Privacy
Policy

Who We Are

Grad2Grid is an online platform connecting young applicants with employers in the United Kingdom, operated by an individual based in the UK.

For the purposes of UK GDPR, Grad2Grid is the data controller for personal information collected through the Platform. You can contact us at info@grad2grid.com with any privacy-related queries.

What Data We Collect

When you register and build your profile:

• Name, email address and password. Your password is handled by Firebase Authentication and we never see it
• Account type (applicant or employer)
• Postcode, city, region, and approximate location coordinates (latitude and longitude), used for distance-based search. Only your city is ever shown to other users. Your postcode and coordinates are never displayed
• Trade, experience level, skills, qualifications and work experience (applicants)
• Company name, sector, job listings, logo and branding (employers)
• Anything else you choose to add, such as a bio
• The date you accepted our Terms and Privacy Policy, and which version you accepted
• If you signed up through a creator's link or entered a referral code: that code, and whether you later took a paid plan. We use this to measure and pay the creators who promote Grad2Grid. Creators only ever see totals, never who you are

When you use the Platform:

• Messages you send to other users, and the people you have blocked
• Reports you submit about other users (the reason, any details you provide, and who you reported), used to investigate misuse and keep the Platform safe
• A record of the profiles and company pages you view and when. If the owner has a paid plan that includes profile views or analytics, they can see your name, account type and trade or sector
• Applicants you have shortlisted (employers only)

If you request a CV review (Premium applicants):

• The CV you upload and any notes you add. Only you and the Grad2Grid team can see your CV, and it is never shown to employers
• The feedback we send you

If you brand your company page (Brand Platinum employers):

• Your company logo, brand colour and tagline. These are public, like the rest of a featured employer's homepage details

If you verify a company (employers):

• Your Companies House number, and the company's registered name and status as returned by Companies House

If you buy a paid plan:

• Your plan, subscription status, billing dates, and payment and invoice history
• Your confirmation at checkout that you agreed to the Terms and, for applicants, that you are 18 or over
• Card details are entered directly with our payment provider, Stripe. We never see or store your full card number. Stripe shares only a customer reference and the details above with us

Security data:

• To protect the Platform from bots and abuse, Google reCAPTCHA collects technical information such as your IP address, browser and device details, and how you interact with the page

How We Use Your Data

We use your personal data to:

• Create and manage your account
• Display your profile to other relevant users on the Platform
• Enable messaging between applicants and employers, and enforce blocks and plan limits
• Show users relevant profiles and jobs within a selected travel distance
• Show users with an eligible paid plan who has recently viewed their profile
• Verify employer companies against Companies House
• Take payments, manage subscriptions and keep financial records
• Send you important service emails, such as email verification, password resets and billing receipts
• Investigate reports, prevent fraud and abuse, and keep the Platform secure
• Measure which creators and partners bring people to Grad2Grid, and pay them for it
• Improve and develop the Platform
• Comply with legal obligations

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract: to provide the Grad2Grid service and any paid plan you sign up for, including your profile, messaging, search and billing
• Legitimate interests: to keep the Platform safe and secure, prevent fraud and abuse, investigate reports, improve the Platform, and measure and pay the creators who promote it
• Legal obligation: to keep financial records for tax purposes, and to respond to lawful requests
• Consent: where you have explicitly agreed to a specific use of your data. You can withdraw consent at any time

Who We Share Your Data With

We share your data only with the following:

• Google Firebase (Google LLC): our infrastructure provider for sign-in, database storage, server functions and hosting
• Google reCAPTCHA Enterprise (Google LLC): checks that requests to the Platform come from real people and not bots
• Stripe: processes payments and manages subscriptions. Stripe also uses payment data for its own fraud prevention and legal obligations, as described in Stripe's Privacy Policy
• postcodes.io: we send the postcode or place name you enter (never your name or email) to look up its location
• Companies House: we send the company number an employer enters, to check that the company exists and is active
• Google Fonts: loads the fonts used on the Platform. Your browser sends your IP address to Google to do this
• Other users: your profile information is visible to other registered users of the Platform. Brand Platinum employers' company name, sector, city, logo and branding are also shown publicly on our homepage
• Authorities: where the law requires it, or where needed to protect someone's safety

We do not sell your personal data to third parties. We do not share your data with advertisers.

International Transfers

Our database is hosted in the UK (London). Google and Stripe may process some data in other countries, including the United States. Where that happens, transfers are protected by the UK–US Data Bridge, the UK International Data Transfer Agreement or Addendum, or another safeguard recognised under UK GDPR.

Data Retention

• Account and profile data: kept while your account is active. If you delete your account, we delete it within 30 days
• CVs sent for review: kept while your account is active so you can request another review. You can ask us to delete your CV at any time
• Company page statistics (daily view counts for employers): kept for up to 2 years
• Messages: may be kept for up to 12 months after a conversation ends, for safety and moderation
• Reports: kept for as long as needed to investigate and act on them, and for up to 2 years afterwards to deal with repeat misuse
• Billing records (invoices, payments and subscription history): kept for 6 years after the end of the tax year they relate to, as required by UK tax law, even if you delete your account
• Records of your agreement to our Terms: kept for 6 years after your account closes, in case of a dispute

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at info@grad2grid.com. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

Cookies & Browser Storage

We only use cookies and browser storage that are strictly necessary: to keep you signed in, protect the Platform from bots, take payments, and make features like unread messages work. We do not use analytics, tracking or advertising cookies. See our Cookie Policy for the full list.

Security

We take the security of your personal data seriously. Your data is stored on Google Firebase infrastructure. Access is controlled by security rules, so private details such as your email address and exact postcode can only be read by you. Passwords are handled by Firebase Authentication and never stored in plain text. All data sent to and from the Platform is encrypted over HTTPS.

However, no method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

Data Breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours as required by UK GDPR, and we will notify affected users without undue delay where the breach is likely to result in a high risk to their rights.

Children's Privacy

Grad2Grid is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has provided us with personal data, please contact us at info@grad2grid.com and we will delete it promptly. For users aged 16 to 17, we apply additional protections in line with the ICO's Age Appropriate Design Code (Children's Code) to ensure their data is handled with appropriate care. Paid plans are only available to users aged 18 or over. Users aged 16 to 17 can use all free features but cannot buy a paid plan.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will tell you on the Platform and ask you to review them the next time you sign in. The date at the top of this page shows when the policy was last updated.