Last updated 26 September 2026 · Version 2026-09d
Who we are
Staffroom24 runs this website. We carry out the statutory safeguarding checks for education supply agencies placing staff in schools in England.
Company details to follow: our registered company name, company number, registered office, Information Commissioner's Office registration number and data protection contact will be printed here.
This notice covers what the website itself collects: from people who visit it, join the waiting list or write to us. We decide what is collected and why, which makes us the controller of it under the UK General Data Protection Regulation and the Data Protection Act 2018.
Write to us about your personal data at hello@staffroom24.com, and a person will answer.
If you use Staffroom24 through an agency account, your full privacy notice is in your account. If you are a candidate, yours is the candidate privacy notice, which your own pages ask you to read and sign.
What the website collects
If you visit this website
Your browser sends the details every browser sends: your internet address, the kind of browser and device, and the page you asked for. Our hosting provider keeps short-lived records of them to run the site and keep it safe. If you reach a page that does not exist, we note the address you tried and the page that sent you, so we can mend the link. If one of our pages hits an error, our servers note the error and where in our code it happened, with names and references taken out. If you choose Allow when asked, we count which pages are used, with names and references taken out of their addresses and never your name or email address, and to fix faults we record where you click and scroll with every word, picture and document on the screen hidden and nothing you type. We do not use advertising, and we do not build a picture of who you are. The cookies page lists everything the site stores in your browser.
If you join the waiting list
Your email address, the page you joined from and when. We send one email to confirm, and then nothing until we open.
If you write to us
Your email address, what you write and anything you attach.
Why we use it, and the lawful basis
The law lets us use personal data only for a reason it recognises, called a lawful basis. This is what the website collects each kind of data for, the basis for each, and how long it is kept.
| What for | What we use | Lawful basis | How long |
|---|---|---|---|
| Running this website and keeping it and the service secure | Your internet address, your browser and the page you asked for. If you reach a page that does not exist, the address you tried and the page that linked to it. | Legitimate interests: a site that works and is not misused. | Hosting records for the short time Vercel keeps them. A note of a missing page goes into our activity record, kept seven years. |
| Counting visits to improve Staffroom24 and fix faults, only if you allow it | The pages you visit, with names, references and the codes in our links taken out of their addresses, your browser and device, and a random number for your browser. A recording of the visit that shows where you click and scroll and which pages you move between, with every word, picture, document and signature on the screen hidden in your browser before it is sent, and nothing you type. Pages with your documents, your identity check, your photograph or a video call are not recorded at all. The errors a page hits, with anything identifying taken out. If you are signed in to an agency account or our staff screens, the reference of your account, your role and your agency. Never your name or email address, and never anything from a file. Your internet address reaches PostHog with each count and is discarded, not kept. PostHog handles it for us in the European Union. | Consent: you chose Allow when asked. Choose No thanks on the cookies page whenever you like and counting and recording stop. | Recordings for 30 days. Counts and errors no longer than 12 months. |
| Finding and fixing faults on our servers | When our servers hit an error: the error message and where in our code it happened, the kind of page, with names, email addresses, references and the codes in our links taken out, and the reference of the record involved. Never what you typed, never anything from a file, and nothing stored on your device. PostHog handles it for us in the European Union. | Legitimate interests: a service that works, and faults found before they reach a candidate's file. | No longer than 12 months. |
| Keeping the waiting list and telling you when we open | Your email address, the page you joined from and when. | Consent: you asked to join, and you can leave whenever you like. | Until you ask us to take you off, or 24 months after you joined, whichever comes first. |
| Answering you when you write to us | Your email address, what you write and anything you attach. | Legitimate interests: answering the people who contact us. | As long as the conversation needs, then with the account or the file it is about. |
Where we rely on legitimate interests we have weighed them against yours, and you can object: see Your rights.
Who handles it for us
We do not sell personal data and we do not use it for advertising. Four services handle what the website collects. Each one handles it only on our instructions, under a contract that requires it to keep it safe.
| Who | What for | What passes through them | Where |
|---|---|---|---|
| Supabase | Our database. The waiting list, the email people send us and our record of activity on the site are kept here. | Your email address, what you write to us, and a note of a page that could not be found. | London, United Kingdom. Supabase's support staff can reach it from elsewhere to keep it running. |
| Vercel | Hosts this website and runs the code behind every page. | Short-lived technical records of each request: your internet address, your browser and the page you asked for. | Our server code runs in London. Pages are delivered through its network worldwide, and it is a United States company. |
| Resend | Sends the email confirming you joined the waiting list, and receives the email you send us. | Your email address, the message and anything attached to it. | The United States, with incoming email received in Ireland. |
| PostHog | Counts which pages of this website are used and records a masked replay of the visit, so we can improve it and fix faults. Only if you choose Allow when asked. Our servers also send it their error reports. | The pages you visit, with anything identifying taken out of their addresses, your browser and device, and a random number for your browser. A replay of where you click and scroll with every word on the screen hidden and nothing you type. Never your name or email address. | The European Union, on PostHog's cloud in Frankfurt. PostHog is a United States company. |
We will also share data where the law requires it, for example with the police or a court.
Data outside the United Kingdom
Our database is kept in London, and the code behind every page runs in London. Supabase, Vercel, Resend and PostHog are based in the United States, or reach our data from there to keep their service running.
When personal data goes outside the United Kingdom it stays protected. We rely on the UK’s adequacy regulations, including the UK–US data bridge for companies certified to it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses in each provider’s data processing terms. You can ask us for a copy of the safeguard that applies at hello@staffroom24.com.
How long we keep it
We keep personal data for as long as we need it for the reason we have it, and then delete it.
- The waiting list: until you ask us to take you off, or 24 months after you joined, whichever comes first.
- Email you send us: as long as the conversation needs, then with the account or the file it is about.
- Records of a visit: for the short time our hosting provider keeps them. A note of a missing page goes into our activity record, kept seven years. If you allowed counting visits, recordings are kept 30 days and counts and errors no longer than 12 months.
Keeping it safe
- Everything travels over an encrypted connection, and browsers are told never to use an unencrypted one.
- The database is encrypted where it is stored.
- Every action is written to a record that cannot be edited.
If something goes wrong with personal data we hold, we tell the Information Commissioner’s Office where the law requires it, and we tell the people affected without delay.
Your rights
You have the right to ask us:
- for a copy of the personal data we hold about you
- to correct anything that is wrong or incomplete
- to delete it, where we no longer have a good reason to keep it
- to restrict what we do with it while a question about it is settled
- to stop using it where we rely on legitimate interests
- for the data you gave us in a form you can take to another service
- to stop, where we rely on your consent: taking you off the waiting list, for example
Write to hello@staffroom24.com. It is free, and we answer within one month. We may ask you to confirm who you are first.
Complaining
Tell us first if you can, and we will try to put it right. You can also complain to the Information Commissioner's Office, which looks after data protection in the United Kingdom: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk.
Changes to this notice
When we change this notice we change the date and the version at the top of it. If you are on the waiting list and a change affects the data we already hold about you, we tell you by email before it takes effect.