Prospectus Plus is built to help institutions deliver a modern and personalised recruitment experience, while staying aligned with regional and international data privacy standards. From secure data storage to optional integrations, we take a privacy-by-design approach at every step.

At Prospectus Plus, we take data protection and privacy very seriously. Whether you’re a Data Protection Officer, an IT lead, or simply doing your due diligence, here’s an overview of what you need to know about how we handle personal data and maintain compliance with key data laws.

If you have any questions about compliance, security, or custom configurations, our team would be happy to assist or liaise directly with your DPO.

Privacy by Design

Prospectus Plus is built with a privacy by design philosophy, ensuring that user data is protected from the ground up. Our platform complies with key privacy regulations, including:

General Data Protection Regulation (GDPR) – Applicable to users in the European Union.
California Consumer Privacy Act (CCPA) – Applicable to users in California.

We employ robust security measures to protect your data:

Encryption: All data is encrypted in transit and at rest using modern encryption standards (e.g. HTTPS, TLS 1.2+).
Access control: Access is strictly limited to authorised SMILE team members on a need-to-know basis. Single Sign-On (SSO) and 2FA are options that can be configured for your administrative back end. The public-facing app (front-end) relies exclusively on the use of one-time passwords.
Resilience: Regular backups are taken and stored securely to support business continuity and disaster recovery.

Why are these measures important?

Regulatory Compliance: By adhering to GDPR and CCPA, we ensure that users’ data is handled ethically and transparently, mitigating risks for both our users and their organisations.
Enhanced Security: Features like SSL/TLS encryption and two-factor authentication significantly reduce the likelihood of data breaches.
User Trust: Strong security practices foster trust and confidence among users, enabling a better overall experience.

Data Capture

By default, Prospectus Plus collects only the minimum data required to deliver a tailored experience—usually just a name and email address.

However, depending on how your institution configures the platform, additional data may be captured through optional features or integrations. This may include:

Subject or course preferences
Device/browser data (for analytics)
Lead source or referral information

Important: When using optional features that collect additional data, the responsibility for ensuring lawful data capture and use lies with the institution configuring the platform.

Geographic Compliance

All data collected through Prospectus Plus can be securely stored on cloud infrastructure hosted in the UK, EU, US, and Canada. Depending on your geographic and regional data laws, we will choose the most appropriate location to store your data. This flexibility allows us to support international clients while maintaining strong compliance controls.

Our hosting partners comply with ISO/IEC 27001 standards, ensuring that data is managed in line with international best practices for information security.

Sub-processors

To provide core functionality, we work with a very small number of trusted sub-processors to deliver Prospectus Plus.

In some cases, additional subprocessors may be introduced when using optional integrations or custom features.

We maintain a clear and transparent record of all subprocessors here.

Compliance Support

We’re here to help you meet your internal compliance and IT review processes. Upon request, we can provide:

GDPR/Data Protection Agreement (DPA)
Subprocessor list
Technical documentation for security reviews
Cyber Essentials Certification Evidence

Cyber Essentials is a UK government-backed scheme that helps protect organisations against a wide range of the most common cyber threats. Certification provides additional assurance that we’ve implemented essential technical controls to safeguard data and infrastructure.

Frequently Asked Questions

How does Prospectus Plus handle my data under GDPR and CCPA?
We comply with GDPR and CCPA by ensuring that personal data is collected, processed, and stored securely and transparently. Users can request to view, update, or delete their data as required by these regulations.

What happens if someone tries to access my account?
With SSO, two-factor authentication, and OTPs in place, unauthorised access attempts are significantly minimised. Alerts and protections are triggered for suspicious activity.

Is my data encrypted at all times?
Yes, data is encrypted during transmission using SSL/TLS protocols to prevent interception.