Privacy Notice for Supporting Education Group
Date of publication: 02/10/2026
Introduction
We at Supporting Education Group manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
This Privacy Notice applies to the recruitment activities of all companies owned directly or indirectly by Supporting Education Group, including where relevant, internal recruitment activities. Currently, this includes:
Supporting Education Group of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Best Practice Network of Newminster House, 27-29 Baldwin St, Bristol, BS1 1LT
Eden Training Solutions of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Fleet Education Services of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Judicium Education of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
LMP Group of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Neo People Management of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Protocol Education of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
School Business Services of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Speech & Language Link of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Teaching Personnel of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Thrive Approach of 5th Floor, 98 Theobalds Road, London, WC1X 8WB
(each a “Supporting Education Group company”) and references to “we”, “us” and “our” in this notice are to the relevant Supporting Education Group company.
In this privacy notice, we explain how we process your personal data if:
You visit our Career Site (you being a “Visitor”)
You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
The data controller for your personal data will usually be the Supporting Education Group company advertising the role for which you apply. Where recruitment activities are carried out on behalf of multiple group companies, those companies may act as joint controllers where appropriate.
Data Protection Officer (DPO)
We have appointed a data protection officer (“DPO”) to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal information, please contact us or our DPO using the contact details below:
Data Protection Officer: Judicium Consulting Limited
Address: 5th Floor, 98 Theobalds Road, London, WC1X 8WB
Tel: 0345 548 7000 (option 1, then option 1 again)
About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analysing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. An example of a data protection law that is relevant for our use of your personal data, as described in this privacy policy, is the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR).
Most obligations under the UK GDPR apply to the so-called data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a so-called data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller and may not use the personal data for its own purposes.
We are the data controller when we process your personal data as described in this Privacy policy. Teamtailor acts as our data processor and hosts the recruitment platform through which applications are submitted and managed.
For the purposes of this privacy policy, references to GDPR include, where applicable, the UK GDPR and the Data Protection Act 2018. Where we process personal data relating to individuals based in the UK, we do so in accordance with applicable UK data protection law. Where EU data protection law applies, we will also comply with the EU GDPR.
What personal data do we process?
Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
Contact details - Such as your name, email address, telephone number and physical address.
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
AI-assisted recruitment data
Where we use recruitment technology with AI-assisted, automated, matching, scoring, ranking, summarisation or recommendation functionality, we may process data generated from your application, CV, profile, interview notes, assessment results or recruitment communications.
This may include application summaries, suggested skills or experience indicators, candidate matching outputs, workflow recommendations, screening support outputs or other recruitment-related system outputs.
These outputs are used to support our recruitment process and are subject to human review.
At the date of publication, AI-assisted functionality may include CV summarisation, skills extraction, candidate matching, application screening support and workflow prioritisation. We do not use fully automated decision-making to determine whether candidates are offered employment.
In some circumstances, we may process special category data, such as information about disability, health, reasonable adjustments, ethnicity or other equality-related information, where this is necessary and lawful for recruitment, equality monitoring, safeguarding, legal compliance, or to make reasonable adjustments.
We do not use special category data for automated recruitment decisions.
Where special category data is processed, we apply additional safeguards and restrict access to those who need it for legitimate recruitment, legal, safeguarding, equality or adjustment purposes.
Where we process special category data, we do so under one or more conditions in Article 9 UK GDPR, including employment, social security and social protection obligations; substantial public interest; safeguarding; equality of opportunity or treatment monitoring; or with your explicit consent where required.
Where do we receive your personal data from?
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
From your references. If you provide us with references, we may collect information about you from them.
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 9 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 9 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy. Please refer to our Cookie Policy for further information, which is available on our website, https://www.supportingeducation.com/.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and otherwise ensure the security of the career site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data used: Communications data.
Where interviews are recorded, we will inform you in advance and, where required, obtain your consent before recording takes place.
Contact you to ask for your participation in surveys
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you to ask you to provide information about a candidate and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
If you fail to provide personal information
If you fail to provide information when requested, where this information is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require references for this role and you fail to provide us with relevant details, we will not be able to take your application further. However, when we rely on your consent to collect your personal information and you select not to provide such information, this will not affect your application with us in any way. If we rely on your consent or if any information we request during your application process is optional, we will let you know at that point.
AI, automation and human review
We may use recruitment technology that includes AI-assisted or automated functionality as part of our recruitment process. These tools may help us process applications, manage recruitment workflows, summarise information, identify relevant skills or experience, or support candidate matching.
We do not make final recruitment decisions based solely on automated processing where that decision would have a legal or similarly significant effect on you. Recruitment decisions are reviewed and made by appropriate Supporting Education Group employees or authorised representatives.
Where AI-assisted tools are used to support recruitment activity, we apply appropriate safeguards. These include human review, access controls, audit records, periodic review of tool outputs, and checks designed to identify and reduce unfair bias, inaccurate results or inappropriate reliance on automated recommendations.
If you have concerns about the use of AI-assisted tools in relation to your application, you can contact us using the details in this policy.
Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
Applicant tracking system provider and recruitment technology suppliers. Our applicant tracking system and careers site provider, Teamtailor, processes candidate data on our behalf as our data processor.
Where we use additional recruitment technology providers, assessment providers, interview tools, automation tools, analytics tools, AI-assisted recruitment functionality or connected integrations, those suppliers may also process personal data on our behalf where this is necessary to support our employer branding and recruitment process.
We require our service providers to process personal data only in accordance with our instructions, applicable data protection law, and appropriate contractual, technical and organisational safeguards.
On what legal basis do we process your personal data?
To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under the UK GDPR.
When we process your personal data for the purposes described in this Privacy Notice, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence for us. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.
Our legitimate interests include attracting suitable candidates, managing recruitment processes efficiently and consistently, maintaining recruitment records, assessing suitability for employment and defending legal claims arising from recruitment decisions.
You can contact our DPO for more information about how this assessment was made.
There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you.
Legal basis for AI-assisted recruitment processing
Where we use AI-assisted or automated functionality to support recruitment administration, candidate matching, application review, workflow prioritisation, summarisation or recruitment decision support, we will only do so where we have a lawful basis under applicable data protection law.
In most cases, this processing will be based on our legitimate interest in managing an effective, fair, consistent and efficient recruitment process, provided that our interests are not overridden by your rights and freedoms.
Where consent is required for a specific form of processing, such as recording an interview or using a specific assessment process that requires consent, we will ask for your consent separately.
We do not use AI-assisted tools as the sole basis for making final recruitment decisions where such decisions would have a legal or similarly significant effect on you.
When do we transfer your personal data outside of the UK and/or EU/EEA, and how do we protect it then?
We always strive to process your personal data within the UK and/or EU/EEA area.
However, some of our service providers process your personal data outside of the UK and/or EU/EEA.
We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the UK and/or EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside the UK and/or EU/EEA, for example because of an authority request.
In cases where another recipient of your personal data (as described in Section 9 above) is based outside the UK and/or EU/EEA, this will also mean that your personal data is transferred outside the UK and/or EU/EEA.
When we, or one of our suppliers, transfer your personal data outside the UK and/or EU/EEA, we will ensure that a safeguard recognised by the UK GDPR is used to enable the transfer. We use the following safeguards:
A decision by the EU Commission that the country outside of the UK and/or EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. In particular, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the UK and/or EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected.
When your personal data is transferred outside the UK and/or EU/EEA, we also implement appropriate technical and organisational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside the UK and/or EU/EEA you can contact our DPO.
Transfers involving recruitment technology and AI-assisted suppliers
Where recruitment technology, AI-assisted functionality, automation tools, assessment providers, integrations or other recruitment-related service providers involve the transfer of personal data outside the UK, EU or EEA, we will ensure that appropriate safeguards are in place.
These may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, transfer risk assessments, contractual controls, and appropriate technical and organisational security measures.
For how long do we keep your personal data?
All individuals. If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
Visitors. We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes. Please refer to our Cookie Policy for further information which is available on our website, https://www.supportingeducation.com/.
Candidates. If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.
Following the six-month retention period, we will either delete your data or seek your consent if we wish to retain your details for future opportunities.
If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.
Interview recordings will normally be retained only for the duration of the recruitment process and any applicable recruitment retention period unless required for legal proceedings or regulatory purposes.
References. We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
Retention of AI-assisted recruitment outputs. Where AI-assisted or automated recruitment tools generate outputs relating to your application or profile, such as summaries, matching outputs, recommendations, workflow indicators or screening support outputs, those outputs will be retained only for as long as necessary for the recruitment purpose for which they were created.
They will be retained in line with our candidate retention periods, unless a longer retention period is required for legal claims, safeguarding, regulatory obligations, audit purposes, or to protect and enforce our rights.
Talent pooling and future opportunities. If we would like to keep your details for future opportunities after a recruitment process has ended, we will do so where we have a lawful basis, such as your consent or our legitimate interest.
You can ask us to delete your profile or stop contacting you about future opportunities at any time, unless we need to retain certain information for legal, safeguarding, regulatory or claims-related reasons.
Security
We have put in place measures to protect the security of your information (i.e. against it being accidentally lost, used or accessed in an unauthorised way). In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. Details of these measures are available on request.
What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
Please note these rights may be limited, for example if fulfilling your request would reveal personal data about another person or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. We will inform you of the relevant exemptions upon which we rely when responding to any request you make.
If you want to exercise any of your data protection rights, please contact the DPO in writing. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Where AI-assisted tools are used in recruitment, you may request further information about how these tools were used in your application and may object to processing carried out on the basis of our legitimate interests where applicable.
Right to be informed. You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this Privacy Notice, through updates on our Career Site (see also Section 6 above), and by answering any questions you may have for us.
Right to access your personal data. You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”). You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”). In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data. You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing. If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification. You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent. When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right to raise a complaint. If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in United Kingdom. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
How to complain
We hope that our DPO can resolve any query or concern you raise about our use of your information.
For further information about your rights or how to make a formal complaint, in the first instance, please contact us using the contact details at the top of this Privacy Notice.
If you remain unhappy with how your complaint has been addressed, you can also complain the Information Commissioner’s Office (ICO) using the following details:
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
