Privacy Policy

How we collect, use, share and protect your personal data when you use Ralspin in the United Kingdom, in accordance with the UK GDPR and the Data Protection Act 2018.

§ 01Who we are (controller)

Ralspin is a curated subscription service that helps families, young adults, sixth-form colleges, schools and multi-academy trusts discover summer schools, apprenticeships, fellowships, research placements, T Levels, certifications and youth conferences, with deadline alerts and 1:1 consultation sessions.

The "controller" of your personal data for the purposes of the UK GDPR is Fezzo Consulting LLC, a Michigan limited liability company doing business as Ralspin ("we," "us," "our," "Ralspin").

As a controller established outside the UK that offers services to individuals in the UK, we have appointed a UK Representative under Article 27 of the UK GDPR. The UK Representative may be contacted at [email protected]. We are registered with the UK Information Commissioner's Office (ICO) under registration number [registration number to be added].

Our Data Protection Officer (DPO) can be contacted at [email protected].

§ 02Scope and updates

This policy applies to personal data we collect about individuals located in the United Kingdom through our website, mobile interfaces, SMS messages, email communications and consultations. If you access Ralspin from outside the UK, please refer to the United States or Canadian version of this policy as appropriate.

§ 03What we collect

Account data

Name, email address, mobile telephone number, hashed password, subscription plan (Self-Starter, Household or Institution), and for institutional accounts, your role and the name of your school, college or trust.

Match profile data

Postcode, audience type, opportunity categories you select, and optionally year group, academic interests, bursary preferences and accessibility needs.

Student profile data (Household and Institution plans)

Up to four student profiles on a Household plan and up to 500 on an Institution plan, including first name or initials, year group, age range, interests and saved opportunities.

Payment data

Processed by our payment partner (such as Stripe). We do not store full card numbers; we receive a tokenised reference, the last four digits, the card brand, billing postcode and transaction history.

Communications data

Records of your contact with us by email, telephone, in-product chat and during consultation sessions.

Usage and technical data

Pages viewed, opportunities saved or skipped, searches run, IP address, browser type, device identifiers, operating system, language preference, time zone, referring URL and approximate location derived from IP. We use first-party cookies and similar technologies; see our Cookie Policy.

§ 04Purposes and lawful bases

We process personal data only where we have a lawful basis under Article 6 of the UK GDPR:

Where we rely on legitimate interests, we have carried out a legitimate-interests assessment to ensure those interests are not overridden by your rights and freedoms. You may obtain further information about that assessment by contacting our DPO.

§ 05Special category and children's data

We do not require you to provide special category data (such as data revealing racial or ethnic origin, religious beliefs, health data or biometric data) to use the service. If you voluntarily provide such information in the course of a consultation or via accessibility-related questions, we process it on the basis of your explicit consent (Art. 9(2)(a)) and we apply heightened safeguards.

The service is not directed to children under 13. We do not knowingly collect personal data directly from a child under 13. Parents or guardians using a Household plan may create student profiles for their children that include limited information (first name or initials, year group, age range, interests). For UK GDPR purposes, a child aged 13 or over may consent to information society services in their own right, and the age of digital consent in the UK is 13. Schools using an Institution plan may operate under their own data processing arrangements; where we act as a processor under a school's instructions, we will enter into a written data-processing agreement under Article 28.

§ 06Recipients of personal data

We disclose personal data only to:

• Processors and sub-processors acting on our written instructions under Art. 28 contracts: hosting and infrastructure providers, payment processors, SMS gateway providers, email providers, customer-support tools, analytics tools and consultation scheduling platforms.
• School administrators with respect to data within an Institution subscription, limited to student profiles, saved opportunities and aggregate engagement reports.
• Public authorities, courts and regulators where required by law or in response to lawful requests.
• Professional advisers such as solicitors, accountants and insurers under duties of confidentiality.
• A purchaser or successor in connection with a sale, merger or reorganisation, where the recipient will be bound by this policy until any replacement is adopted.

We do not sell personal data.

§ 07International transfers

Personal data collected from UK residents is transferred to and stored on servers located primarily in the United States and may be accessed by our processors in other jurisdictions. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards under Article 46 of the UK GDPR:

• The UK Addendum to the EU Standard Contractual Clauses, executed with each non-UK processor.
• The UK International Data Transfer Agreement (IDTA) where appropriate.
• Adequacy regulations made by the UK Secretary of State, including the UK-US Data Bridge where the recipient is a participating organisation.

Where required, we conduct Transfer Risk Assessments before relying on these safeguards. A copy of the relevant transfer mechanism is available on request from our DPO.

§ 08PECR — marketing, SMS and cookies

The Privacy and Electronic Communications Regulations 2003 ("PECR") regulate direct marketing by electronic means and the use of cookies and similar technologies.

Marketing emails and SMS

We send marketing communications (such as our weekly dispatch) only where you have given specific opt-in consent or the "soft opt-in" applies (you have purchased or negotiated to purchase a similar service from us, we offered an easy opt-out at point of collection, and every communication offers an easy opt-out). You can withdraw consent at any time by clicking the unsubscribe link in any marketing email, replying STOP to any SMS, or contacting [email protected].

Service messages

Deadline alerts, account notices, billing notices and consultation confirmations are service messages sent on the basis of our contract with you and are not marketing under PECR. Message frequency varies; standard message rates may apply.

Cookies

We use strictly necessary cookies on the basis of legitimate interests. All other cookies (analytics, preference and any third-party marketing cookies) are set only with your consent through our cookie banner. See our Cookie Policy for full details and to manage your preferences.

§ 09Data retention

• Active account data — for the duration of your subscription.
• Closed account data — up to 24 months from cancellation, then deleted or pseudonymised.
• Billing records — 6 years (to comply with HMRC and Companies Act record-keeping obligations).
• Support and consultation records — up to 3 years from the date of last contact.
• Marketing opt-in/out records — retained for the period necessary to demonstrate compliance with PECR and the UK GDPR.

§ 10Security

We have implemented appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest for sensitive fields, role-based access controls, logging and monitoring, regular vulnerability assessments and a documented incident-response plan. In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the risk is high, notify affected individuals without undue delay, as required by Articles 33 and 34 of the UK GDPR.

§ 11Automated decisions and profiling

Our match engine performs automated processing to rank opportunities for you based on your interests, postcode and saved activity. This processing produces recommendations rather than decisions with legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR. You may at any time review or adjust your filters, request that we explain a recommendation in plain English or unsubscribe from automated alerts.

§ 12Your rights

Subject to the conditions in the UK GDPR, you have the following rights:

§ 13How to exercise your rights

To exercise any of your rights, email [email protected]. We will:

1. Verify your identity (we will request the minimum information necessary).
2. Respond within one month. Where the request is complex or where we receive multiple requests, we may extend by a further two months and will tell you within the first month if we do so.
3. Respond free of charge. Where requests are manifestly unfounded or excessive (particularly repetitive), we may charge a reasonable fee or refuse to act.

§ 14Complaints and the ICO

If you are not satisfied with how we have handled your personal data or rights request, you may lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113

§ 15Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date and, where required, by notice through the service or by email. Your continued use of the service after the effective date constitutes acceptance of the updated policy.

§ 16Contact our DPO