Privacy Policy

Defence Works is a job board for the UK's defence, nuclear and advanced manufacturing sector, operated by Global Payments Consultants Ltd, Lime Garth, Kendal, LA9 5DU. For data protection purposes we are the data controller for the personal data described below.

Questions about this policy or your data: privacy@defence-jobs.uk.

When you declare your clearance level, we collect only the self-selected category (e.g. BPSS, CTC, SC, DV). We do not collect, store, or transmit vetting certificates, reference numbers, issue or expiry dates, sponsoring departments, or any other classified or traceable information.

Clearance status is never made publicly available, never indexed by search engines, and never shared with third parties. It is attached only to the specific job applications you submit and is visible solely to that hiring employer for the duration of their recruitment process. It is permanently and irreversibly deleted from our records within 6 months of your last activity, or immediately on request.

All clearance claims are verified independently by prospective employers using official Ministry of Defence vetting systems. We are not a vetting authority, do not hold official records, and do not perform verification checks.

• Employer account data — name, company name, work email address, and the sign-in credentials held by our authentication provider.
• Vacancy content — job titles, descriptions, locations, salary ranges and application links that employers submit for publication.
• Payment data — where a paid listing is purchased, we record the transaction reference, amount, currency, listing type and billing email. Card details are entered with our payment provider and are never received or stored by us.
• Applicant data — where an application is made through the site rather than by an external link, we handle the contact details, CV and any supporting information submitted, and pass them to the advertising employer.
• Usage data — anonymised vacancy view counts (stored as a non-reversible hash rather than an IP address), plus standard server logs needed to run and secure the site.

• Contract — creating and managing employer accounts, publishing vacancies, taking payment and issuing receipts.
• Legitimate interests — moderating listings before publication, preventing fraud and abuse, measuring vacancy performance for the advertising employer, and sending service messages such as onboarding and listing-expiry reminders.
• Legal obligation — keeping payment and tax records for the periods required by law.
• Consent — any non-essential cookies or optional messages. You can withdraw consent at any time; see our cookie notice.

Where an application is submitted through the site, we act on the employer's behalf in passing it on. The advertising employer is responsible as controller for its own use of your application after it is received.

Where you arrive from an invite or shared job link, we store a short referral code in your browser for up to 30 days so we can count how many sign-ups a given link produced. It contains no personal data, is never linked to your identity, and clearing your browser storage removes it.

We do not ask for special category data (such as health, ethnicity or trade union membership) and ask that you do not include it in a CV or application. Applications are used only to put you in touch with the employer advertising that vacancy. We do not sell candidate data, and we do not share it with employers other than the one whose vacancy you applied to.

We use a small number of service providers who process data on our behalf under contract:

• Our hosting, database and authentication platform, which stores accounts, vacancies and payment records.
• Our email delivery provider, which sends account, receipt and reminder emails.
• PayPal, which processes payments for paid listings under its own privacy policy.
• Adzuna, whose public job feed supplies some third-party vacancy listings shown on the site. This is a data source, not a recipient of your data.
• Google Search Console, used to submit our sitemap. It receives page URLs, not personal data.

Where a provider processes data outside the UK or EEA, that transfer relies on the UK International Data Transfer Addendum or equivalent safeguards.

• Employer accounts and company details: for as long as the account is open, then up to 12 months after the last activity.
• Published vacancies: standard listings expire 30 days after publication and are retained afterwards as a record of what was advertised.
• Applications and CVs submitted through the site: 6 months from submission, unless the employer asks us to remove them sooner.
• Payment and receipt records: 6 years, to meet UK accounting and tax requirements.
• Email delivery and reminder logs: 12 months, to evidence what was sent and to diagnose delivery problems.

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Ask us to delete your data where we have no continuing lawful reason to keep it.
• Object to, or ask us to restrict, processing based on our legitimate interests.
• Withdraw consent where consent is our basis for processing.
• Ask us to transfer your data to you or another provider in a portable format.

To exercise any of these, email privacy@defence-jobs.uk. We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Access to the site's database is restricted by row-level security rules, administrative functions require an authenticated account with an admin role, and traffic is served over HTTPS. No online service can be guaranteed completely secure; if a breach affects your rights we will notify you and the ICO as required.

We may update this policy as the site changes. The date at the top shows when it was last reviewed. Material changes affecting how we use your data will be notified to account holders by email.