Privacy Policy

This policy explains what personal data ShiftPoint IT Consulting (“ShiftPoint”, “we”, “us”) collects when you use myshiftpoint.co.uk and take the Career Readiness Self-Assessment, why we collect it, who handles it, and the rights you have over it.

We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions, email us at info@myshiftpoint.co.uk.

The short version

• We only collect what you type into the assessment: your name, email address, ratings and written answers.
• Nothing is sent to us until you choose to submit. Your answers are saved in your own browser for up to 7 days so you can come back to them.
• When you submit, your results are emailed to ShiftPoint so we can follow up with you about them. We don’t use them for anything else, and we don’t send marketing emails.
• We don’t use advertising or analytics cookies, and we never sell your data.
• We keep submissions for up to 12 months, and you can ask us to delete yours sooner.

What we collect

Information you give us

• Your name and email address, so we know who the assessment belongs to and can reply to you.
• Your assessment answers: the 1–5 rating you give each item, any written detail you add, and the scores calculated from them.
• Anything you include in emails to us, if you get in touch.

Please don’t include sensitive information (such as health details) in your written answers. The assessment doesn’t need it.

Information collected automatically

• Your IP address, used briefly to limit how many requests can be made in a short time and to help check that you aren’t an automated bot.
• Browser and device signals collected by Cloudflare Turnstile, our bot check, when you request a verification code. See “Who we share it with” below.

How we use it, and our lawful basis

• To verify your email address. Before you submit, we email you a 6-digit code to confirm the address is yours. This stops people submitting assessments in someone else’s name.

• To review your assessment and follow up with you about it. This is the reason you submit it, so we process it to take the steps you’ve asked for. Where that doesn’t apply, we rely on our legitimate interest in responding to people who ask for our feedback.

• To keep the service secure. We use your IP address, a scrambled (hashed) form of your email address and the bot check to prevent spam and abuse. This is in our legitimate interest, and in yours, because it stops your email address being flooded with codes.

We only contact you about your assessment. We won’t send you newsletters or marketing, and we don’t use your data to make automated decisions about you. Your score is calculated automatically, but it is guidance for you, not a decision about you.

Where your data is stored

In your browser

While you work through the assessment, your name, email address and answers are saved in your browser’s local storage, so you won’t lose your progress if you close the page. This data stays on your device and isn’t sent to us until you submit. It is removed automatically after 7 days. You can also clear it at any time by clearing your browser’s site data, which is worth doing on a shared or public computer.

Cookies

We don’t set advertising, analytics or tracking cookies. Cloudflare Turnstile may use strictly necessary technology to tell people and bots apart. Because it is essential to keeping the form secure, it doesn’t need your consent.

Who we share it with

We don’t sell your personal data. We use a small number of service providers (processors) who handle data on our behalf and only as we instruct:

• Resend delivers our emails: your verification code, and your submitted assessment to our inbox. Resend’s privacy policy.

• Cloudflare runs the Turnstile bot check and receives your IP address and browser signals. Cloudflare’s privacy policy.

• Upstash stores verification codes and rate-limit counters for a few minutes. Codes are stored in a scrambled (hashed) form, and are linked to a hashed email address, not your email address in plain text. Upstash’s privacy policy.

• Our hosting and email providers, who run the website and the ShiftPoint inbox where submissions arrive.

We may also share data if the law requires it, for example in response to a valid request from a court or regulator, or to protect our rights or someone’s safety.

International transfers

Some of these providers may process data outside the UK, including in the United States. Where they do, we rely on safeguards recognised under UK law, such as the UK International Data Transfer Addendum, standard contractual clauses or the UK–US data bridge.

How long we keep it

• Verification codes expire after 10 minutes and are deleted once used.
• Rate-limit records (based on your IP address and a hashed email address) expire within a few minutes.
• Answers saved in your browser are removed after 7 days, or when you clear your browser data.
• Submitted assessments and related emails are kept for up to 12 months from when we receive them and then deleted. We delete them sooner if you ask. If you go on to work with us, we keep what we need for that relationship and tell you about it at the time.

Keeping it secure

All data is sent over encrypted (HTTPS) connections. We confirm your email address before accepting a submission, and we limit and screen requests to keep out bots. Access to submissions is limited to the ShiftPoint team. No system is completely secure, but we take reasonable steps to protect your data.

Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that is wrong or incomplete
• ask us to delete your data
• object to, or ask us to restrict, how we use your data
• ask for your data in a portable format

To use any of these rights, email info@myshiftpoint.co.uk. We’ll reply within one month. There’s normally no charge.

If you’re unhappy with how we handle your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children

The assessment is designed for graduates and early-career professionals and isn’t intended for anyone under 16. If you think a child has sent us their details, contact us and we’ll delete them.

Links to other websites

This site links to other websites, such as our providers’ privacy policies. We aren’t responsible for how those sites handle your data, so please read their own policies.

Changes to this policy

We’ll update this page if the way we handle your data changes, and change the “Last updated” date at the top. If a change significantly affects how we use data you’ve already given us, we’ll tell you by email.

Contact us

For questions about this policy or your data, email info@myshiftpoint.co.uk.