This Privacy Policy explains how Switchable Ltd ("Switchable", "we", "us", or "our") collects and uses personal data when you access or use our websites at switchable.org.uk, switchable.co.uk, and switchable.careers, and any related tools or services made available through these websites (collectively, the "Platform"). It applies to learners, prospective learners, employer contacts, and other visitors to the Platform.
Switchable Ltd, a company incorporated in England and Wales (Company No: 17052031), acts as the data controller in relation to personal data collected directly from users, website visitors, and prospective customers. We are registered with the Information Commissioner's Office (ICO) under registration number ZC095665.
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
To provide the Platform, we may share personal data with trusted third-party service providers acting as data processors, such as hosting, analytics, form, email, and technical infrastructure providers. These processors act only on our instructions and are subject to appropriate data protection obligations.
If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact us at legal@switchable.org.uk.
1. What Personal Data We Collect and Why
Switchable collects and processes personal data only where necessary to operate the Platform, comply with applicable legal and regulatory obligations, and protect the integrity and security of the Platform.
User engagement and administration: We process personal data to manage your interactions with the Platform, administer access to tools and content, and communicate with you about your use of the Platform. This may include your full name, email address, and telephone number where you choose to provide it.
Quizzes, forms, and assessments: We process personal data to deliver quizzes, assessments, and related tools, and to generate insights or recommendations based on your responses. This may include responses relating to your preferences, experience, eligibility, or other information you voluntarily provide.
Lead generation and provider matching: Where you have explicitly requested to hear from one or more training providers, we process your contact details and quiz or form responses to share with those providers on your behalf. We only share your details with providers you have actively selected or consented to be contacted by. We do not share your details with any provider without your explicit consent.
Apprenticeship-specific data: Where you submit a form relating to apprenticeship opportunities, we may also process information about your current employment status, employer details (where relevant), and prior qualifications at the relevant level. Apprenticeship providers require this data to assess eligibility and progress your enquiry. This data is shared only with the apprenticeship provider(s) you have selected or consented to be contacted by, and on the same lawful and consent basis as any other lead data.
Employer contact data for apprenticeship Employer Leads: Where you submit an employer enquiry form on our business pages, we process information about you and your organisation to match your enquiry to a suitable apprenticeship delivery provider. This includes your name, role, work email, work phone, organisation name, sector, size band, levy status, employer reference number (where provided), whether you currently have apprentices, your forecast apprentice hiring volume, the apprenticeship standards you are interested in, urgency, whether you have a candidate in mind, and any free-text notes you choose to add. We rely on legitimate interests under Article 6(1)(f) UK GDPR for this processing, and on the corporate-subscriber rule under the Privacy and Electronic Communications Regulations (PECR) for related follow-up contact.
Digital products and subscription access: Where you purchase or access digital products or subscription-based services, we process personal data to provide access, manage entitlements, and administer service communications.
Communications and support: We process personal data to respond to enquiries, provide support, manage feedback, and maintain records of communications.
Technical operation, analytics, and security: We process personal data to operate, maintain, and improve the Platform, monitor performance, ensure security, and prevent misuse. This includes IP address, device type, browser information, and usage data collected through cookies and analytics tools, subject to your consent.
Referral programme: Switchable operates a referral programme through which registered users can refer friends to the Platform. Where you participate as a referrer, we process your name and email address to deliver your reward when a friend you referred achieves a confirmed enrolment, on the basis of legitimate interests. Where you arrive at the Platform via a referral link, we record that referral against your submission on the basis of legitimate interests; you are informed of this at the point of form submission. On confirmed enrolment of a referred friend, we notify the referrer that the enrolment has occurred; we do not share the friend's contact details or any other personal information with them. To deliver rewards, we share the referrer's email address with Amazon.co.uk solely for the purpose of sending an Amazon gift card; Amazon acts as a data processor for this limited purpose only. Referral records are retained for two years from the date the reward becomes payable, or three years where a referral was rejected on fraud grounds.
We do not intentionally collect special category (sensitive) personal data such as information relating to health, ethnicity, religious beliefs, or sexual orientation. Where such data is inadvertently submitted, it will not be used and may be deleted.
2. How We Collect Your Data
We collect personal data through the following channels:
- Landing pages and opt-in forms
- Quizzes, surveys, and assessment tools
- General interactions with the website
- Purchases of digital products or subscription-based services, where applicable
- Website analytics, cookies, and similar tracking technologies, subject to your consent
We may collect and temporarily store partial form or quiz responses where a user begins but does not complete a submission. Partial responses are used solely for analytical, service improvement, and system functionality purposes. They are not shared with training providers and are not used for marketing unless the user completes the form and provides explicit consent.
Contact details such as an email address or telephone number are requested only after you have completed relevant qualifying questions, or where you have actively chosen to provide them to receive a service or be contacted by a provider.
3. Lawful Basis for Processing
We process personal data only where we have a lawful basis to do so under the UK GDPR:
Consent: Where you submit forms, quizzes, or assessments through the Platform, opt in to receive marketing communications, consent to non-essential cookies or tracking technologies, or request to be contacted by a training provider. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Contract: Where processing is necessary to provide purchased digital products or subscription-based services, including to provide access, manage support, and administer payments.
Legitimate interests (general): To operate, maintain, and improve our services, manage enquiries and lead records, and conduct internal reporting and analysis using anonymised or aggregated data. We do not rely on legitimate interests as a lawful basis for direct marketing to learners or for sharing learner personal data with third parties for their own marketing purposes.
Legitimate interests (business-to-business apprenticeship lead generation): Where you submit an employer enquiry through our business pages, we process and share your contact details with our apprenticeship delivery partner on the basis of legitimate interests, balanced against your rights and freedoms under a Legitimate Interests Assessment that we maintain internally. We currently route Employer Leads to one named delivery partner: Riverside Training Limited (UKPRN 10005488). A summary of our Legitimate Interests Assessment is available on request via legal@switchable.org.uk.
4. Our Obligations as Data Controller
Switchable Ltd acts as the data controller in relation to personal data collected through the Platform. We are registered with the ICO (Registration No: ZC095665) and process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
Where third-party service providers are engaged, they act as data processors or independent data controllers depending on the services provided. All processing by third parties is carried out under appropriate contractual arrangements and safeguards.
5. Payments Processing and International Transfers
Where users purchase digital products or subscription-based services through the Platform, payment processing is handled by third-party payment service providers. Switchable does not store or process payment card details directly.
In connection with the operation of the Platform, personal data may be transferred to and processed by third-party service providers located outside the United Kingdom. Where such international transfers occur, Switchable ensures that appropriate safeguards are in place in accordance with the UK GDPR, including approved contractual protections and adequacy decisions where applicable.
6. Data Sharing and Retention
Switchable shares personal data only where lawful, necessary, and proportionate. Personal data is shared on a need-to-know basis with:
- Trusted third-party service providers who support the operation of the Platform (hosting, analytics, email, form tools, payment providers)
- Training providers, solely where you have explicitly consented to be contacted by them and have selected them through our Platform
- Apprenticeship delivery providers, where you are an employer contact who has completed an Employer Lead form on our business pages. We currently route Employer Leads to one named delivery partner: Riverside Training Limited (UKPRN 10005488). We will update this Privacy Policy if we add or change delivery partners.
We do not sell personal data. We do not share personal data with any training provider unless you have actively requested to hear from them.
AI-assisted operations: We use third-party AI assistant tools as sub-processors to support internal operations including analysis, drafting communications, and lead-handling workflows. These providers act as data processors under Data Processing Addenda that include Standard Contractual Clauses with the UK International Data Transfer Addendum for any transfers outside the United Kingdom. Personal data processed via these providers is not used to train their models. AI tools assist our staff but do not make automated decisions about you under Article 22 UK GDPR. Final decisions on lead routing, eligibility, or any matter affecting you remain with our staff.
Employer Lead sharing with apprenticeship delivery providers: When we route an Employer Lead to an apprenticeship delivery provider, the provider becomes an independent data controller for the personal data they receive. The handoff is exclusive: each Employer Lead is routed to a single provider, not sold or shared with multiple parties. Personal data shared with the provider must be deleted by them within 90 days where the enquiry has not progressed to an agreement.
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected:
| Category | Purpose | Retention Period |
|---|---|---|
| User contact details | Engagement, communications, service delivery | Retained while active; anonymised or deleted after a reasonable period of inactivity |
| Quiz and form responses | Delivery of tools and recommendations | Retained as long as necessary; anonymised thereafter |
| Lead data (consented users) | Provider matching as consented | Up to 6 months; anonymised or deleted thereafter |
| Lead data (unqualified users) | Internal filtering | Anonymised as soon as no longer required |
| Digital product access data | Access management and support | Duration of access plus a reasonable period thereafter |
| Communications and support records | Enquiries and dispute resolution | Reasonable period following resolution |
| Technical and usage data | Platform operation, security, analytics | Per analytics and cookie settings; anonymised where feasible |
| Referral records | Referral programme administration and fraud prevention | 2 years from reward payable date; 3 years where referral rejected on fraud grounds |
| Payment data | Payment processing | Held by third-party providers per their obligations; Switchable holds no card details |
Once personal data is no longer required it is securely deleted or irreversibly anonymised. Anonymised data may be retained for internal reporting purposes.
7. Marketing Communications, Analytics, and Advertising
Where you have opted in, we may contact you with updates, insights, or relevant opportunities. You can unsubscribe at any time using the link in our communications or by contacting legal@switchable.org.uk.
We use third-party technologies to support analytics, advertising, and performance measurement, including services provided by Google and social media platforms such as Meta and TikTok. These are deployed only in accordance with your consent preferences.
We do not intentionally share or upload personal contact details with advertising platforms unless clearly disclosed and you have provided the necessary consent.
8. How We Protect Your Personal Data
We implement appropriate technical, administrative, and organisational measures to protect personal data against unauthorised or unlawful access, loss, alteration, misuse, or disclosure. These include encryption, access controls, authentication mechanisms, and internal security policies.
Where personal data is processed by third-party processors, we require them to implement equivalent security standards and to process personal data only in accordance with our documented instructions and applicable law.
While we take reasonable steps to safeguard personal data, no security system is entirely infallible and absolute security cannot be guaranteed.
9. Your Rights Under UK GDPR
As a user of our Platform, you have the following rights in relation to your personal data:
Right of Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may request the correction of inaccurate or incomplete personal data.
Right to Erasure: You may request deletion of your personal data where processing is no longer necessary, subject to any legal obligations we may have to retain it.
Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances.
Right to Object: You have the right to object to processing for specific purposes, including direct marketing or processing based on legitimate interests. If you are an employer contact whose details we are processing on the basis of legitimate interests for apprenticeship lead generation, you can object at any time by emailing legal@switchable.org.uk.
Right to Data Portability: Where applicable, you may request your personal data in a structured, machine-readable format.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at legal@switchable.org.uk. We will respond in accordance with UK GDPR timelines.
10. Cookies and Similar Technologies
Our website uses cookies and similar technologies. For full details please see our Cookie Policy.
In summary we use:
- Strictly necessary cookies: Essential for the Platform to function. No consent required.
- Preference cookies: Remember your choices and settings.
- Analytics cookies: Collect anonymised usage data to improve the Platform. Consent required.
- Advertising cookies: Support performance measurement via platforms such as Meta and Google. Consent required.
When you first access the Platform, you can manage your cookie preferences via the cookie banner. Non-essential cookies are only placed with your explicit consent and are stored for up to 12 months unless you withdraw consent earlier.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the Platform, our services, or applicable legal requirements. Any updates will be published on our website. The date at the top of this page indicates when it was last updated.
12. How to Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our Data Protection Contact:
- Attn: Data Protection Contact, Switchable Ltd
- Email: legal@switchable.org.uk
- Registered Address: 128 City Road, London, United Kingdom, EC1V 2NX
Charlotte Harris is the appointed Data Protection Officer for Switchable Ltd. You can reach her using the contact details above.
13. How to Complain
If you think we have handled your personal data unfairly or in a way that breaches data protection law, please tell us first. We take complaints seriously and use them to improve how we work.
How to complain: use our complaint form at switchable.org.uk/data-complaint, email legal@switchable.org.uk, or write to us at the registered address above. You do not need to use a particular format. To help us investigate, please tell us what happened, when, and what outcome you are looking for.
What happens next: we will acknowledge your complaint within 30 days (usually within 5 working days), investigate without undue delay, and give you a written outcome within 3 months. If we need longer because the complaint is complex, we will tell you why and give a revised target date. We log every complaint internally and use what we learn to improve our processes.
If you are not satisfied: if you are not happy with our response, or if we have not responded within 3 months, you can complain to the Information Commissioner's Office at ico.org.uk/concerns or by telephone on 0303 123 1113. Under the Data (Use and Access) Act 2025, the ICO will normally expect you to have raised the matter with us first.
Our full Data Protection Complaints Procedure is available on the data complaint page or on request.