Privacy policy
The short version
- We collect only what we need to run KO Careers: your name, email and password if you create an account, your booking and payment details, your CV, and notes from your sessions.
- We use it to send you our emails (only if you create an account, and you can unsubscribe at any time), deliver sessions and keep you safe. We never sell it, and we don't use ads, tracking or analytics.
- Your CV is seen only by our mentors, who all keep it confidential. We never share it with an employer or university unless you ask us to.
- If you're under 18, your parent or guardian needs to agree before you take part in sessions. If you're under 13, our website isn't for you yet.
- You can unsubscribe, see what we hold, correct it or ask us to delete it at any time. Just email teamkocareers@gmail.com.
- If you're unhappy, tell us, or contact the Information Commissioner's Office.
1. Who we are
KO Careers is a careers mentoring service run by Marko Vasiljevic, a sole trader, trading as "KO Careers". In this policy, "we", "us" and "our" mean KO Careers. We are the controller of your personal information, which means we decide how and why it's used and we're responsible for looking after it under UK data protection law (the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025).
Contact us about anything in this policy
Email: teamkocareers@gmail.com (please put "Privacy" in the subject line)
We are a small business, so we are not legally required to appoint a Data Protection Officer. Marko Vasiljevic is responsible for data protection and reads every privacy message personally.
2. Who this policy covers
This policy explains how we handle personal information about:
- people who visit our website, kocareers.com (and kocareers.co.uk, which redirects to it);
- people who create a free account on our website for our podcast, updates and bookings;
- students who book or take part in our sessions (university students, sixth formers and other school or college students);
- parents, guardians and carers of students under 18, and anyone who pays for a session on someone else's behalf;
- people who email or message us, or leave feedback or a testimonial;
- guests on The Spring Loaded Podcast; and
- people who apply to become, or work with us as, mentors (section 18 covers the extra information we hold about mentors).
If you give us information about someone else (for example, a parent booking for their child, or a student giving us a parent's email address), please make sure they know you're doing so and point them to this policy.
3. What information we collect and where it comes from
| Type of information | Examples | Where we get it |
|---|---|---|
| Account and sign-up details | Your first name, email address and password (stored only in scrambled, “hashed” form, so nobody at KO Careers can ever see it); the date, time and IP address of your sign-ins; the date and time you created your account and joined our email list; which emails you open and links you click (see section 7) | You, through the sign-up form on our website, and our email provider Kit |
| Booking details | Your name, email address, the service you booked, the date and time, your answers to booking questions (such as your area of interest, university or school, year group, target firms or courses, a link to your CV, whether you're under 18 and your parent or guardian's contact details) | You (or the person who books for you), through our booking system Calendly |
| Payment details | The amount paid, the date, the last four digits of the card and its expiry date, billing name and country, and refund records. We never see or store your full card number | Stripe, which processes payments for us |
| Your CV and application materials | Your CV, cover letters, personal statement drafts, application answers and online assessment results you choose to share | You |
| Mock video interview recordings | Video and audio of you answering practice questions for our HireVue Mock Review | You |
| Session notes | What we discussed, the strategy agreed for you, actions and progress, and which applications and offers you've told us about | Your mentors, during and after sessions |
| Messages | Emails, WhatsApp messages (adults only) and anything you send us | You |
| Feedback and testimonials | Your comments, star ratings and, if you agree, a testimonial with your first name, university or school and the offers you landed | You |
| Preferences saved in your browser | Your light or dark mode choice, and a sign-in token that keeps you signed in to your account (see section 8) | Your own browser; this stays on your device |
| Technical information | IP address, browser type, device type, pages requested and the time of the request, held in server logs | Your browser, automatically, via our website host and Google Fonts |
| Safeguarding information | Concerns about a student's safety or wellbeing, what was said or seen, and what was done about it | Mentors, students, parents or other organisations |
| Information about parents and guardians | Name, email address, phone number and confirmation that you consent to your child taking part | You or your child |
| Podcast guest information | Name, voice, likeness, biography, career history and anything you say on the recording | You |
You don't have to give us any of this information. However, if you don't sign up we can't send you the podcast or let you book calls; if you don't give us booking details or your CV we can't deliver the session you asked for; and if you're under 18 and we don't have a parent or guardian's consent, we can't run sessions with you.
We don't ask for, and you don't need to give us, information about your health, ethnicity, religion, sexuality or other sensitive matters. Section 5 explains what happens if you choose to share them.
4. How we use your information, and our lawful basis
The law says we need a valid reason (a "lawful basis") for each way we use personal information. These are ours:
| What we do | Our lawful basis |
|---|---|
| Send you podcast episodes, updates on new features, deadline alerts and tips by email | Your consent, which you give by creating an account after reading what we'll email you about. You can withdraw it at any time by clicking “Unsubscribe” in any email or by emailing us |
| Let you create an account and sign in, book calls and unlock podcast episodes on our website, and reset your password if you forget it | Contract (providing the service you asked for). For students under 18 whose parent or guardian is our customer, our legitimate interests in delivering the service the family asked for |
| Deliver sessions: reviewing your CV with our mentors, running calls and follow-ups, marking mock interviews, sending booking confirmations and reminders, and answering your questions | Contract, or our legitimate interests where the contract is with your parent or guardian |
| Take payments and give refunds | Contract |
| Keep accounting and tax records, and respond to requests from HMRC or other authorities | Legal obligation |
| Collect a parent or guardian's consent and contact details for students under 18, and keep them informed | Legitimate interests in keeping children safe, which is a recognised legitimate interest under the Data (Use and Access) Act 2025 |
| Act on safeguarding concerns and share information with children's services, the police or other agencies when someone may be at risk | Recognised legitimate interest (safeguarding vulnerable individuals, and emergencies), legal obligation where one applies, and vital interests where someone's life is at risk |
| Handle complaints, refunds disputes and chargebacks, and establish or defend legal claims | Legitimate interests in running our business properly and protecting our legal position |
| Ask for feedback and use it to improve our services | Legitimate interests in improving what we offer. You can ignore these requests or ask us to stop |
| Publish your testimonial on our website or social media | Your consent. You can withdraw it at any time and we'll remove it |
| Record and publish podcast episodes with guests | Contract (your guest agreement) or your consent |
| Keep our website and systems secure and working | Legitimate interests in protecting our website and the people who use it |
| If KO Careers is ever sold or restructured, share information with the new owner so your service can continue | Legitimate interests. We'd tell you before this happened |
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations, taking particular care where the person is under 18. You can ask us for details of that assessment, and you have the right to object (see section 13).
We only use your information for the purposes above, or for a new purpose that's compatible with them. If we want to use it for something different, we'll tell you first and, where needed, ask for your consent.
5. Sensitive information
Some information is given extra protection by law ("special category data"): health (including mental health), racial or ethnic origin, religious or philosophical beliefs, sexual orientation, sex life, political opinions, trade union membership, genetic and biometric data. Information about criminal convictions and offences is also protected.
If you choose to tell us
Many spring weeks and insight programmes are aimed at particular groups (for example, students from under-represented ethnic backgrounds, women, students with disabilities or students who are the first in their family to go to university). If you tell us about your background or circumstances so we can help you target these programmes, or about a disability or health condition so we can adjust how we work with you, we will use that information only for that purpose, share it only with the mentors working with you, and rely on your explicit consent. You can withdraw that consent at any time and we'll delete the information, although we may then be unable to give advice that depends on it.
Safeguarding
If we're worried that someone is at risk of harm, we may record and share sensitive information without consent where the law allows it, relying on the condition for safeguarding of children and of individuals at risk in Schedule 1 of the Data Protection Act 2018, or on vital interests in an emergency. We keep an appropriate policy document explaining how we handle this information safely.
Mock video interviews
Your mock interview recording shows your face and voice. We use it only to watch your answers and give you feedback. We don't use it to identify you by facial or voice recognition, so it isn't biometric data, and we delete it after the time set out in section 11.
6. Children and young people
- Under 13: our website and services are not for children under 13 and we don't knowingly collect their information. If we learn that we have, we'll delete it.
- Accounts and email sign-up (13 and over): people aged 13 or over can create a free account and sign up to our emails and podcast themselves, which is the UK age for giving consent to online services.
- Sessions (16 and over): our paid sessions are for students aged 16 and over. If you're under 18, a parent or guardian must agree to you taking part and give us their contact details before your first session, and they'll be told when sessions are booked.
We have designed our website to protect young people by default. We don't show adverts, we don't use analytics or tracking cookies, we don't build profiles of you for marketing, we don't share your location, we don't have public profiles or chat features, and we never sell your information. We have taken into account children's "higher protection matters" under data protection law in designing our services.
Your rights if you're under 18
Your personal information belongs to you, not your parents. If you're old enough to understand your rights (usually from about 12 or 13), you can exercise them yourself. A parent or guardian can make a request on your behalf, but if you're old enough to understand, we'll usually check with you first, unless it's clear that sharing is in your best interests. We won't give a parent information you've told us in confidence unless we need to for your safety.
7. Our emails and your consent
When you create an account, we add your first name and email address to our email list straight away. The sign-up window tells you what we'll send before you create your account. We keep a record of when and how you joined, so we can show you consented.
We use Kit (kit.com, previously called ConvertKit) to store our email list and send emails. Kit records whether our emails are opened and which links are clicked, using a small invisible image and tracked links in each email. We use this, only in total or by email, to see what's useful and to stop emailing people who've lost interest. You can block this by turning off images in your email app.
You can unsubscribe at any time by clicking “Unsubscribe” at the bottom of any email, or by emailing teamkocareers@gmail.com. Unsubscribing is free and immediate. If you unsubscribe, we'll keep your email address on a “do not email” list, so we don't accidentally email you again. If you unsubscribe, you'll no longer have access to the sign-up-only parts of our website (such as locked podcast episodes and booking).
Booking confirmations, reminders and messages about a session you've booked are part of the service, not marketing, so you'll still get them if you unsubscribe from updates.
8. Cookies and browser storage
Our website does not use cookies of its own, analytics, advertising or tracking. We do save a few small items in your browser's local storage, only on your device, to make the website work the way you've chosen. The law allows this without asking first, because the storage is strictly necessary for a service you asked for or keeps the website looking the way you chose.
| Name | What it does | How long it lasts |
|---|---|---|
| ko-theme-v4 | Remembers whether you chose light or dark mode | Until you clear your browser data |
| sb-sfjsbjeiiyzleldgqbry-auth-token | Keeps you signed in to your KO Careers account on this device. It holds a secure sign-in token, your email address and your first name. It never holds your password | Until you sign out or clear your browser data. While you keep using the website, the token renews itself |
On a shared or public computer, click your name at the top of the page and choose Sign out when you've finished.
Other websites and services
- Google Fonts: our pages load fonts from Google's servers. This means your browser sends your IP address and browser details to Google so the fonts can be delivered. Google says it doesn't use this to profile you or set cookies. See Google Fonts privacy.
- Booking (Calendly) and payments (Stripe): when you click “Book a time”, you go to Calendly's website, where Calendly and Stripe may set cookies that are needed for booking and payment and to prevent fraud. They control those cookies and explain them in their own cookie policies.
- Links to LinkedIn and other websites: these are ordinary links. Nothing from those websites loads on our pages until you click.
If we ever add analytics or other cookies that need your permission, we'll update this policy and ask you first.
9. Who we share your information with
We never sell your personal information or share it for other companies' marketing. We share it only with the people and organisations below, and only as much as they need.
Our mentors
Our mentors work with us to deliver sessions. The mentors assigned to you see your booking details, CV and session notes. For our Spring Week CV Review, all eight of our mentors review your CV together to agree a strategy for you. Every mentor is bound by confidentiality, follows our instructions, and may only use your information to help you.
Service providers who process information for us
| Provider | What they do for us | Where the data is held |
|---|---|---|
| Kit (formerly ConvertKit) | Email sign-ups and sending emails | USA |
| Calendly LLC | Online booking, booking questions, confirmations and reminders | USA |
| Stripe (Stripe Payments UK Ltd and its group) | Taking card payments and refunds | UK, EU and USA |
| Our email (Gmail), video calls (Google Meet), secure file storage (Google Drive) and web fonts | UK, EU, USA and elsewhere | |
| WhatsApp (Meta) | Messaging with adult Mentorship students who choose to use it. Messages are end-to-end encrypted | EU, USA and elsewhere |
| Netlify, Inc. | Hosting our website and delivering its pages to your browser | USA, with copies of the website on servers around the world |
| Supabase, Inc. | Storing your account (first name, email address and hashed password) and handling sign-in and password resets | UK (London) servers, with support access from the USA |
| Resend | Sending account emails, such as password reset links | USA |
These providers may only use your information to provide their service to us (except where they act independently, as below), and must keep it secure.
Stripe also acts as an independent controller for some purposes, such as preventing fraud and meeting its own legal duties. You can read Stripe's privacy policy. Google acts independently when it handles your IP address to deliver fonts.
Other people we may share information with
- Your parent or guardian, if you're under 18, so they know about your bookings and can support you, except for things you tell us in confidence (unless your safety is at risk).
- Children's services, the police, a Local Authority Designated Officer (LADO), the Disclosure and Barring Service or similar organisations, if we have a safeguarding concern or the law requires it.
- Professional advisers such as an accountant, lawyer or insurer, who must keep it confidential.
- HMRC, courts, regulators and law enforcement, where the law requires us to.
- A buyer of KO Careers, if the business is sold or restructured, so your service can continue. We'd tell you first.
We never share your CV, your applications or details about you with any employer, university, UCAS or recruiter unless you ask us to.
10. Sending information outside the UK
Some of our providers store or access information in the USA and other countries outside the UK. When this happens, we make sure it's protected to UK standards, by using one of these safeguards:
- the country has been approved by the UK Government as providing adequate protection (for example, countries in the European Economic Area);
- for the USA, the provider is certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"); or
- we have a contract with the provider containing the UK's International Data Transfer Agreement or the UK Addendum to the EU's Standard Contractual Clauses, which these providers include in their data processing terms.
Email us if you'd like more information or a copy of the relevant safeguard.
11. How long we keep your information
We keep information only for as long as we need it. These are our usual periods. We may keep information longer if we need it for an open complaint, a legal claim or a safeguarding concern, or if the law requires it.
| Information | How long we keep it |
|---|---|
| Your account (first name, email address, hashed password and sign-in records) | Until you ask us to delete it: email us and we'll delete it within 30 days. If you haven't signed in for 3 years, we may delete it |
| Email sign-up details | Until you unsubscribe. After that, we keep just your email address on a “do not email” list. If you haven't opened any of our emails for 24 months, we may remove you from our list |
| Booking details, your CV, application materials and session notes | 12 months after your last session, then deleted (you can ask us to keep them longer, for example if you plan to come back next application season, or to delete them sooner) |
| Mock video interview recordings | Deleted 30 days after we send you your feedback |
| Emails and WhatsApp messages | 12 months after our last contact with you |
| Payment, refund and invoicing records | 6 years from the end of the tax year they relate to (required for tax purposes) |
| Complaints and records of disputes | 6 years after the complaint is closed |
| Parent or guardian consent records | Until the student turns 21, or 6 years after the last session if later |
| Safeguarding records about a child | Until the young person turns 25 |
| Safeguarding records about an adult | 6 years after the last contact |
| Records of allegations about a mentor | Until the mentor reaches normal pension age, or for 10 years, whichever is longer |
| Testimonials and the record of your consent | For as long as the testimonial is published, then 2 years |
| Podcast episodes | For as long as the podcast is available, unless agreed otherwise in the guest agreement |
| Website server logs | Up to 30 days, as set by Netlify |
| Preferences and sign-in token saved in your browser | Until you sign out or clear them (we can't see or delete these) |
When information is no longer needed, we delete it securely or anonymise it so it no longer identifies anyone.
12. How we keep your information safe
We use appropriate technical and organisational measures to protect your information, including:
- using reputable providers with strong security, with two-step verification switched on for every KO Careers account;
- keeping CVs and notes in access-controlled KO Careers folders, shared only with the mentors who need them, rather than on personal devices or in personal email;
- removing a mentor's access as soon as they stop working with us;
- confidentiality commitments and data protection guidance for every mentor;
- never putting your CV or personal details into public AI tools that may use them to train their models; and
- keeping safeguarding records separately, so only the owner of KO Careers can see them.
No system is completely secure. If a data breach happens that is likely to put people's rights at risk, we will tell the Information Commissioner's Office within 72 hours of finding out, and if there's a high risk to you, we'll tell you directly without undue delay.
13. Your rights
You have these rights over your personal information:
- Access: ask for a copy of the information we hold about you (a "subject access request").
- Correction: ask us to correct information that's wrong or incomplete.
- Deletion: ask us to delete your information ("the right to be forgotten"). We'll do this unless we have to keep it, for example for tax records or safeguarding.
- Restriction: ask us to pause using your information, for example while we check whether it's accurate.
- Objection: object to us using your information where we rely on legitimate interests. You can object to direct marketing at any time and we will always stop.
- Portability: ask us to give you the information you provided to us, in a common electronic format, or send it to someone else, where we use it based on consent or contract.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time. This doesn't affect anything we did before you withdrew it.
- Human decision-making: not to be subject to decisions made only by automated means that have a legal or similarly significant effect on you. We don't make any decisions like this (see section 14).
- Complain: complain to us and to the Information Commissioner's Office (see section 15).
How to use your rights
Email teamkocareers@gmail.com. You don't need to use any particular words or form, and it's free. If we need to check your identity, or need more information to find what you're asking for, we'll ask you, and the one-month time limit will start once we have it.
We'll respond within one month. If your request is complicated or you've made several, we may extend this by up to two more months, and we'll tell you why within the first month. We'll carry out a reasonable and proportionate search for your information. We may refuse, or charge a reasonable fee, if a request is clearly unfounded or excessive, and we'll explain why. Some information may be withheld where the law allows it, for example to protect another person or where sharing it could put a child at risk.
14. Automated decisions and AI
We don't make decisions about you using automated means only, and we don't use your information for profiling. Every piece of feedback and advice comes from a real mentor.
We don't use your CV, recordings, messages or other personal information to train AI models, and we don't put them into public AI tools that might use them that way.
15. Complaints
If you're unhappy with how we've handled your information, please tell us first so we can put it right. Email teamkocareers@gmail.com with "Data protection complaint" in the subject line. We'll acknowledge your complaint within 30 days (in practice we aim for 5 working days), look into it properly, keep you updated, and tell you the outcome without undue delay.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
The ICO usually expects you to have raised your complaint with us first.
16. Other websites
Our website links to other websites, such as LinkedIn, Calendly, firms' careers pages, UCAS and support services. We're not responsible for how those websites handle your information. Please read their privacy policies.
17. Changes to this policy
We'll update this policy when the way we use information changes or the law changes. The date at the top shows when it was last updated. If we make a significant change, we'll tell people on our email list and, if the change needs your consent, we'll ask for it before it applies.
18. Extra information for mentors and people applying to mentor
If you apply to be a mentor or work with us as one, we also hold: your CV and application, interview notes, references, identity documents, your right-to-work check if required, contact and payment details, training records, the signed code of conduct, and the results of criminal record checks.
- Criminal record (DBS, PVG or AccessNI) checks: we record the date, type, certificate number and whether it was clear or needed a risk assessment, and we don't keep a copy of the certificate for longer than 6 months. We rely on the conditions for employment and for safeguarding children and individuals at risk in Schedule 1 of the Data Protection Act 2018, and we follow the DBS code of practice.
- Lawful bases: contract (our agreement with you), legal obligation (tax, right to work, safeguarding duties) and legitimate interests (checking suitability and running the business safely).
- How long: unsuccessful applications are deleted 6 months after the decision. Mentor records are kept for 6 years after you stop working with us, except payment records (6 years from the end of the tax year) and any record of an allegation (see section 11).
Your rights in section 13 apply to you too.