01Who we are

Career People Ltd (“we”, “us”, “our”), trading as Council People, is the data controller responsible for the personal data described in this policy. This means we decide why and how your personal data is processed.

We are not required to appoint a statutory Data Protection Officer. Responsibility for data protection sits with the company's directors, who can be reached at the address above.

02Scope of this policy

This policy applies to personal data we process through our websites at councilpeople.co.uk, councilpeople.com and any associated subdomains or hosted job board pages (together, the “Site”), and through the services we provide to job seekers and to employers.

It explains our practices under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

It does not apply to the websites of councils or other employers that you reach by following a link from our Site. Those organisations are separate data controllers with their own privacy policies. See section 16.

03How our service works

Council People is a job aggregator. We collect publicly advertised vacancies from UK local authorities and present them in one searchable place. Understanding this model explains why we hold so little data about you.

The vacancy information we display (job titles, descriptions, salaries, locations, employer names) is published by councils for the purpose of recruitment. Where such listings incidentally contain the name or contact details of a named contact at the council, we process that information on the basis of our legitimate interests in operating a job board (section 5), and we will remove it on request.

04Personal data we collect

4.1 Job seekers (candidates)

If you subscribe to job alerts, we collect and store your email address, and nothing else. We do not ask for, and do not hold, your name, address, telephone number, date of birth, CV, employment history, or any special category data (such as health, ethnicity, religion, sexual orientation or trade union membership).

You do not need an account, and you do not need to give us any personal data, to browse or search the Site.

4.2 Employers and councils

If your organisation registers for an account to post vacancies, we collect:

• Account details — the name and work email address of the person registering, the organisation name, and a password (stored in hashed form; we never see it in plain text).


• Listing content — the vacancy details, organisation profile and logo that you choose to publish.


• Transaction records — where you purchase a paid listing, a record of the order, amount, date and invoice. Card details are entered directly into Stripe and are never received or stored by us.


• Correspondence — any messages you send us and our replies.

4.3 Everyone who visits the Site

Our platform and analytics providers process limited technical data, which may constitute personal data:

• Device and connection data — IP address, browser type and version, operating system, and device type.


• Usage data — pages viewed, time on page, referring website, links clicked, and search or filter terms used on the Site.


• Campaign data — where you arrive via a tagged link, the UTM parameters identifying the source, medium and campaign.


• Security and operational logs — records generated by our hosting platform to detect abuse and keep the service running.

Analytics data is only collected where you have consented to analytics cookies. See section 7.

05Lawful bases for processing

UK GDPR requires us to have a lawful basis for each processing activity. Ours are set out below.

Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests do not override your rights and freedoms. You may ask us for information about that assessment, and you have the right to object (section 11).

06Job alert emails and marketing

If you subscribe, we send you emails containing newly listed local government vacancies. These emails are sent on the basis of your consent, which you give by actively subscribing.

• Every email contains a one-click unsubscribe link.


• Unsubscribing takes effect promptly and permanently, and we will delete your email address (see section 10).


• We do not send you advertising, third-party offers, or promotional emails on behalf of anyone else.


• We do not pass your email address to councils, recruiters, advertisers or data brokers.

If you hold an employer account, we may send you service messages that are necessary to operate that account — for example, confirming a listing has gone live, sending an invoice or receipt, notifying you that a listing is about to expire, or informing you of important changes to the service. These are not marketing messages and cannot be unsubscribed from while your account remains open, though you may close your account at any time.

07Cookies and similar technologies

Cookies are small files placed on your device. Under PECR we may only place non-essential cookies with your consent, which we ask for by means of a cookie banner when you first visit.

We do not use advertising cookies, retargeting pixels, social media trackers, or any cookie that profiles you for marketing purposes. We carry no advertising on the Site.

You can withdraw or change your cookie consent at any time using the cookie settings link on the Site, and you can block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the Site working.

08Who we share data with

We do not sell, rent or trade your personal data. We share it only with the service providers we need to run the Site, and where the law requires it.

The following providers act as our processors, or as independent controllers where noted. Each is bound by a contract that requires appropriate security and permits processing only on our instructions.

We may also disclose personal data where we are required to do so by law, by a court order, or by a regulator; where necessary to establish, exercise or defend legal claims; or to prevent fraud, abuse or harm to any person. If our business is sold or restructured, data may transfer to the acquiring entity, and we will tell you before it becomes subject to a different privacy policy.

09International transfers

Some of our providers are based outside the United Kingdom, or process data on servers outside the UK — principally in the United States and the European Economic Area.

Where personal data leaves the UK, we make sure it is protected to a standard essentially equivalent to UK law, using at least one of the following safeguards:

• UK adequacy regulations, where the destination country is recognised by the UK Government as offering adequate protection (this includes transfers to the EEA).


• The UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it.


• The UK's International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment where appropriate.

You may request a copy of the relevant safeguard by contacting us at support@councilpeople.com.

10How long we keep data

We keep personal data only for as long as we need it for the purpose we collected it, and then delete it.

Where we are required to keep data for a legal, accounting or regulatory reason, we retain only what that obligation requires and restrict access to it.

11Your rights

Under UK GDPR you have the following rights. They are free to exercise, and we will not treat you differently for using them.

• Right of access — to be told whether we hold personal data about you, and to receive a copy of it.


• Right to rectification — to have inaccurate data corrected, and incomplete data completed.


• Right to erasure (“right to be forgotten”) — to have your data deleted where there is no good reason for us to keep it.


• Right to restrict processing — to ask us to pause our use of your data in certain circumstances.


• Right to data portability — to receive data you gave us, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.


• Right to object — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.


• Right to withdraw consent — at any time, where we rely on consent. This does not affect the lawfulness of processing carried out before you withdrew it.


• Rights relating to automated decision-making — see section 15. We do not carry out such processing.


• Right to complain to the Information Commissioner's Office — see section 19.

12How to exercise your rights

Email support@councilpeople.com, or write to us at the registered office in section 1. Please tell us which right you wish to exercise.

• We respond within one month of receiving your request. If your request is complex, or you have made several, we may extend this by up to two further months and will tell you within the first month if so.


• We may ask you for information to confirm your identity, so that we do not disclose data to the wrong person. We will ask only for what is necessary.


• Requests are free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — and we will explain why and tell you how to challenge that decision.

If you want data relating to a job application, please contact the council you applied to. We never receive applications, so we cannot access, correct or delete them (see section 3).

13Security

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, as required by Article 32 UK GDPR. These include:

• Encryption of data in transit using TLS across the whole Site.


• Storing account passwords only as salted hashes, never in plain text.


• Delegating card payments to Stripe, a PCI-DSS Level 1 certified provider, so that we never handle card data.


• Restricting access to personal data to those who need it, protected by strong authentication.


• Selecting reputable providers and putting written data processing terms in place with them.


• Collecting the minimum data necessary — the single most effective safeguard we apply.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do, however, maintain procedures to deal with any suspected breach (section 17).

14Children and young people

Our job alert service is available to people aged 16 and over. This reflects section 9 of the Data Protection Act 2018, under which a child aged 13 or over can consent to information society services, and our own decision to set the threshold at 16 for a service concerned with employment.

We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has subscribed, contact support@councilpeople.com and we will delete the email address promptly.

Vacancies for apprenticeships, work experience and graduate schemes may be of interest to younger people. Anyone may browse and search the Site without providing any personal data; only the alert subscription carries the age threshold. Applications are always made on the council's own website, subject to that council's rules.

15Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22 UK GDPR.

We do not screen, score, rank or profile candidates. We do not build behavioural profiles for advertising. Job alert emails are compiled by matching newly published vacancies against the alert you asked for; this is a simple filter, not a decision about you.

16Links to council and third-party websites

The Site links to the recruitment pages of councils and other employers, and may link to other third-party sites. When you follow such a link you leave our Site.

Each council is an independent data controller for any personal data you provide to it, including your application. We do not control those websites, we are not responsible for their content or their privacy practices, and this policy does not apply to them. We encourage you to read the privacy notice of any site before providing personal data to it.

17Data breaches

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office without undue delay and within 72 hours of becoming aware of it, as required by Article 33 UK GDPR.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly and without undue delay, describing what happened, its likely consequences, and the steps we are taking.

18Changes to this policy

We may update this policy to reflect changes in our service, our providers, or the law. The effective date and version number at the top of this page always show the current edition.

Where a change materially affects how we use your personal data, we will give you prominent notice — for example, a notice on the Site or, where we hold your email address and it is appropriate to do so, an email. Where a change requires your consent, we will ask for it before the change takes effect.

19Complaints

If you are unhappy with how we have handled your personal data, please tell us first at support@councilpeople.com. We would like the chance to put it right.

You also have the right to complain at any time to the UK supervisory authority for data protection:

Complaining to the ICO does not affect any other legal remedy available to you, including the right to seek compensation through the courts.

20Contact us