Your information
PRIVACY POLICY
A clear explanation of what personal information HeadHunters Academy may use, why it is needed and the choices and rights available to you.
Prepared 3 September 2026 · Review at least annually and whenever the service or law changes
Who is responsible for your information
HeadHunters Academy (Company 15774032), is the data controller when it decides why and how the personal information described in this notice is used. The company number is 15774032 and the registered office is 75–76 Kirkgate, Leeds, England, LS2 7DJ. The ICO registration reference supplied by the controller is 00011378496.
Jenine Hunter and Bradley Walton are the controller representatives. Privacy enquiries and formal complaints can be sent to hello@headhunterssalon.co.uk, made by telephone on 07719 725041, or sent by post to the registered office above.
Information we may use
- Identity and contact information: name, date of birth where eligibility requires it, address, email, telephone number and emergency contact details.
- Enquiry, application and enrolment information: course interests, prior learning, qualifications, employment, eligibility evidence, funding information and communications.
- Learning and assessment information: attendance, progress, feedback, submitted evidence, assessment decisions and reasonable-adjustment records where applicable.
- Account information: staff-created username, access permissions, login and security records, display photograph, short biography and optional links supplied by the learner.
- Technical information: security logs, device and browser information, page requests and aggregate website statistics.
- Special-category or safeguarding information: health, disability, support needs or safeguarding information only where necessary and with an identified UK GDPR condition and appropriate access controls.
Information may come from you, a parent or carer where appropriate, an employer, previous provider, awarding or assessment organisation, government service, funding body or another source you authorise. We will explain the source when required.
Why we use information and our lawful bases
| Purpose | Likely lawful basis |
|---|---|
| Answer enquiries and take steps towards an application or booking | Steps at your request before a contract; legitimate interests in administering genuine enquiries |
| Deliver and administer a private course | Contract; legal obligations; legitimate interests in safe and effective delivery |
| Check apprenticeship eligibility, agree training and retain audit evidence | Contract, legal obligation and obligations arising from the applicable funding agreement; any public-task basis must be separately documented |
| Create and secure a staff-managed learner account | Contract, legitimate interests and legal obligations relating to secure education administration |
| Arrange support, reasonable adjustments or safeguarding action | An Article 6 basis plus a documented Article 9 or Schedule 1 condition where special-category information is used; vital interests may apply in an emergency |
| Send optional marketing | Consent, or the electronic-mail soft opt-in only where its legal conditions are met; every message must offer an easy opt-out |
| Produce aggregate statistics to improve the public website | Legitimate interests under UK GDPR and, if storage or access technology is used, the PECR statistical-purpose exception only while its strict conditions are met |
HeadHunters must document the final lawful basis for each operational process before collecting information through a future VLE, booking system or community feature.
Children and young people
Some apprentices may be under 18, so their information requires particular care. Public self-registration is disabled. Learner accounts are created by authorised staff, private by default and limited to the information needed for the current service. Student profile information is not intended to appear in public search results, and behavioural advertising must not operate in authenticated learner areas.
Before any VLE, messaging, community, automated recommendation or app feature is commissioned, HeadHunters should complete a data-protection impact assessment, a safeguarding assessment and an age-appropriate design assessment. Education processing may be treated differently from a commercial online service under the ICO Children’s Code, so each feature must be assessed on what it actually does rather than relying on a blanket exemption.
Who information may be shared with
Where necessary and lawful, information may be shared with employers, awarding and assessment organisations, apprenticeship funding or government bodies, auditors, inspectors, safeguarding authorities, professional advisers and carefully selected technology suppliers acting under contract.
Sarah Kane is the currently approved person for processing administration under HeadHunters’ authority. Her access must remain limited to assigned duties. If she supplies services independently rather than as authorised staff, written UK GDPR processor terms must define the subject matter, duration, purpose, data types, security, confidentiality, sub-processing, deletion and audit requirements.
Current or proposed technology categories include website hosting, WordPress components, account management, email delivery, backups, security and privacy-first analytics. Before live publication or use of a future VLE, material providers must be recorded with their purpose, role, contract and any international transfer safeguards.
If information is transferred outside the UK, HeadHunters will use an applicable adequacy regulation or approved safeguards and complete any required transfer-risk assessment. Information will not be sold.
How long information is kept
The approved working baseline is six years for core learner, apprenticeship, assessment, contractual and financial records, measured from the end of the relevant learner or contractual relationship. A longer or shorter period applies where a funding rule, awarding organisation, safeguarding requirement, legal obligation or documented operational need requires it. HeadHunters reviews records at the end of their period and securely deletes or anonymises information that is no longer needed.
- General enquiries: up to 24 months after the last meaningful contact.
- Unsuccessful applications: normally 12 months, unless a longer period is justified and explained.
- Private-course contracts, payment records and core learner records: six years after the relevant relationship ends.
- Apprenticeship and assessment evidence: six years after completion or withdrawal unless the applicable funding agreement, awarding body or audit rules require a different period.
- Safeguarding and welfare records: kept under a separately approved safeguarding schedule because an automatic six-year deletion may not be appropriate.
- Inactive website accounts: disable promptly when access is no longer required; retain only the underlying records justified by this schedule.
- Routine security logs: normally no more than 90 days unless needed to investigate an incident or meet a documented security requirement.
Your data-protection rights
Depending on the purpose and lawful basis, you may have rights to be informed, access your information, correct it, request erasure, restrict use, object, receive portable information and challenge certain automated decisions. Consent can be withdrawn at any time without affecting earlier lawful use.
Your right to object: you may object to processing based on legitimate interests and may object to direct marketing at any time. Email the privacy contact above. We may need to verify your identity and will explain if a legal exception limits a request.
You can complain to the Information Commissioner’s Office (opens in a new tab). We would appreciate the opportunity to address the issue first.
Security, cookies and changes
HeadHunters uses role-based access, staff-managed accounts, strong authentication practices, encrypted connections, backups, updates and restricted administration to protect information. No system is completely risk-free; suspected incidents are assessed and reported where the law requires.
Read the Cookie Policy for website technologies and choices. We will update this notice before introducing materially different uses of information and draw important changes to the attention of affected people.