Privacy Policy

The Keeper Educational Exchange Programme (“KEEP”, “we”, “us”) runs an exchange programme for professional animal keepers and operates this website at keeperexchange.org.

KEEP is the data controller for the personal information described in this notice. That means we decide why it is held and what happens to it.

• Email: info@keeperexchange.org
• Registered address: KEEP, Cambridge, CB24

If you want to exercise any of the rights in section 10, or you are unhappy with something we have done with your information, write to that address and mark it for the attention of the data protection lead.

This notice covers the KEEP website and the accounts it holds: keeper accounts, collection accounts, and the placements, applications and messages that pass between them.

It does not cover what a host collection does with your information after you have been placed with them. Once a collection has your application, that collection is a controller in its own right and its own privacy notice applies. Section 6 sets out exactly what they can see and when.

Everyone who visits

• Pages requested, and the technical information any web server receives — your browser type, and an IP address used to deliver the page and to protect the site from abuse.
• Whether you accepted or declined analytics cookies (see section 9).

Keepers

• Name, email address, and the password you set (stored only as a cryptographic hash — we never see it).
• Your profile: headline, summary, location, years of experience, skills, LinkedIn address, and whether you are open to a placement.
• Your CV, as an uploaded file, and its original filename.
• The collection you say you work at, and whether that collection has confirmed it.
• Every application you make: the placement, the dates, your cover letter, the CV attached at the time, and the status it reaches.
• Messages you exchange with a collection through the site, and whether they have been read.
• Your notification settings, including whether you asked to hear about new placements.

Collections

• The account holder’s name and email address.
• The collection’s name, address, website, description and logo.
• Placements posted, including the description, dates and images.
• Team members invited, the email addresses they were invited at, their role, and which team they belong to.
• Decisions taken on applications, and who took them.

People we email or who contact us

• Anything you put in the contact form or an email to us, and our reply.
• Whether an email we sent failed, so we can tell that it did not arrive.

Almost all of it comes from you, when you register, complete your profile, post a placement or apply for one.

Two exceptions:

• If a collection invites you to join their team, we hold the email address they gave us until the invitation is accepted, declined or expires.
• KEEP has a historical record of exchanges that took place before this website existed. Where that record names a keeper, it is held on the same basis and with the same rights as everything else in this notice.

Under the UK GDPR we must have a lawful basis for each use. Ours are:

• To run your account and the exchange — creating your account, showing your application to the collection you applied to, carrying messages between you, and telling you what happened. Basis: performance of a contract with you.
• To keep the programme trustworthy — reviewing new keeper and collection registrations before they go live, moderating placements before they are published, and investigating misuse. Basis: our legitimate interests in a programme where a collection can trust who turns up and a keeper can trust where they are going.
• To warn you about clashing dates — checking a new application against placements you have already accepted. Basis: our legitimate interests, and yours, in not being double-booked.
• To send service emails — sign-in links, application updates, moderation decisions, invitations. Basis: performance of a contract with you.
• To send you news of new placements, where you have asked for it. Basis: your consent, which you can withdraw at any time in your notification settings.
• To measure how the site is used, where you have accepted analytics cookies. Basis: your consent.
• To meet our legal obligations, including responding to requests about your own data. Basis: legal obligation.

Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and you can object — see section 10.

This is the part most people actually want to know, so it is set out plainly.

Before you apply

Nothing about you is visible to a collection. Browsing placements does not tell anyone you looked.

When you apply to a placement

The collection that posted it — and only that collection — can see your name, your email address, your profile, your CV, your cover letter and the dates you asked for. Within that collection, access is limited to the people who have been given it: if the collection uses teams, a member scoped to one team cannot see applications to another team’s placements.

Between keepers

Keepers cannot see one another’s applications, messages, CVs or contact details. If you have confirmed that you work at a collection, your name may appear on that collection’s own page as one of its keepers.

KEEP administrators

A small number of KEEP administrators can see accounts, placements and applications in order to approve registrations, moderate listings and resolve problems. They can act on behalf of a collection where it is needed for support, and that is recorded.

We do not sell your information, and we do not share it for anyone else’s marketing. We use three suppliers, each acting on our instructions:

• Supabase — hosts the database, the sign-in system and the uploaded files. Everything in section 3 is stored there.
• Resend— sends our emails. It receives the recipient’s address and the content of the message.
• Google — provides analytics, which only loads if you accept it, and the map shown on a placement page. Opening a page with a map lets Google see that request.

We will also disclose information where the law requires it, or to establish or defend a legal claim.

Our suppliers are able to process data outside the UK. Where they do, the transfer is covered by the UK’s International Data Transfer Agreement or Addendum, or by adequacy regulations, so your information keeps essentially the same protection it has here. You can ask us for details of the safeguards in place.

• Your account and profile — while your account is open. Delete your account and we remove your profile, CV and applications.
• Applications and messages — with the account, so both sides keep a record of an exchange while it is live and afterwards.
• Invitations — until accepted, declined or expired, then removed.
• The historical record of exchanges — kept as a record of the programme, because a count of exchanges since 2018 is only true if the record behind it is intact.
• Email delivery failures — long enough to notice and fix a problem.

Where we no longer need to identify anyone, we may keep anonymous totals — how many exchanges took place in a year, for instance. Those cannot be traced back to you.

Some cookies are needed for the site to work at all; you cannot turn those off, and we do not need your permission for them:

• Your sign-in session, so you stay signed in between pages.
• Which collection you are currently acting for, if you belong to more than one.
• The preview code, while the site is not yet public.
• Your answer to the cookie banner, so we stop asking.

One is optional: Google Analytics, which tells us which pages are used and which are not. It does not load until you accept it, and declining costs you nothing on this site. Clear this site’s data in your browser to be asked again.

Under the UK GDPR you can ask us to:

• Give you a copy of the information we hold about you.
• Correct it if it is wrong — much of it you can correct yourself in your profile.
• Delete it. You can delete your account yourself; write to us if you would rather we did it.
• Restrict what we do with it while a dispute is resolved.
• Object to a use we base on legitimate interests.
• Port it — receive it in a machine-readable form, or have it sent elsewhere.
• Withdraw consent for anything we do on that basis, at any time. Withdrawing it does not undo what was done beforehand.

Write to info@keeperexchange.org. We answer within one month. There is no charge unless a request is excessive or repetitive.

If you are not satisfied with our answer you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

Traffic to the site is encrypted. Passwords are stored only as hashes. Access to each record is enforced by the database itself rather than by the page asking for it, so a keeper cannot reach another keeper’s application and a collection cannot reach another collection’s, even if a link were guessed.

No system is perfectly secure. If a breach ever puts your rights at risk we will tell the ICO within 72 hours and tell you without undue delay.

KEEP is for working animal-care professionals and the collections that employ them. The site is not intended for children, and we do not knowingly hold information about anyone under 18. If you believe we have, tell us and we will remove it.

When we change this notice we update the date at the top. If a change materially affects how we use your information we will tell account holders directly rather than relying on you to check.

See also our Terms & Conditions.