Privacy Notice | Pekanga Advisor

This notice applies specifically to Pekanga Advisor (advisor.pekanga.co.uk), used by independent careers advisors to manage their own clients. It sits alongside, and does not replace, Pekanga's main Privacy Notice, which covers the school platform and our website. Where the two differ, this notice governs Advisor.

Who is the controller of your clients' data

When you use Pekanga Advisor with your own clients, you are the data controller for your clients' personal data. You decide what to collect, how to use it, and how long to keep it. Pekanga Ltd acts as your data processor: we process your clients' data only to provide the Advisor platform to you, and only on your instructions.

This is different from the school platform, where the school is the controller. In Advisor, that role is yours.

What Advisor processes on your behalf

Depending on how you use the platform, Advisor may process:

Client details you enter, such as a name, email address or identifier and, if you import a cohort list, year group and tutor group
Appointment notes you write or dictate
Live session audio, transcribed in real time during a recorded appointment (consent-gated, see section 4)
RIASEC assessment and Discovery mode results
AI-generated action plans and report content
CV content: a CV your client has provided, or details you enter to draft a new one

You control what you enter. Pekanga does not ask your clients for this information directly; it is your relationship with your client that determines what is collected.

AI and automated processing

Advisor uses Claude, Anthropic's AI model, to generate structured content from what you enter: session summaries, action plans, career report content, and CV drafts or improvements. This is a functional process, generating a document to help you and your client, not a profile or automated decision about your client as a person.

Anthropic does not use API content to train its models, and keeps inputs and outputs only for a limited period before they are automatically deleted. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum. We send only what is needed to generate the output, and avoid sending persistent client identifiers where technically practicable.

A CV naturally contains more personal detail than a subject-choice input: work history, education, sometimes referee names or addresses. If you or your client would rather personal details like referee contact information were left out of an AI-drafted CV, you can simply omit them when entering details, they are not required fields.

Live session recording uses Speechmatics for real-time transcription. This is unchanged by the CV feature and remains covered by the existing consent flow shown before any recording starts.

Consent

Before recording a live session, both you and your client must confirm consent through the in-app consent flow. This is unchanged by anything in this notice.

For the CV builder specifically, there is no separate recording involved. Entering or uploading CV content is treated as part of your normal client-record-keeping under your existing advisor-client relationship, in the same way appointment notes already are. We recommend telling your client that you use an AI tool to help draft or improve CVs, in whatever way you'd naturally explain your working methods to a client.

Sub-processors

The following sub-processors are used to deliver Advisor. All process only what is necessary to provide the relevant feature.

Supabase (EEA): database, authentication and Edge Function processing for all Advisor data. This is where your client data is stored
Anthropic (USA): AI content generation (session summaries, action plans, report content, CV drafting and review)
OpenAI (USA): speech-to-text for dictation in the client chat and appointment notes. Audio is sent for that single request and Pekanga does not keep it. According to OpenAI's published API data controls, the audio transcription service is not subject to abuse-monitoring retention and does not store the audio or the transcript as application data. Data sent to the OpenAI API is not used to train its models. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum
Speechmatics (EU): real-time speech-to-text transcription for live session recording. Audio streams directly to Speechmatics' EU endpoint and is not recorded or stored by us or by Speechmatics. The transcript is returned to the platform and saved in your notes for that client. Model training on customer data is disabled on our account
Stripe: subscription billing and payment processing. Does not receive client data
Resend (USA): transactional email, for example sending a report to your client or a password reset. Emails are sent from Ireland, but Resend holds its account data in the USA. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum
Vercel (USA): hosting of the Advisor web application. Its serverless functions run in the USA. When you create a PDF of a report, the report content passes through one of them to build the PDF. We do not store it there

We give at least 30 days' notice before adding or replacing a sub-processor, as set out in the Advisor Data Processing Agreement.

Data retention

Client records, notes, transcripts and CV drafts are retained for as long as your Advisor subscription is active, or until you delete them. If your subscription ends, you have 60 days to ask for your data to be returned or deleted, and we complete the request within 30 days. If we hear nothing within the 60 days, we delete or anonymise it. Copies taken for maintenance are deleted once they are no longer needed. We may keep information that has been genuinely anonymised, so that no individual can be identified, for statistics and to improve the service. You can request deletion of specific client records at any time.

Your responsibilities as controller

Because you are the controller for your clients' data, you are responsible for:

Having a lawful basis to process your clients' personal data
Telling your clients how their data is used, in a way appropriate to your practice
Responding to any request from a client to access, correct, or delete their data (Pekanga will support you in fulfilling this, on request)
Deciding what personal detail is appropriate to include in any AI-assisted document, including CVs

Your rights and ours to you

As the Advisor account holder, you can ask us at any time to export or delete the data associated with your account. Email hello@pekanga.co.uk and we will action it within 5 working days.

Contact

Questions about this notice, or about how Advisor processes data: hello@pekanga.co.uk.

Pekanga Ltd, registered in England and Wales, company number 17216579. ICO registration ZC172552.

This notice is a good-faith attempt to set out how Pekanga Advisor handles data, written to sit alongside Pekanga's existing school-facing Privacy Notice and DPA. It should be reviewed by a qualified data protection solicitor before relying on it for a commercial contract or larger customer. This document does not constitute legal advice. Version 2.0, October 2026.