DraftContents
Who we are
onDesk provides finance careers education in the United Kingdom. For the personal information described in this policy, we are the controller. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can contact us about anything in this policy at info@getondesk.com.
Who this policy covers
This policy explains how we handle personal information about:
- parents and guardians who contact us, book a call or buy a programme;
- students, including students under 18, who take part in a programme, a talk or an event;
- teachers and society organisers who book a talk or workshop; and
- visitors to this website.
It covers this website, the free call, our programmes, the student and parent portals, talks and events, and our email and WhatsApp support. Our free tools (onTime, onTrack and onTarget) open on a separate site, ondeskmarkets.com. Please read the privacy information on that site when you use them.
The information we collect
Information you give us
- When you book a free call: name, email address, mobile number, school or university, the student’s stage, any note you add and the time you choose.
- When you apply for onDesk One: parent or guardian name, email address and phone number, student name, stage, school or university, goals and how you heard about us.
- When you ask for a guide: your email address.
- When a school or society books a talk or workshop: name, role, school or society, email address, preferred term, format and message.
- On the free call and in your written plan: the student’s stage, subjects, interests, goals and anything else you choose to tell us so we can recommend the right programme.
- During a programme: documents the student shares (such as a CV, personal statement, cover letters and application answers), set tasks, session notes, Desk-Ready Scores, target lists, deadlines, application outcomes and the monthly parent updates.
- When you contact us: the content of your emails and WhatsApp messages, and your phone number or email address.
- At talks and events: CVs that students hand in or send to us for feedback, and any contact details given with them.
- Feedback and reviews: comments, reviews and, only with permission, testimonials and results we may publish.
Payment information
Payments are taken by Stripe through a secure payment link. Stripe collects your card details directly. We do not see or store your full card number. We receive confirmation of the payment, such as your name, email address, the amount and the date.
Information collected when you use this website
- Fonts: the fonts on this site load from Google Fonts. When a page loads, your browser connects to Google, which receives your IP address and basic browser information.
- Currency choice: if you switch prices to US dollars or UAE dirhams, your choice is saved in your browser’s local storage. It stays on your device and is not sent to us.
- Hosting: like most websites, our hosting provider may keep short-term technical logs (such as IP address, pages requested and time) to keep the site running and secure.
- Advertising and analytics: a Meta Pixel and an analytics tool will run only if you agree to marketing cookies. See our Cookies policy.
Sensitive information
We do not ask for health information or other special category data. If you choose to tell us about a health condition, disability or learning need so that we can adapt sessions, we will use it only for that purpose and only with your explicit consent, which you can withdraw at any time. We may also record information about a safeguarding concern where that is needed to keep a young person safe (see our Safeguarding policy).
How we use it and our lawful bases
Under UK GDPR we must have a lawful basis for each use of personal information. The table sets out what we do and why we are allowed to.
What we do Information used Lawful basis Reply to enquiries, hold the free call and send the written plan Contact details, stage, school, notes, what you tell us on the call Taking steps at your request before a contract. Where a parent books for a child, our legitimate interest in answering the parent’s enquiry Deliver the programme: sessions, set tasks, document reviews, Desk-Ready Scores and the portals Programme information, documents, notes and scores Performance of our contract with the customer. Where a parent is the customer, our legitimate interest in delivering the programme the family has asked for Send monthly parent updates and give parents access to the parent portal Progress, scores, deadlines and actions For students under 18, performance of our contract with the parent. For students aged 18 or over, the student’s consent, which they can change at any time Take payment and keep accounts Payment confirmation, name, email address, amount Performance of a contract, and legal obligation (tax and accounting records) Support by email and WhatsApp Messages and contact details Performance of a contract and our legitimate interest in answering questions promptly Give feedback on CVs handed in at talks and events CV and contact details given with it Our legitimate interest in providing the feedback the student asked for Arrange talks and workshops with schools and societies Organiser’s name, role, organisation and email address Our legitimate interest in running and following up the booking Send marketing emails to parents and to adult students Name and email address Your consent, or, where you have enquired about or bought a programme, the soft opt-in allowed by PECR. You can unsubscribe at any time Keep young people safe Information about a concern Legal obligation, vital interests or our legitimate interest in protecting children. Special category data under the safeguarding condition in the Data Protection Act 2018 (Schedule 1, paragraph 18) Publish a testimonial or result Name, quote, result and photo Consent. For a student under 18, a parent or guardian’s consent as well Measure and advertise on the website Cookie and device information Consent, asked for before anything runs Improve our programmes, handle complaints and protect our legal rights Feedback, records and correspondence Our legitimate interests, and legal obligation where it applies Where we rely on legitimate interests, we have balanced our interests against yours, taking particular care where a child is involved. You can ask us for details of that assessment.
Children’s information and parents
Many of the students we work with are under 18. We take extra care with their information.
- Contact through a parent or guardian. Students under 18 are contacted through a parent or guardian. A parent or guardian books the call and pays for the programme, and completes the onDesk One application.
- DBS-checked advisors. Students under 18 work only with DBS-checked advisors. See our Safeguarding policy.
- No marketing to under-18 students. We do not send marketing emails or messages to students under 18. Parents receive our parent emails instead, and can unsubscribe at any time.
- Two portals. Students use the student portal for set tasks and documents. Parents use the parent portal and receive a written update every month.
- Students aged 18 or over decide. Once a student is 18, they choose whether their parents can see their progress in the parent portal and in monthly updates, and they can change that choice at any time by telling us.
- Only what we need. We collect only the information needed to run the programme, and we explain it to students in plain language.
Children have the same data protection rights as adults. A parent or guardian can usually make a request on behalf of a younger child. When a request concerns a student, we consider the student’s age, understanding and best interests, and we may speak to the student directly.
International transfers
Some of our providers, including Stripe, Google and Meta, may store or process information outside the UK, including in the United States. When this happens we make sure the transfer is protected by one of the safeguards UK law allows, such as:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified; or
- the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
If an advisor working with you is based outside the UK, the same safeguards apply. You can ask us for more information about the safeguard used for a particular transfer.
How long we keep it
We keep personal information only for as long as we need it for the purpose we collected it for, or as the law requires.
Information How long we keep it CVs collected at talks and events Deleted 6 months after the event Programme records: documents, set tasks, notes, scores and parent updates For the programme and while the student uses onDesk Alumni Payment and accounting records Six years from the end of the financial year they relate to, to meet tax rules Marketing email list Until you unsubscribe. We keep a short record that you opted out so we do not email you again Safeguarding records In line with UK safeguarding guidance Currency choice in your browser Until you clear your browser storage When information is no longer needed, we delete it or make it anonymous.
Keeping it secure
We use established providers, limit access to student information to the people who need it, and share documents through onDesk accounts rather than personal ones. No system is completely secure, so please tell us straight away if you think your information has been put at risk.
If a data breach is likely to put you at risk, we will tell you, and we will report it to the ICO where the law requires.
Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you and get a copy;
- correct information that is wrong or incomplete;
- delete your information in some circumstances;
- restrict how we use it in some circumstances;
- object to our use of it where we rely on legitimate interests, and to stop direct marketing at any time;
- move information you gave us to another provider (data portability), where it applies; and
- withdraw consent at any time where we rely on consent. This does not affect what we did before.
To use any of these rights, email info@getondesk.com. There is no charge. We will reply within one month, or tell you within that month if we need longer for a complex request. We may ask you to confirm your identity first.
We do not make decisions about you based only on automated processing that have a legal or similarly significant effect on you.
How to complain
If you are unhappy with how we have handled your information, please tell us first at info@getondesk.com so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this policy
We may update this policy, for example when we add a new tool or service. The date at the top shows when it last changed. If we make a significant change, we will tell customers by email before it takes effect.
Contact us
For any question about this policy or your information:
- Email: info@getondesk.com
- WhatsApp: +44 7440 346747
DraftDraft prepared for onDesk. Have it reviewed by a qualified UK solicitor before relying on it.