Gradspace.

DRAFT — not yet legal advice. This policy has been prepared as a working draft that reflects standard UK GDPR practice. Have it reviewed by a qualified solicitor before you publish it or rely on it.

Privacy Policy

Last updated: 28 July 2026 · Applies to gradspace.uk and the Gradspace platform

Contents

Who we are
What we collect
Why & lawful basis
Who we share with
How long we keep it
Your rights
Security & location
Age
Cookies
Contact & complaints

1. Who we are

Gradspace is operated by Gradspace Ltd ([company number], registered in England & Wales at [registered address]). We are the data controller for the personal data described here. For any privacy question, contact us at privacy@gradspace.uk.

2. What personal data we collect

Depending on how you use Gradspace, we may collect:

Account	Name, email address, password (stored securely hashed), account type (graduate or practice).
Graduate profile	Portfolio links, skills, qualification stage, location, salary expectations, availability, deal-breakers, and anything you choose to add.
Practice profile	Company name, location, website, description, and verification details.
Activity	Pitches sent/received, your responses, and messages exchanged on the platform.
Technical	Basic device/session data needed to keep you logged in and to keep the service secure.

We do not collect special-category data (such as health or ethnicity) and ask that you don't add it to your profile.

3. Why we use it, and our lawful basis

To provide the service — creating your account, showing profiles, and enabling pitches and messages (lawful basis: performance of a contract).
To keep you informed — notifications about pitches, replies and responses (lawful basis: contract / legitimate interests).
To keep Gradspace safe and improve it — preventing abuse, fixing problems, understanding usage (lawful basis: legitimate interests).
Marketing — only where you've asked to hear from us, e.g. the waitlist (lawful basis: consent, which you can withdraw anytime).

Gradspace is a marketplace, so some data is shared by design:

Graduate profiles are visible to verified practices on the platform, so they can pitch you. You control what's on your profile.
Practices you interact with see the messages and responses you send them.
Service providers who help us run Gradspace (e.g. our hosting and database provider, Supabase; our email provider) under strict data-processing terms.

We never sell your personal data.

5. How long we keep it

We keep your data while your account is active. If you delete your account, we remove your personal data within 30 days, except where we must keep limited records for legal or security reasons.

6. Your rights

Under UK GDPR you have the right to: access your data; correct it; delete it; restrict or object to processing; and receive a portable copy. To exercise any of these, email privacy@gradspace.uk and we'll respond within one month.

7. Security & where your data lives

Your data is hosted in the UK/EU region. Passwords are hashed, access is protected by row-level security so users can only see their own data and what they're meant to, and connections are encrypted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

8. Age

Gradspace is intended for users aged 18 or over. We don't knowingly collect data from anyone under 18.

9. Cookies & storage

We use a small amount of essential storage to keep you logged in and remember your preferences. See our Cookie & Data Notice for details.

10. Contact & complaints

Questions or concerns: privacy@gradspace.uk. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Gradspace Ltd · Where graduates hold the power · This is a draft pending legal review.