Data Processing

For individual customers, JobStatement normally acts as the data controller because we decide how information is used to deliver and manage the service.

If a school, agency or other organisation instructs us to process material on its behalf, that organisation may be the controller and JobStatement may act as its processor under a separate written agreement.

Processing may cover names, contact information, employment and education history, teaching experience, job criteria, personal statements, form answers, feedback and service correspondence. It includes receiving, organising, reviewing, annotating, rewriting, securely storing, returning and deleting that information.

Only people who need the material to deliver or support the service should access it. This may include qualified teacher reviewers and providers of secure hosting, email, payments, document handling, analytics and administration.

Reviewers and providers are required to follow confidentiality, security and purpose-limitation requirements. We remain responsible for selecting and overseeing providers appropriately.

Customers should not include pupil-identifying information, safeguarding details, health information, criminal-offence information or confidential records about another person. Examples should be anonymised. If unnecessary sensitive information is received, we may remove it or ask for a replacement document.

We use proportionate access controls and organisational safeguards. Submitted materials and related appraisal records are normally retained for 12 months after the service ends, then deleted or irreversibly anonymised, unless a dispute or legal duty requires a longer period.

You may request earlier deletion. We will comply where there is no overriding contractual or legal reason to retain the information. Backup copies may remain for a limited cycle before secure deletion.

Where a provider processes information outside the UK, we use a recognised transfer safeguard. If a personal-data incident creates a risk to individuals, we will investigate, limit harm and make any legally required notifications.

Questions about processing or requests for a controller-to-processor agreement can be sent to ask@jobstatement.com.