Privacy notice
How we handle your data. Plain English, no small print.
This notice explains what personal data NextStep UK collects, why we collect it, how long we keep it and the rights you have over it. It applies to nextstepuk.org and every feature on it.
Who we are
NextStep UK is the data controller for the personal data you provide when you use this service. You can contact us about anything in this notice at privacy@nextstepuk.org.
What data we hold
- Account data — email address, and optionally a display name, home postcode (used only to sort vacancies by distance) and year group.
- Activity data — saved apprenticeships, application tracker entries, career assessment answers and results, CVs you build, and vacancy alerts you set up.
- Technical data — IP address, browser type and timestamps in our server logs, kept to run the service securely and prevent abuse.
We do not collect special category data (such as health, ethnicity or religion) and we ask you not to include it in free-text fields such as your CV summary.
Why we use it, and our lawful basis
- To provide the service — saving opportunities, tracking applications, building CVs. Lawful basis: performance of a contract (our terms of use).
- To personalise results — matching your quiz profile and postcode to apprenticeship routes and vacancies. Lawful basis: legitimate interests (giving you relevant guidance), or consent where you provide optional details.
- To send service emails — sign-in links, password resets, CV download links and vacancy alerts you asked for. Lawful basis: contract and consent.
- To keep the service secure — logging, rate limiting and abuse prevention. Lawful basis: legitimate interests.
We do not use your data for automated decision-making that has a legal or similarly significant effect on you. Quiz results are guidance only and never restrict what you can apply for.
Who we share it with
We never sell your data. We do not share it with employers, schools, colleges or careers advisers without your explicit, revocable consent.
We use a small number of trusted processors to run the service:
- Lovable Cloud (built on Supabase) — database, authentication and hosting.
- Lovable Emails — sending transactional emails such as sign-in and CV download links.
- GOV.UK Find an apprenticeship (Department for Education) — we request vacancy data from this service. We do not send your personal data to it.
- postcodes.io — converts a postcode into approximate coordinates so we can show distance and map results. Only the postcode is sent.
We may disclose data if we are legally required to, or where it is necessary to protect someone's safety (see our safeguarding page).
Where your data is stored
Your data is stored on servers within the UK/EEA where possible. Where a processor transfers data outside the UK, that transfer is covered by UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Account and activity data — for as long as your account is open, then deleted within 30 days of you deleting your account.
- Inactive accounts — if you don't sign in for 24 months we'll email you, and delete the account if you don't respond.
- Guest quiz results and draft CVs — stored only in your own browser until you clear them or save them to an account.
- Server logs — up to 12 months.
Your rights
- Access — download everything we hold about you from your account page, or ask us.
- Rectification — edit your profile at any time.
- Erasure — delete your account permanently from your account page.
- Restriction and objection — ask us to pause or stop a particular use of your data.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — at any time, without affecting anything done before you withdrew it.
Email privacy@nextstepuk.org and we'll respond within one month. If you're unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Young people and age
NextStep UK is designed for 16–21 year olds. You must be at least 13 to create an account. If you are under 18 and would like a parent, carer or teacher to help you understand this notice, please do — and email us if anything isn't clear. If we learn that a child under 13 has created an account, we will delete it.
Cookies
We use strictly necessary cookies and browser storage only. See our cookie policy for the full list.
Changes to this notice
If we make significant changes we'll update the date at the top of this page and, where the change affects you, tell account holders by email.
Contact
Data protection queries: privacy@nextstepuk.org
General enquiries: hello@nextstepuk.org