Privacy Policy

MCR Pathways Website Privacy Notice

Last updated: October 2026

At MCR Pathways we are  deeply committed to respecting and protecting the privacy and security of personal data. This privacy notice explains how we collect, use and protect any personal data you provide or that collect when you visit and use our website mcrpathways.org.  We are committed to protecting your privacy in compliance with the UK General Data Protection Regulation  ( UKGDPR) and Data Protection Act 2018.

This notice also covers our online forms on join.mcrpathways.org (registering to become a mentor, asking us to call you back, contacting us, and telling us your needs for an event we have invited you to), My Mentor Journey (the personal page that guides you through becoming a mentor) and our jobs website, jobs.mcrpathways.org. Each of these forms shows a short summary of how we use what you tell us, and links to this page for the full details. This page names the organisations that help us run these services, and says where they handle your information and how it is protected (see The services we use).

What personal data we collect and how we collect it

We may collect and process the following types of personal data from you when you interact with our website:

Information you provide directly-

• General Inquiries/Get in touch: If you fill out a ‘Get in touch’ or ‘Contact us’ form, ask us to call you back about mentoring, or sign up for a newsletter, we collect your name, email address, phone number, and any other information you choose to provide in your message. Messages sent with our Contact us form reach the right team by email, delivered by Resend (see The services we use). We use your message only to reply to you, and we do not add it to our supporter database. If you ask us to call you back, we add your details to our supporter database so that the right member of our team can call you.
• Mentor Applications: When you apply to become a mentor through our website, we collect the personal data required for your application. This will include contact details, information about your suitability for the role, and any necessary background check information, including criminal conviction data. More specific details about the processing of mentor data, including emergency contact details and the handling of criminal convictions, are provided in our dedicated MCR Pathways Volunteer Mentor Privacy Notice, which you will be presented with during the application process. You register on join.mcrpathways.org, and your application is kept in our supporter database. Some people also get a personal link to My Mentor Journey from our team, where they can follow the steps to becoming a mentor and complete their safeguarding training. Progress there is kept with your record in our supporter database, and when you complete the safeguarding training we also keep a record of that, under your supporter database reference, in the database behind our Mentor Hub (see The services we use).
• Events: If we invite you to one of our events and send you a personal link to tell us your needs, we collect your round table choice, your meal choice, any allergies and any other needs you tell us about. Only the MCR staff organising the event can see all of your answers. The caterer receives only your first name with your meal choice and any allergies. We use these details only with your agreement, only for the event, and delete them 30 days after it. You can change or remove your answers with the same link until a week before the event.
• Job applications: If you apply for a job with us through jobs.mcrpathways.org, see Job applicants below.
• Partner Enquiries: If you contact us about  partnership opportunities through the website, we collect data on your name, organisation/company, contact information, how you wish to be contacted and what partnership opportunities are of interest.
• Donations: If you make a donation through our website, we will collect the necessary payment and contact details. This processing is typically handled by a third-party payment provider, and their privacy policy will also apply.

Information collected automatically:

• Usage Data: When you visit our website, we may automatically collect certain information about your device and how you interact with our site. This can include your IP address, browser type, operating system, referring URLs, pages viewed, and the dates/times of your visits. This data is primarily collected through cookies and similar technologies (See Cookies Selection below).
• Cookies: Our website uses cookies to enhance your Browse experience, analyse site traffic, and understand user behaviour.

Cookies and tracking technologies 

Necessary Cookies

These cookies are required for the website to function properly.

Cloudflare Turnstile	Our forms on join.mcrpathways.org (registering as a mentor, asking us to call you back and contacting us) and our job application form on jobs.mcrpathways.org use Cloudflare Turnstile to check that a form is being filled in by a person rather than a bot. To do this, Cloudflare processes technical information about your browser and device, including your IP address. It does not see your answers.
CookieYes	CookieYes is the software we use to implement the GDPR Cookie selection. It will remember your cookie preferences and allow you to update them.

Functional Cookies

These cookies add functionality from approved third party services.

Provider	Purpose
Vimeo	This cookie allows videos to play from Vimeo’s service. It provides some anonymised analytics like how many times a video has been watched or for how long.
Youtube	This cookie allows videos to play from Youtube’s service. It provides some anonymised analytics like how many times a video has been watched or for how long. It also contains additional information from Youtube if the user has used it on other sites such as: remembering the user’s preferences and remembering the user’s casting devices.
FundraiseUp	This cookie tracks your interactions with our FundraiseUp fundraising widget.

Analytics Cookies

These cookies allow us to understand user behaviour on the website, anonymously.

Provider	Purpose
Google Analytics	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.
Facebook	This cookie allows us to understand the effectiveness of our adverts from the Meta platforms (Facebook, Instagram) and allows us to advertise to our website visitors on those platforms.

AI Services

Provider	Purpose
Pangram	When you apply for a job with us, Pangram checks the written answer in your application (where you explain why you would be excellent in the role) for signs of AI-generated writing. See Job applicants.
Google Gemini	If your job application goes forward, Google Gemini may suggest where your CV and written answer show evidence for the job’s criteria. A person checks these suggestions and decides how your application is scored. See Job applicants.

Job applicants

This section explains how we use your information when you apply for a job with us through our jobs website, jobs.mcrpathways.org. The application form shows a short summary of it.

What we collect. Your name, email address, phone number and address; where you heard about the job; your employment history and qualifications; details of two referees; your written answer about why you would be excellent in the role; your CV; whether you need reasonable adjustments at interview, and the details if you do; your confirmation that you have the right to work in the UK; and, only if you choose to answer, whether you are disabled or care-experienced, for our Targeted Interview Schemes.

Why we can use it. We use your information to consider your application, which you have asked us to do (UK GDPR Article 6(1)(b)). We check applications for AI-generated writing and use AI to suggest evidence because we have a legitimate interest in a fair, consistent and efficient process (Article 6(1)(f)). We use Targeted Interview Scheme answers and reasonable adjustment details to meet our obligations as an employer (Article 9(2)(b) and the Data Protection Act 2018, Schedule 1, paragraph 1).

Checking for AI-generated writing. When you apply, an automated tool (Pangram) checks your written answer for signs of AI-generated writing. It sees only that answer, not your CV or anything else you tell us. We may also check the same answer with a second version of the tool, to compare how well they work. Our recruitment team decides what happens next. A very high result can mean your application does not go forward to shortlisting. If you said yes to either Targeted Interview Scheme question, a person always looks at your application on its own before that happens. You can ask for a person to review the decision, give us your views and challenge it, by emailing privacy@mcrpathways.org.

Evidence suggestions. If your application goes forward, one of our recruitment administrators may ask an AI tool (Google Gemini) to read your CV and written answer. It lists your employment history and any possible gaps in it, and suggests, with a quote from what you wrote, where you show evidence for each of the job’s criteria. It is told not to draw conclusions about personal characteristics such as your age or health. These are suggestions only: a person checks them and decides how your application is scored. Your Targeted Interview Scheme answers and reasonable adjustment details are never sent to either AI tool.

Who sees it. Only our recruitment administrators and the members of staff working on that job can see your application. Your Targeted Interview Scheme answers are used only for that scheme and are not scored. Only our recruitment administrators can see your reasonable adjustment details, and we use them only to arrange your interview. We contact your referees only if we are going to make you a conditional offer of employment, so please let them know you have given us their details.

Where it is kept. Your application and CV are kept in our recruitment system, which is hosted in London by Supabase and Vercel. To keep the form free of spam, Cloudflare Turnstile checks that a person is filling it in, and we keep a coded version of your IP address for about two days to limit how many applications can be sent from one place each day. The jobs website’s fonts come from Adobe Fonts, which receives your IP address and the address of the page you are viewing. More about each of these is under The services we use.

How long we keep it. We delete your application, your CV and everything we recorded about them, including the results of the AI checks, 180 days after the job’s closing date. We keep them longer only if a legal or safeguarding hold applies, and only while it does. If you applied through our old website form before 21 October 2026, a copy of that form is also held in our old website system until it is deleted.

Your rights. You have all the rights listed under Your Data Protection Rights below, including the right to ask a person to review a decision made by automated means. To use them, email privacy@mcrpathways.org.

Lawful Basis for Processing Your Data

We rely on the following lawful bases under UK GDPR for processing your personal data collected via the website:

Legitimate Interests: For website analytics, improving our website, preventing fraud, and responding to general inquiries where we believe our interests are balanced against your rights and freedoms. Our legitimate interest is to maintain an effective and engaging website and communicate effectively.

Consent: For non-essential cookies (e.g., analytics, marketing cookies) and for sending you marketing communications (like newsletters), where required. You have the right to withdraw your consent at any time.

Performance of a Contract: If you are applying to become a mentor application or making a donation that forms a contractual relationship.

Legal Obligation / Substantial Public Interest: Where we are required to process data to comply with a legal obligation such as safeguarding purposes, including criminal background checks for mentors or for reasons of substantial public interest (safeguarding children and individuals at risk).

How We Use Your Personal Data

We use the personal data collected from our website for the following specific purposes:

• To respond to your general inquiries and provide you with information you request.
• To process and manage mentor applications, including conducting necessary criminal background checks, to assess suitability for working with vulnerable young people, and to meet our safeguarding obligations.
• To manage your newsletter subscriptions
• To improve our website’s content, functionality, and user experience.
• To analyse website traffic and user trends.
• To process donations securely.
• For internal administrative purposes and record-keeping.
• To comply with legal and regulatory obligations.

Sharing Your Personal Data

MCR Pathways will not sell or rent your personal data to third parties. We may share your data in the following limited circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating our website, conducting our business, or providing services to you (e.g., website hosting, analytics providers, payment processors, applicant tracking systems, background check providers/vetting bodies). These providers are contractually bound to protect your data and only use it for the purposes we specify. The services that handle information from our website, forms, My Mentor Journey and jobs website are listed under The services we use below.
• Legal Requirements: When required by law, court order, or to protect our rights, property, or safety, or the rights, property, or safety of others.
• Organisational Changes: In the event of a merger, acquisition, or restructuring of MCR Pathways, your data may be transferred to the new entity.

The services we use

These organisations handle personal information for us so that we can run our website, our forms, My Mentor Journey and our jobs website. They work on our instructions under a contract, and may use your information only to provide their service to us.

• Salesforce: our supporter database. It holds mentor registrations, call-back requests, My Mentor Journey progress and event answers. Where, and how it is protected: Stored in the UK, in Salesforce’s London data centre. Salesforce is based in the United States; any access from outside the UK is under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Resend: delivers the messages you send with our Contact us form to our team’s email inboxes. Where, and how it is protected: Our account uses Resend’s European Union region (Dublin, Ireland) to send them. Resend is based in the United States; any access from there is under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Google Workspace: our email. Contact us messages, and our replies to them, are kept in our team’s inboxes. Where, and how it is protected: Google’s data centres, which can be in the UK, Europe, the United States or elsewhere; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Cloudflare Turnstile: checks that a person, not a bot, is filling in our forms on join.mcrpathways.org and jobs.mcrpathways.org. It receives technical details such as your IP address and browser, not your answers. Where, and how it is protected: Cloudflare’s worldwide network. Cloudflare is based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Vercel: hosts this website, join.mcrpathways.org (including My Mentor Journey) and our jobs website, and passes what you send in a form to where it is kept. Where, and how it is protected: Its worldwide network. The jobs website runs in London; our other forms may be handled outside the UK, including in the United States. Vercel is based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Supabase: the database and file storage for job applications and CVs; and, for My Mentor Journey and our Mentor Hub, a record of the courses a mentor has completed, such as safeguarding training. Where, and how it is protected: Job applications: London, in the UK. Course records: Dublin, Ireland, in the European Union, which the UK recognises as giving adequate protection.
• Pangram: checks the written answer in a job application for signs of AI-generated writing. It sees that answer only. Where, and how it is protected: The United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Google Gemini: suggests evidence from job applicants’ CVs and written answers, for a person to check. Under the terms of the paid service we use, Google does not use what it is sent to improve its products, and keeps it only for a limited time to check for misuse. Where, and how it is protected: The United States and other countries where Google has facilities; covered by Google’s data processing terms, which our Data Protection Officer has approved for this use.
• Adobe Fonts: provides the fonts on this website and our jobs website. Your browser asks Adobe for them, so Adobe receives your IP address, browser details and the address of the page you are viewing. Where, and how it is protected: Adobe’s worldwide network. Adobe is based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Google Analytics: measures how this website is used (see Analytics Cookies above). Where, and how it is protected: Google’s data centres, including in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Beacon: our database for fundraising and supporters. This website loads Beacon’s code, so Beacon receives technical details such as your IP address and browser. Where, and how it is protected: Under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Fundraise Up: takes donations made on this website (see FundraiseUp in the cookie tables above), so it receives the details you give when you donate. Where, and how it is protected: Fundraise Up is based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Google Fonts: provides one of the fonts on this website. Your browser asks Google for it, so Google receives your IP address and browser details. Where, and how it is protected: Google’s data centres, including in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• YouTube and Vimeo: play the videos on this website (see Functional Cookies above). Where, and how it is protected: Both are based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.
• Meta (Facebook and Instagram) and LinkedIn: measure how well our adverts on their platforms work, and let us show our adverts to people who have visited this website. They receive your IP address, browser details and the pages you visit (Meta’s cookie is listed in the cookie tables above). Where, and how it is protected: Both are based in the United States; under the provider’s data protection terms; email privacy@mcrpathways.org for details.

International Data Transfers

MCR Pathways primarily processes and stores data within the United Kingdom. Some of the services above store or process data outside the UK, or are run by companies based in the United States that could access it from there. Where this happens, we rely on the safeguards UK law allows, such as the UK recognising the other country as giving adequate protection (as it does for the European Union) or transfer terms approved for UK transfers in our agreement with the provider. To find out which safeguard applies to a particular service, email privacy@mcrpathways.org.

Data Retention

We will retain your personal data for no longer than is necessary for the purposes for which it was collected, and in line with our internal Data Retention Policy. Data collected via website forms (e.g., general inquiries) will be kept only as long as needed to address your inquiry. If you ask us to call you back about mentoring, we keep your details for up to 60 days and then delete them, unless you go on to become a mentor. Messages sent with our Contact us form are kept in our team’s inboxes only as long as we need them to deal with your enquiry. Meal, allergy and other needs you tell us for an event are deleted 30 days after the event. Job applications are deleted 180 days after the job’s closing date, unless a legal or safeguarding hold applies (see Job applicants). Data related to mentor applications, will be retained according to our Data Retention Policy, details of which are provided in the MCR Pathways Volunteer Mentor Privacy Notice. Anonymous website usage data may be retained for longer for analytical purposes.

Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please email privacy@mcrpathways.org:

• The Right to Be Informed: To receive clear, transparent, and easily understandable information about how we use your data.
• The Right of Access (Subject Access Request – SAR): To request a copy of the personal data we hold about you. We will respond within 30 days of receipt.
• The Right to Rectification: To request that inaccurate or incomplete personal data we hold about you be corrected.
• The Right to Erasure (“Right to be Forgotten”): To request the deletion or removal of your personal data where there is no compelling reason for its continued processing. Please note that certain data, particularly criminal conviction data required for safeguarding, may be exempt from immediate erasure due to legal obligations.
• The Right to Restrict Processing: To request the suspension of processing of your personal data in certain circumstances.
• The Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where technically feasible.
• The Right to Object: To object to the processing of your personal data based on legitimate interests (unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms) or for direct marketing purposes.
• Rights about Automated Decisions: Where a decision about you is made by automated means, such as our check of job applications for AI-generated writing, you can ask for a person to review it, give us your views and challenge the decision.
• The Right to Withdraw Consent: Where we rely on your consent for processing (e.g., for certain cookies or marketing emails), you have the right to withdraw that consent at any time.

Links to Other Websites

Our website may contain links to other websites of interest. Please note that we do not have any control over these external websites. Therefore, we cannot be responsible for the protection and privacy of any information you provide whilst visiting such sites, and such sites are not governed by this Privacy Notice. You should exercise caution and look at the privacy policy applicable to the website in question.

Complaints

If you have concerns about how MCR Pathways has processed your data or handled your requests regarding your data, please contact us in the first instance at privacy@mcrpathways.org. We aim to resolve all complaints promptly and fairly.

If you are not satisfied with our response or how we have handled your complaint, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority for upholding information rights. Their helpline number is 0303 123 1113, or you can visit their website at www.ico.org.uk.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or for legal or regulatory reasons. We encourage you to review this page periodically for any updates. The “Last Updated” date at the top of this notice will indicate when it was last revised.

Contacting Us

For any questions or concerns about this Website Privacy Notice or our data protection practices, please do not hesitate to contact us at:

privacy@mcrpathways.org