Privacy policy

Plain English: what we collect, why, who sees it, how long we keep it, and your rights.

Last updated 19 October 2026. Draft for approval.

Who we are

Work Local Forest Row is run by Ferris Creative LTD, company number 14585804, registered in England and Wales. Registered office: 24 Freshfield Bank, Forest Row, RH18 5HG. We are the data controller for the information on this site. Contact us at hello@worklocalforestrow.uk. Ferris Creative LTD has applied to register with the Information Commissioner's Office (ICO), and we'll show our registration number here as soon as the ICO confirms it.

What we collect, and why

If you're looking for work

Your account: email address, a password (stored scrambled, so we can't read it), your name, the village you live in, and whether you're under 18. We don't ask for your date of birth or full address. Why: to run your account and show you jobs you can do. Lawful basis: contract.
Your profile: headline, skills, availability, the kinds of work you want, a few lines about you, and optionally a phone number. Why: so businesses you apply to know who you are. Lawful basis: contract.
Your CV, if you upload one. CVs often contain more than you'd expect. Please leave out anything you'd rather not share, such as your date of birth, health, religion or ethnicity. If you include details like that, you're choosing to share them with the businesses you apply to, and we rely on the explicit consent you give when you upload. Lawful basis: contract, and explicit consent for any special category details.
Your applications: which jobs you applied for, your note, the CV you sent, and the status the business sets. Lawful basis: contract.
"Open to offers", only if you switch it on. Checked local businesses then see your first name, village, headline, skills and availability. Lawful basis: consent, which you withdraw by switching it off.
Job alerts, only if you switch them on. Lawful basis: consent.

If you're a business

Your business name, address and postcode, your name, email, phone, website and Companies House number if you give it. Why: to check the business is real and local, and to run your account. Lawful basis: contract, and legitimate interests in keeping fake jobs off the board.
Featured job payments: Stripe handles your card details. We only see that a payment was made, its amount and date. Lawful basis: contract, and legal obligation for accounting records.

Everyone

Reports you send us, and your email if you give it. Lawful basis: legitimate interests and our legal duties to keep the service safe.
Security records: scrambled IP addresses for rate limiting and stopping abuse, kept for a day. Lawful basis: legitimate interests.
Visit counts: we count page views on our own server, by page and day, with no cookies and nothing that identifies you.
Google Analytics, only if you accept cookies. See cookies.
Automated decisions: we do not use your information for automated decision-making or profiling to rank, filter or reject candidates. Only two simple rules run automatically: 16 and 17 year olds can't apply for jobs a business has marked 18 and over, and job adverts that look like scams or pay below the minimum wage are held back until a person has checked them.

If you send us a photo

The photo, the name you'd like it credited to, your email address, where it was taken and any note. Why: to choose photos to feature on the site and credit you properly. Your email is only used to tell you if we use it, and is never shown. Lawful basis: consent, which you can withdraw at any time by asking us to take the photo down.

Who sees your information

Businesses you apply to see your name, village, profile, email address, phone number if you've added one, your note and the CV you send. Once they have it, they are responsible for it under data protection law.
Businesses whose request you accept get your name, email and phone number.
Our suppliers, who process data for us under contract: Cloudflare (hosting, database, file storage, email sending and the robot check), Stripe (featured job payments), Google (analytics, only with consent) and postcodes.io (we send it business postcodes to work out distances, never your personal details). Cloudflare, Stripe and Google may process data outside the UK, including in the United States. All three are certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), which the UK government recognises as giving adequate protection.
Nobody else. We never sell data, and sponsors never see it. We would share information with the police or a regulator only where the law requires it.

How long we keep it

Applications, and the CV sent with them: six months after the job closes.
Accounts: until you delete them. If you don't log in for 12 months we email you, and delete the account 30 days later if you don't.
Sign-ups never confirmed: seven days.
Photos you send: while we show them, and for a year if we don't use them. Ask and we'll delete yours straight away.
Ended jobs: 90 days.
The list of businesses that opened your CV: 12 months.
Reports and moderation decisions: three years, so we can show how we handled a problem if we're ever asked.
Payment records: six years, for the accounts.
Visit statistics in Google Analytics: 14 months.

Under 18s

You can sign up from 16. If you're 16 or 17, businesses can't browse your profile and "open to offers" is switched off. You apply to the jobs you choose, and only those businesses see your details.

Your rights

You can see, correct, download or delete your information at any time from your account page, or by emailing hello@worklocalforestrow.uk. You can also object to how we use it, ask us to restrict it, and withdraw consent whenever you like. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Changes

If we change this policy in a way that matters, we'll email account holders before it takes effect.