The Dep Hub
Back to home

Privacy Policy

Last updated: August 2026

1. Introduction

The Dep Hub ("we," "us," "our," or "Company") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

2. Information We Collect

We collect information you provide directly to us, including:

For Teachers:

  • Account Information: Name, email address, password, phone number, location
  • Profile Information: Profile photos, bio, teaching disciplines, experience, availability, references, CV documents
  • DBS Information: DBS certificate number, level (Standard, Enhanced, or Enhanced + Barred List), issue date, and DBS Update Service status. We do not store copies of DBS certificates
  • Right to Work: Self-declared right to work status and supporting details
  • Insurance: Self-declared public liability insurance status, provider, and expiry date
  • Profile submission declaration — a record of the teacher's confirmation that their profile information is accurate and their consent to DBS review, including timestamp, collected at profile submission
  • Communication Data: Messages, enquiries, and feedback you send through the Platform
  • Technical Data: IP address, browser type, pages visited, time spent on the Platform (via cookies and analytics)

For Schools:

  • Account Information: School name, contact name, email address, phone number, location
  • Profile Information: School logo, bio, organisation type, website, minimum DBS requirements
  • Safer recruitment acceptance — a record of the school's acceptance of their safer recruitment responsibilities, including timestamp, collected at signup
  • Subscription and Billing: Plan details and billing records (payment card data is processed by Stripe and not stored by us)
  • Communication Data: Messages and enquiries sent through the Platform
  • Technical Data: IP address, browser type, pages visited, time spent on the Platform

3. Lawful Basis for Processing (GDPR)

We process your personal data on the following lawful bases:

  • Legitimate Interests: Providing and improving the Platform, fraud prevention, community safety, and supporting safe recruitment in settings working with children (Article 6(1)(f))
  • Performance of Contract: Processing necessary to provide our Platform services (Article 6(1)(b))
  • Legal Obligation: Compliance with safeguarding and other legal requirements
  • Consent: Where you give it for specific purposes — for example, sharing your DBS certificate number with a particular school, or optional analytics/marketing cookies. You can withdraw consent for these at any time

Special category and criminal offence data (DBS information): We process DBS-related data (certificate number, level, issue date, and Update Service status) under Article 6(1)(f) UK GDPR (legitimate interests — supporting safe recruitment in settings working with children) and, as this is criminal offence data, under the condition in paragraph 18 of Schedule 1 to the Data Protection Act 2018 (safeguarding of children and of individuals at risk). We do not rely on your consent as the legal condition for processing this data. We maintain an Appropriate Policy Document governing this processing, available on request.

4. How We Use Your Information

We use your information to:

  • Provide, maintain, and improve the Platform
  • Verify your identity and prevent fraud
  • Review profiles before publishing (safeguarding)
  • Record and review DBS information as part of our vetting process
  • Facilitate connections between teachers and schools
  • Send service updates, notifications, and responses to your enquiries
  • Comply with legal and regulatory requirements
  • Analyse Platform usage and improve our services

5. DBS Data Handling

We collect DBS certificate numbers and related information solely to support safeguarding and profile review. We do not store copies of DBS certificates. DBS numbers are held securely, visible only to our admin team for review purposes, and shared with schools only where a teacher has given explicit, separate consent. For teachers registered on the DBS Update Service, we may conduct an online status check at gov.uk/check-dbs-certificate as part of the profile review process. Teachers confirm at profile submission that their declared information is accurate and that it will be reviewed.

We do not use automated AI or large language model processing on DBS information or other personal data. Sensitive data is never sent to AI providers.

6. Data Retention

We retain your personal data as follows:

  • Active Accounts: Retained for the duration of your account
  • Deleted Accounts: Deleted or anonymized within 30 days of account deletion, except where required by law
  • DBS Information: Retained for 7 years to comply with safeguarding best practices
  • Acceptance Records: Declaration and acceptance timestamps retained for 7 years for legal compliance
  • Transactional Data: Retained for 7 years for billing and legal compliance

7. Who We Share Your Data With

We may share your information with:

  • Third-Party Service Providers: Cloud hosting, email services, and analytics (fully GDPR-compliant with Data Processing Agreements)
  • Schools: Your public profile information when you interact with job postings or schools request your CV. DBS certificate numbers are only shared where you have explicitly authorised this
  • Legal Authorities: If required by law or to prevent harm
  • Administration Staff: Internal team only for profile vetting and customer support

We do not sell or rent your personal data to third parties.

8. Your Rights Under GDPR

You have the right to:

  • Access your personal data (Right of Access)
  • Correct inaccurate data (Right to Rectification)
  • Request deletion of your data (Right to Erasure) — subject to legal obligations
  • Restrict processing (Right to Restrict Processing)
  • Data portability (Right to Data Portability)
  • Object to processing (Right to Object)
  • Withdraw consent at any time

To exercise any of these rights, contact us at support@thedephub.co.uk

9. Third-Party Processors

We use the following third-party data processors (all GDPR-compliant):

  • Application hosting and platform: Base44, Inc. (United States). Your data, including DBS metadata, is stored and processed on US-based infrastructure via Base44 and its sub-processors, under a Data Processing Agreement with appropriate international transfer safeguards. Base44 holds SOC 2 Type II and ISO 27001 certifications, and data is encrypted in transit and at rest
  • Sub-processors: Base44 uses sub-processors including MongoDB and Supabase (data and media hosting), Render (servers), Google Cloud (analytics), and SendGrid. A current list is available on request. Transfers outside the UK are covered by appropriate safeguards
  • Email Services: Resend
  • Payment Processing: Stripe (payment card data is processed by Stripe and not stored by us)

All processors are bound by Data Processing Agreements and contractually required to protect your data.

10. ICO Registration

The Dep Hub is registered with the United Kingdom Information Commissioner's Office (ICO) under registration reference ZC204581. You can verify our registration at ico.org.uk.

11. Cookies

We use cookies to improve your experience. See our Cookie Policy for details.

12. Security

We implement appropriate technical and organizational security measures to protect your data, including encryption, secure authentication, and restricted access. However, no system is completely secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy. Changes will be posted on this page, and we will notify you of significant changes.

14. Contact Us

For privacy-related questions or to exercise your rights, contact: support@thedephub.co.uk