Privacy policy

The controller of the personal data described here is Play&Work Ltd, trading as Flair.Place, a company registered in England and Wales under company number 16322543, with its registered office at 86–90 Paul Street, London EC2A 4NE, United Kingdom.

For anything in this policy — including asking us to remove something about you, whether it is a listing you appear on, a role you submitted, or a newsletter sign-up — write to info@flair.place. You do not need to explain why, and we will not ask.

Because the roles themselves come from the hiring companies, anything you want changed about a job itself is usually theirs to change. We can always remove our copy of it.

There is no account to create and nothing to log in to. Analytics is anonymous and sets nothing on your device — see the cookies policy. We do not run advertising.

Roles you save and your light/dark preference are stored by your browser on your own device. They are never transmitted to us, and we cannot read them.

Our hosting provider keeps standard server logs — typically the IP address, the time, the page requested, and the browser’s user-agent string — which exist to keep the service running and secure. Fonts are served from our own domain, so loading a page makes no request to Google or any other font host.

The IP address used for rate-limiting is held in memory only, for one hour, and is not written to the database or linked to your submission.

To keep fraudulent and malicious submissions off the site, we:

• •inspect submitted files for macros, embedded scripts, and other structural signs of malware, and check that the file is really the type it claims to be;
• •send submitted links to Google Safe Browsing to check them against known malware and phishing lists — only the URL is sent;
• •send a cryptographic hash of an attached file to VirusTotal to see whether that exact file is already known to be malicious — the file itself is never uploaded;
• •pass the text of the posting to an AI model to flag common recruitment-fraud patterns.

None of these produce an automated decision about you. Every submission is reviewed by a person, who decides whether it is published.

Some listings show up to three people who work at the hiring company, so a candidate can see who they would be working alongside. For each we may show a name, a job title, a photograph, and links to public professional profiles such as LinkedIn or X.

Where this comes from

Either the person who submitted the role gave it to us — they are required to have your agreement before doing so — or we found it ourselves in publicly available sources such as your public professional profile, your employer’s own website, or press coverage. We are telling you this because, where we collected it without asking you first, data protection law requires us to.

Why we consider this lawful

We rely on legitimate interests: publishing a useful, honest picture of a team is part of what makes an edited job board worth reading, and the information involved is limited to professional details you have already made public in a professional context. We weigh that against your interests as follows — we publish nothing beyond name, role, photo, and public profile links; we never publish personal contact details, home location, or anything about your private life; a person reviews every entry before it goes live rather than publishing automatically; we do not profile you, score you, market to you, or sell the data; and we remove you immediately on request.

You can object to this at any time under Article 21 of the UK/EU GDPR, and we will stop — that is what the removal route above is for.

We do not sell personal data and we do not share it for anyone else’s marketing. The following providers process it on our behalf, or receive limited data as described:

We may also disclose data where the law requires it, or to establish or defend legal claims.

Several of these providers are in the United States. Those transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or under the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it.

Uploaded documents are stored outside the public web root and are never reachable by URL. They can only be retrieved by an authenticated administrator, and a file our scan considers dangerous cannot be downloaded at all. Administrator access is password protected and session-based.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the supervisory authority and, where required, you.

If the UK or EU GDPR applies to you, you have the right to ask us for a copy of your data; to have it corrected; to have it erased; to restrict how we use it; to object to processing based on legitimate interests, including everything described in section 5; and to receive data you gave us in a portable format.

Email info@flair.place and we will respond within one month. There is no charge.

If you are unhappy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk, or to the supervisory authority where you live.

Flair Place is for people looking for professional roles and is not directed at children. We do not knowingly collect data from anyone under 16.

We will update this policy as the site changes. The date at the top shows when it last did. If a change materially affects how we use data we already hold, we will take reasonable steps to tell the people affected.