Privacy Policy

01Who we are

Bristol Tracker Limited is a company registered in England and Wales under company number 15763725. We operate Trackr Academy as a product under the Trackr brand. You can contact us at any time at info@the-trackr.com.

We are the data controller for the personal data we collect from you in connection with the Programme. This means we determine how and why your data is processed.

02Data Protection Officer

Our Data Protection Officer is Samuel Leong. You can contact the DPO directly at sam@the-trackr.com for any questions about how your personal data is handled, to exercise any of your rights under UK GDPR, or to raise a concern about our practices.

03What personal data we collect

We collect only the data we need to deliver the Programme, communicate with you, and meet our legal obligations. The categories of data we collect are:

• Your name
• Your email address
• Your phone number
• Your university and degree subject
• Your sector preferences for applications
• Payment data, collected and processed by our payment provider, Stripe (we do not store full card details ourselves)
• A flag indicating which tier you are enrolled on, including whether you are an Elite Tier applicant or participant

If you apply to the Elite Tier, we additionally collect the contents of your CV. This is the only additional data we collect from Elite Tier applicants beyond the categories above.

We do not collect IP addresses, device identifiers, browsing behaviour, or any analytics data about your use of our website beyond the standard server logs maintained by our hosting provider (see section 09).

04How we use your data

We use your personal data only for the following purposes:

• To deliver the Programme, including granting access to live sessions, materials, and the cohort WhatsApp group
• To process your payment and confirm your enrolment
• To review Elite Tier applications and decide whether to offer a place
• To deliver Elite Tier services, including one-to-one tutoring, mock interviews, and CV revisions
• To send you transactional communications such as schedule updates, joining instructions, and operational messages necessary to deliver the Programme
• To respond to your enquiries and requests
• To meet our legal, regulatory, and accounting obligations

We do not use your data for marketing or send you promotional communications unless you have given us explicit, prior consent. We do not sell, rent, or trade your data with any third party for marketing purposes.

05Legal basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

• Performance of a contract: Most of our processing is necessary to deliver the Programme to you under our Terms & Conditions, including processing payment, granting access to materials, and communicating about your enrolment.
• Legitimate interests: We process limited data to operate our business effectively, for example to keep records of CV feedback and revisions so we can deliver a consistent service across the recruitment cycle. We balance our interests against your rights and only rely on this basis where appropriate.
• Legal obligation: We may process and retain data to comply with our legal and regulatory obligations, including tax, accounting, and consumer protection law.
• Consent: Where we rely on your consent for any specific processing activity (for example, sharing identifiable feedback externally), we will ask for it clearly and you can withdraw it at any time.

06Who we share your data with

We share your personal data only with the third-party service providers we rely on to operate the Programme, and only to the extent necessary. Each of these providers acts as a data processor on our behalf and is contractually required to handle your data securely and only on our instructions:

• Stripe: processes your payment. We never see or store your full card details.
• Tally: hosts our application and enrolment forms.
• Brevo: sends transactional emails on our behalf (joining instructions, schedule updates, and similar operational messages).
• Google Workspace (Google Sheets, Google Drive): stores our internal participant records, CV submissions, and feedback history.
• Netlify: hosts our website and serves the pages you see.
• WhatsApp: hosts the cohort communication group described in section 07.

We may share aggregated, anonymised data (for example, total cohort size or aggregate outcomes) that does not identify you. Beyond this and the processors above, we do not share identifiable personal data with any other third party without your explicit, prior consent. We do not share your data with prospective employers, recruitment firms, or other Programme participants without your consent.

We may disclose your data where we are required to by law, by a court, or by a regulator with proper authority. We will resist any request that we consider unlawful or overbroad.

07The cohort WhatsApp group

The cohort WhatsApp group is managed by us using the WhatsApp platform. Trackr representatives administer the group, including adding and removing members. All messages, names, and profile photos in the group are visible to every member.

We do not maintain a separate archive of the group’s contents. Records of messages exist only to the extent that the WhatsApp platform itself retains them on participants’ devices and within WhatsApp’s own systems, which are governed by WhatsApp’s own terms and privacy policy, not ours.

You acknowledge that anything you share in the group is shared with every other member of the group and is not confidential. If you would prefer not to participate in the group, please let us know at info@the-trackr.com and we will arrange an alternative.

08How long we keep your data

We keep your personal data for as long as we have a relationship with you and for a reasonable period afterwards, in line with the following:

• Active enrolment: while you are enrolled on the Programme, we retain all data necessary to deliver the Programme to you.
• Elite Tier records (CV submissions, feedback, revision history, mock interview notes): we retain these for the duration of the 2026/27 recruitment cycle and beyond, so we can continue to provide a consistent service if you re-engage with us. We do not record mock interview sessions themselves.
• Unsuccessful Elite Tier applicants: we retain application data, including any CV you submitted, for up to twelve months after the decision, so we can respond to follow-up questions and consider any reapplication. After that period it is deleted, unless you ask us to keep it on file.
• Financial and tax records: we retain records of payments and invoices for at least six years after the end of the relevant tax year, as required by HMRC and English law.
• Other operational records: we retain data for as long as we have a legitimate business reason to do so, balanced against your rights.

You can ask us to delete your data at any time using the rights described in section 10. Where we have a legal or regulatory obligation to retain certain data (most commonly, financial records), we will keep only what we are legally required to keep and delete the rest.

09Cookies, analytics, and server logs

Our website does not use analytics tools such as Google Analytics, marketing pixels, advertising trackers, or non-essential cookies. We do not profile your browsing behaviour or build a record of how you use the site.

Our hosting provider, Netlify, maintains standard server logs as part of operating the website. These logs may include technical information such as IP addresses, browser type, and requested URLs, and are retained for security, abuse prevention, and operational diagnostics. Netlify handles these logs as a processor and under its own privacy and security commitments.

10Your rights under UK GDPR

You have the following rights in relation to the personal data we hold about you:

• Right of access: you can ask us for a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct any data that is inaccurate or incomplete.
• Right to erasure: you can ask us to delete your data, subject to any legal or regulatory obligation we have to keep it.
• Right to restriction: you can ask us to limit how we process your data while a query or correction is being resolved.
• Right to data portability: you can ask us to provide the data you have given us in a structured, commonly used format so you can transfer it to another provider. We do not offer this as an automated self-service feature, but we will provide it on request where it is technically feasible and required by law.
• Right to object: you can object to processing we carry out under our legitimate interests.
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Right to complain: you can complain to the Information Commissioner’s Office (the ICO) at ico.org.uk if you believe we have mishandled your data. We would appreciate the chance to address your concern directly first.

To exercise any of these rights, please email info@the-trackr.com or contact our DPO at sam@the-trackr.com. We will respond within two weeks of receiving your request, or sooner where we reasonably can.

11International data transfers

We are based in the UK and we expect the majority of Programme participants to be based in the UK and the European Economic Area. Some of the processors we rely on (including Stripe, Google Workspace, and Brevo) may store or process data outside the UK or EEA in the course of providing their services to us.

Where this happens, those transfers are protected by appropriate safeguards under UK GDPR, including the UK’s adequacy decisions, the International Data Transfer Agreement (IDTA), or standard contractual clauses, as published and maintained by each processor. We rely on the safeguards that each processor has put in place and do not arrange separate transfer mechanisms ourselves.

12Security

We take the security of your personal data seriously and use the following measures:

• We use established, security-audited third-party processors (Stripe, Tally, Brevo, Google Workspace, Netlify) to store and process your data.
• Internal access to participant data is restricted to people who need it to deliver the Programme.
• We do not store payment card details on our own systems; these are handled directly by Stripe.
• We review our practices periodically and aim to improve our security as the Programme grows.

No system can be guaranteed to be completely secure. If we ever become aware of a personal data breach affecting your data, we will notify you and the ICO without undue delay, and in any event within 72 hours of becoming aware, where the breach is likely to result in a risk to your rights and freedoms, as required by UK GDPR.

13Children

Trackr Academy is intended for university students and graduates and is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we hold data about a person under 16, please contact us at info@the-trackr.com and we will delete it promptly.

14Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Programme, our processors, or the law. The version that applies to you is the version published on this page on the date you read it. Where we make material changes affecting your existing rights or expectations, we will notify you in writing in advance.

15Contact us

For any question about this policy, your data, or to exercise any of your rights, please contact us:

• General enquiries: info@the-trackr.com
• Data Protection Officer: Samuel Leong, sam@the-trackr.com