How SprintPivot Ltd collects, uses, and protects your personal data
SprintPivot Ltd is a UK-registered company providing an AI-powered career transition platform. Our registered address is available upon written request. We act as the data controller for all personal data collected through our platform.
Contact us about data protection:
Email: privacy@sprintpivot.co.uk
Post: Data Protection Officer, SprintPivot Ltd, United Kingdom
| Category | Examples | Who provides it |
|---|---|---|
| Account data | Name, email address, password (hashed), role | All users |
| Professional profile | Current job title, target industry, years of experience, LinkedIn profile | Job seekers, mentors |
| Company data | Company name, job title, billing address, ATS integration URL | Recruiters |
| Project submissions | Work files, submission links, notes, approach descriptions | Job seekers |
| Mentor feedback | Review scores, written feedback, grading decisions | Mentors |
| Payment data | Stripe customer ID, mandate reference (we never store raw card numbers) | Job seekers |
| Communications | Emails sent to us, support queries | All users |
Under UK GDPR, we must have a valid legal basis for processing your personal data. The bases we rely on are:
| Processing activity | Legal basis (UK GDPR Article) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Delivering learning path, projects, and matching | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and invoicing | Performance of a contract (Art. 6(1)(b)) |
| Sending essential transactional emails (verification, password reset) | Performance of a contract (Art. 6(1)(b)) |
| Sending service updates and progress notifications | Legitimate interests (Art. 6(1)(f)) — improving user outcomes |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
| Security monitoring, fraud prevention, and audit logging | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations (tax, financial records) | Legal obligation (Art. 6(1)(c)) |
| Anonymous analytics and platform improvement | Legitimate interests (Art. 6(1)(f)) |
| Data category | Retention period | Reason |
|---|---|---|
| Active account data | Duration of account + 7 years | Contract, legal obligation |
| Financial and invoicing records | 7 years from transaction | HMRC / Companies Act requirement |
| Project submissions and portfolio items | Duration of account + 3 years | Contract, dispute resolution |
| Mentor review records | Duration of account + 3 years | Contract, audit |
| Audit logs and security events | 2 years | Legitimate interests (security) |
| Email communications | 3 years | Legitimate interests (dispute) |
| Deleted account data | 30 days after deletion request, then purged | Right to erasure (UK GDPR Art. 17) |
| Anonymised analytics data | Indefinitely (no personal data retained) | Legitimate interests (platform improvement) |
We do not sell your personal data. We share data only in the following circumstances:
All processors are subject to data processing agreements (DPAs) ensuring UK GDPR compliance.
We may disclose personal data where required by law, court order, or regulatory authority (e.g. HMRC, ICO, FCA).
In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the new entity, with notice provided to users.
Your data is primarily stored and processed within the UK and European Economic Area. Where any data is transferred outside the UK/EEA (e.g. if a service provider has servers in the USA), we ensure adequate safeguards are in place, including:
You have the following rights regarding your personal data. To exercise any right, email privacy@sprintpivot.co.uk. We will respond within 30 days.
| Right | What it means |
|---|---|
| Right of access (Art. 15) | Request a copy of all personal data we hold about you |
| Right to rectification (Art. 16) | Correct inaccurate or incomplete data |
| Right to erasure (Art. 17) | Request deletion of your data where there is no legal basis to retain it |
| Right to restrict processing (Art. 18) | Request that we limit how we use your data in certain circumstances |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interests, including direct marketing |
| Rights related to automated decision-making (Art. 22) | Not be subject to solely automated decisions with significant effects — our AI grading is always supplemented by human mentor review |
| Right to withdraw consent | Withdraw consent at any time where consent is the legal basis (e.g. marketing emails) |
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
SprintPivot uses the following cookies:
| Cookie name | Purpose | Duration | Basis |
|---|---|---|---|
| PHPSESSID | Session management — keeps you logged in | Session (deleted on browser close) | Strictly necessary |
| _ga, _gid | Google Analytics — anonymous usage statistics | Up to 2 years | Consent |
| __stripe_mid | Stripe fraud detection | 1 year | Legitimate interests |
You can manage cookie preferences in your browser settings. Blocking the PHPSESSID cookie will prevent you from logging in.
We implement the following security controls in line with UK Cyber Essentials and OWASP best practices:
SprintPivot is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has created an account, please contact us at privacy@sprintpivot.co.uk and we will delete the account immediately.
SprintPivot uses AI systems to:
Important: No decision with significant legal or similarly significant effect is made by AI alone. AI grading is always reviewed and signed off by a human mentor before any outcome is recorded in your portfolio. If you disagree with an assessment, you may request human review by contacting support.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Continued use of the platform after changes are notified constitutes acceptance of the updated policy.