Privacy policy
The short version
- We collect what's needed to run Direct Supply: your account, your profile, the checks we do on teachers, your messages and bookings, and your subscription.
- Verified schools can see teachers' contact details and verification status. Nobody can see teachers' check details except the teacher and Direct Supply.
- We never sell your data and we don't use advertising or tracking cookies.
- You can delete your account at any time from your Account page, and your data goes with it.
1. Who we are
Direct Supply is run by William Fraser, a sole trader trading as Direct Supply, based in Staffordshire, England. For the information described in this policy, we are the "controller" under UK data protection law.
For any privacy question or request, email hello@getdirectsupply.co.uk. We'll reply within one month.
2. What we collect
Everyone with an account
- Your email address and a securely hashed password.
- Messages you send and receive on Direct Supply, and when they were read.
Supply teachers
- Profile (shown publicly): your name, headline, description, phases, year groups and subjects, qualifications, years of experience, region, town, postcode district, how far you'll travel, day rate and availability.
- Contact details (shown only to verified schools): your phone number and email.
- Verification details (never shown to schools): your date of birth, surname as registered, teacher registration number, criminal record check certificate or membership number, the nation you're registered in, and the names, schools and email addresses of two referees. We also record the outcome of each check.
- Activity: vacancies you apply for, rates you propose and booking requests you receive.
- Subscription: your plan, its status and renewal date, and the reference numbers Stripe gives us. We never see or store your card details.
School staff
- The school's name, official school number (URN or equivalent), region, town and postcode.
- Your name, job role, work email and phone number.
- Vacancies you post and bookings you make.
Referees
If a teacher names you as a referee, we hold your name, school and email address so we can contact you for a reference. We only use them for that.
3. How we use it, and why we're allowed to
| What we do | Lawful basis |
|---|---|
| Run your account, show teacher profiles, and let schools and teachers find, message and book each other | Contract: it's the service you signed up for |
| Show a teacher's phone and email to verified schools | Contract: it's how schools contact teachers directly |
| Verify teachers' identity, registration, criminal record check and references, and verify schools against official registers | Legitimate interests in keeping children safe and the platform trustworthy. For criminal record information, the condition we rely on is safeguarding of children and individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18), together with the consent you give when you submit your checks. |
| Take subscription payments and keep financial records | Contract, and legal obligation (tax records) |
| Send account emails such as sign-up confirmation, password resets and booking notifications | Contract |
| Prevent fraud and misuse, and keep the service secure | Legitimate interests |
We don't send marketing emails without asking you first, and we don't use automated decision-making or profiling that has legal effects on you. Every verification decision is made by a person.
4. Who can see your information
- Anyone can see teacher profiles, verification badges and open vacancies.
- Verified schools can also see teachers' phone numbers and email addresses.
- The people you message, apply to or book can see those messages, applications and bookings.
- Direct Supply can see everything, so it can run the checks and support users.
We use these service providers to run Direct Supply. Each only processes data on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and storage | EU (Ireland) |
| Cloudflare | Website hosting and security | Global network |
| Stripe | Subscription payments | UK, EU and US |
| Zoho | Sending and receiving email | UK |
| Google Fonts and jsDelivr | Delivering the site's fonts and code, which shares your IP address with them | Global |
Where data is processed outside the UK, it's protected by UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.
We'll share information with the police, a local authority designated officer or other authorities only where the law requires it, or where we believe it's needed to protect a child or someone at risk.
5. How long we keep it
- Your account, profile, checks, messages and bookings are kept until you delete your account. They're then deleted straight away, and removed from our backups within about a week.
- Payment records are kept for six years, because tax law requires it. Stripe keeps its own records under its privacy policy.
- Emails sent to hello@getdirectsupply.co.uk are kept for up to two years after the conversation ends.
6. Your rights
You have the right to:
- get a copy of the information we hold about you;
- have it corrected if it's wrong (most of it you can edit yourself on your Account page);
- have it deleted (use Delete account on your Account page, or email us);
- object to or restrict how we use it;
- receive your information in a portable format;
- withdraw consent where we rely on it. This doesn't affect anything we did before you withdrew it, but it may mean we can't verify you.
To use any of these rights, email hello@getdirectsupply.co.uk. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
7. Cookies and storage
We don't use advertising or analytics cookies. The site keeps two things in your browser's storage, and both are needed for it to work:
- your sign-in session, so you stay signed in;
- your light or dark mode choice.
Stripe's checkout page sets its own cookies to prevent fraud.
8. Security
All traffic is encrypted. Access to data is enforced by database rules, so each person can only reach what they're entitled to see. Teachers' check details are restricted to the teacher and Direct Supply. Passwords are hashed, and card details are handled only by Stripe. If a data breach is likely to put you at risk, we'll tell you and the ICO as the law requires.
9. Age
Direct Supply is for adults working in schools. You must be 18 or over to create an account.
10. Changes to this policy
If we make a significant change, we'll email account holders before it takes effect. The date at the top shows when the policy last changed.