This Privacy Policy ("Policy") is the statement of the privacy practices of Golding Education Ltd, a company incorporated and registered in England and Wales under Company Registration Number 16396444 (trading as "RelishED," "the Company," "we," "us," or "our"). The Company is the data controller for personal data processed through the RelishED platform at relished.org, its subdomains, application programming interfaces, and related services (the "Platform"). The Company is registered with the Information Commissioner's Office ("ICO") under Registration Number 00013805394.
All requests relating to personal data or this Policy should be directed to privacy@relished.org. The Company will respond to legitimate data-subject requests within thirty (30) calendar days, subject to verification of identity where reasonably required.
The Platform is for professional educators, education professionals, and adults seeking their Services, who are at least eighteen (18) years of age. By using the Platform you represent that you are at least eighteen (18) years old. The Company does not knowingly collect personal data from anyone under eighteen (18).
This Policy is prepared in accordance with the United Kingdom General Data Protection Regulation as retained in UK law ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, applicable ICO guidance, and the terms governing the third-party sign-in and payment services described below. It applies to all personal data the Company processes in connection with the Platform.
The Company processes personal data on the lawful bases set out in Article 6 of the UK GDPR: performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); the legitimate interests of the Company or a third party where not overridden by your rights (Article 6(1)(f)); and, where applicable, your consent (Article 6(1)(a)).
ACCOUNT AND AUTHENTICATION DATA. When you create an account we process your electronic mail address (your primary identifier, used for authentication, notifications, and transactional correspondence), your name, a secure session credential stored as a browser cookie, a security token to protect against cross-site request forgery, and any short-lived one-time code or sign-in link sent by electronic mail (stored briefly and deleted on use or expiry). Processed on the basis of contract and, for security tokens, legitimate interests in security.
SIGN-IN PROVIDER DATA. Where you choose to sign in using Google, LinkedIn, or Apple, we receive from that provider your email address, display name, and (for Google and LinkedIn) a reference to your profile photograph. Where you use Sign in with Apple's private relay, we receive an Apple-assigned relay address. We use this data only to create and authenticate your account and to display your name and image on the Platform. We do not receive your contacts, connections, or posts, and do not use sign-in data for advertising. You may revoke our access at any time through the relevant provider's account settings; revocation does not delete your RelishED account. Any biometric authentication (such as Face ID, Touch ID, or a passkey) is performed entirely on your device and is never transmitted to or processed by the Company.
PROFESSIONAL PROFILE DATA. We process the profile information you provide, including professional and educational history, the institutions you reference, job titles, subjects, qualifications, a biography and headline, professional contributions, and a profile photograph. Uploaded images undergo technical validation and metadata removal (including any embedded location data) before storage. Processed on the basis of contract and legitimate interests in operating a professional directory.
CAREER PREFERENCES AND ROLE-MATCHING DATA. Where you choose, you may tell us your career preferences, including the roles, subjects, and locations you are interested in and your availability (such as your notice period, current contract status, and willingness to relocate). We use this information to identify and bring to your attention roles that may suit you. This information is PRIVATE: we do not publish it on your public profile, and we do not display any public "open to work" or job-seeking indicator. Your interest in new roles is a private signal to us, not a public status. Where you additionally opt in to being approached about roles, we may make relevant information from your Record available to schools, employers, and recruiters seeking to fill specific roles so that they can contact you privately about an opportunity. We do this on the basis of your consent, which you may withdraw at any time in your settings; withdrawal stops all further sharing. Matching roles to you is processed on the basis of our legitimate interests in operating a role-matching service; sharing your details so that an employer may approach you is processed on the basis of your consent.
MARKETPLACE AND BOOKING DATA. When you list, book, deliver, or receive a Service, we process the details of the Listing and Booking, including the parties, the Service, the price, scheduling information, the status of the engagement, and related messages, on the basis of contract.
PAYMENT DATA (STRIPE). Payments are processed by Stripe, Inc. and its affiliates ("Stripe"). When you pay for or receive payment for a Service, the relevant payment, identity-verification ("know your customer"), and payout information is collected and processed by Stripe in accordance with Stripe's own privacy policy, available at stripe.com/privacy. The Company does not collect or store full payment card numbers. The Company receives from Stripe limited transaction and status information (such as confirmation of payment, payout status, the last four digits of a card, and amounts) necessary to operate the marketplace, account to Pros, calculate fees, and meet legal obligations. For a Pro who connects a Stripe account, Stripe acts as an independent controller of the identity and financial information it collects to provide its regulated payment services. Processed on the basis of contract and compliance with legal obligations (including anti-money-laundering and tax obligations).
REVIEWS, TESTIMONIALS, AND COMMUNITY DATA. Where you submit or are the subject of a review, testimonial, or professional endorsement, we process the content of that submission, the identifiers of the parties, and timestamps, on the basis of legitimate interests in professional credibility and trust. Such content may be displayed publicly on the relevant profile. You may request removal of content concerning you by contacting privacy@relished.org.
DIRECT MESSAGE DATA. The Platform provides private messaging. Message content is encrypted at rest, such that the Company does not read message content in the ordinary course of its operations. The Company processes unencrypted message metadata (sender, recipient, conversation identifier, type, timestamp, and read status) on the basis of contract. The fact and timing of communication are visible to the Company as metadata.
USAGE AND SECURITY DATA. We process IP addresses, timestamps, and request identifiers for security monitoring, abuse prevention, and rate limiting, on the basis of legitimate interests. Such data is retained for a maximum of ninety (90) days.
The Platform may rank and suggest Pros, Services, and content using information from your profile and activity. This does not produce legal or similarly significant effects and is used only to make content more relevant. We do not use automated processing to make hiring, creditworthiness, or other consequential decisions. You may object to such processing by contacting privacy@relished.org.
The Company discloses personal data to the following categories of recipient, each bound by appropriate contractual data-protection commitments and each processing data only as necessary for the stated purpose:
STRIPE. Stripe provides payment processing, payout, and identity-verification services for the marketplace, as described in Section 3, and processes the associated payment and verification data under its own terms and privacy policy.
SIGN-IN PROVIDERS. Google LLC, LinkedIn (LinkedIn Ireland Unlimited Company / LinkedIn Corporation), and Apple Inc. provide the authentication services you choose to use, as described in Section 3.
INFRASTRUCTURE PROVIDERS. The Company uses reputable third-party cloud hosting, storage, content-delivery, electronic-mail-delivery, and security providers to operate the Platform. These providers process personal data only on the Company's instructions and under contractual data-protection terms, and are located in the United Kingdom and the United States, with transfers safeguarded as described in Section 6. The Company does not disclose the specific identity of its infrastructure providers in this Policy for security reasons; the categories of recipient and the safeguards applied are as stated here, and further detail is available to a competent authority or data subject on a legitimate request to privacy@relished.org.
SCHOOLS, EMPLOYERS, AND RECRUITERS. Where, and only where, you have opted in to being approached about roles, the Company may make relevant information from your Record available to schools, employers, and recruiters seeking to fill specific roles, so that they may contact you privately. This is done on the basis of your consent and never includes payment card or financial data. Such recipients act as independent controllers of the personal data they receive and are responsible for their own compliance with data-protection law. If you have not opted in, your details are not shared for this purpose, and you may withdraw at any time in your settings.
The Company does not sell your personal data to advertisers or data brokers, does not disclose personal data to third parties for their own advertising or targeted-marketing purposes, and shows no third-party advertising on the Platform. The Company may disclose personal data where required by law, court order, or regulatory authority, or to establish, exercise, or defend legal claims. The two limited exceptions described immediately below. Business transfers and aggregated or de-identified data. Do not involve selling your identifiable personal data to advertisers.
BUSINESS TRANSFERS. RelishED and the Platform, together with their associated data, are assets of the Company. If the Company is involved in, or evaluates, a merger, acquisition, investment, financing, corporate reorganisation, change of control, insolvency, or a sale or transfer of all or part of its business or assets, personal data held by the Company may be disclosed to, reviewed by, and transferred to the parties to that transaction, their professional advisers, and any successor or acquiring entity, and may continue to be processed by that entity for the purposes described in this Policy. The Company will require any such recipient to be bound by this Policy or by a successor privacy policy that provides materially equivalent protection, and, where the controller of your personal data changes, you will be notified as required by applicable law.
AGGREGATED AND DE-IDENTIFIED DATA. The Company may create aggregated, statistical, anonymised, or de-identified data derived from personal data, in a form that does not identify you and cannot reasonably be used to identify you. Such data is not personal data under data-protection law, and the Company may retain, use, license, and share it for any lawful purpose. Including operating, improving, developing, and promoting the Platform and the Company's current and future products and services, research, benchmarking, and the production of sector and market insights and reports. The Company does not attempt to re-identify de-identified data except to verify that its de-identification methods remain effective.
Some personal data is transferred to and processed in the United States by the Company's payment, sign-in, and infrastructure providers. Such transfers are made under appropriate safeguards, including (as applicable) the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, or other safeguards recognised under UK GDPR. You may request information about the safeguards applied by contacting privacy@relished.org.
The Company retains personal data only as long as necessary for the purposes for which it was collected and as required by law. Account, profile, and marketplace data are retained for the life of the account and deleted within thirty (30) days of account deletion. Records of completed transactions, invoices, and related financial and tax records are retained for the period required by applicable law (which may exceed the life of the account). Message content is retained for the life of the conversation or until deleted; message metadata is retained for up to ninety (90) days after deletion. Security logs are retained for up to ninety (90) days. Where a legal obligation requires longer retention, data is retained for the mandated period notwithstanding a deletion request.
Under UK GDPR you have the rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent. To exercise any right, contact privacy@relished.org with enough information to identify your account; we may request verification of identity and will respond within thirty (30) days (extendable by up to sixty (60) days for complex requests, with notice). For matters handled by Stripe as an independent controller (such as payment-identity data), you may also exercise rights directly with Stripe. If you are dissatisfied with our response you may complain to the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
The Platform uses strictly necessary cookies only: a session cookie to maintain your signed-in state and a security cookie to protect against cross-site request forgery. These are used solely to operate the Platform securely and not for advertising, tracking, or cross-site analytics. Strictly necessary cookies cannot be disabled without ceasing to use the Platform.
The Company implements appropriate technical and organisational measures to protect personal data, including encryption of data in transit and of sensitive data at rest, removal of metadata from uploaded files, validation of uploads, restricted access to production systems, and protections against common web vulnerabilities. No method of transmission or storage is completely secure; the Company cannot guarantee absolute security. In the event of a personal-data breach likely to result in a risk to your rights and freedoms, the Company will notify the ICO within seventy-two (72) hours of becoming aware and will notify affected users as required by law.
The Platform is for adults aged eighteen (18) or over. The Company does not knowingly collect data from anyone under eighteen (18) and will delete any such data promptly upon becoming aware of it. Contact privacy@relished.org if you believe a minor's data has been collected.
Users may publish Content containing personal data of third parties (such as colleagues). You are solely responsible for ensuring a lawful basis exists for any third-party personal data you publish. The Company is not responsible for the accuracy or lawfulness of User-generated Content.
The Company may amend this Policy to reflect changes in law or practice. Material changes will be notified to users by electronic mail before taking effect. The current Policy is always available at relished.org/privacy. Continued use of the Platform after notification constitutes acceptance of the amended Policy.
Golding Education Ltd (trading as RelishED)
Data Protection Contact
Electronic mail: privacy@relished.org
Company Registration No. 16396444 (England and Wales)
ICO Registration No. 00013805394
RelishED | Golding Education Ltd | Company No. 16396444 (England and Wales) | ICO Reg. 00013805394 | © 2026 Golding Education Ltd. All rights reserved.