Privacy Policy

Last updated: 10 May 2026

1. Introduction

This Privacy Policy explains how The ROSE Network ("we", "us", "our"), operated as a function of the Intelligence Corps Association (ICA), Registered Charity No. 1175211, collects, uses, stores, and protects your personal data when you use our website at www.therosenetwork.co.uk.

It also acts as our public-facing data-handling statement: it identifies every third-party processor we use, where each item of personal data is physically stored, the operational-security ("OPSEC") undertaking that members give on signing in, and the levels of data each type of user can see.

Data is shared with us voluntarily. At every stage — registration, mentor application, business listing, opportunity submission, RSVP, contact form — you choose what to share, and we ask for no more than is necessary. In almost all cases this is information you have already published elsewhere or would readily share in a professional networking context (your name, employer, professional summary, business details, a link to a public role or tender). You are in control of what you submit, and you can amend or withdraw it at any time using the rights in section 10.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

The data controller for personal data collected through this website is:

3. What Data We Collect

We may collect the following categories of personal data:

3.1 Data you provide directly

• Contact form submissions: Name, email address, and any information you include in your message when using our contact form.
• Opportunity submissions: Submitter name and email, together with role title, organisation, location, salary, summary, link, and application deadline when posting a job or public appointment via the Opportunities page.
• Event submissions: Submitter email, together with event title, organiser, description, date, location, venue, and link when posting an event via the Events page.
• Business directory listings: Business name, sector, description, website, LinkedIn URL, contact name and email of the listing owner.
• Contract and tender posts: Title, description, organisation, deadline, source URL, and contact details of the poster.
• Mentor applications: Name, email, UK mobile number, service background, civilian role, industry, location, mentoring areas, availability, optional photo, and any other details supplied when applying to mentor Service Leavers. Mentors may opt to apply anonymously: in that case they supply a public-safe display alias and a redacted bio for the directory, while their real name, photo, civilian role, industry, location, and LinkedIn URL remain visible only to administrators and are deliberately excluded from the HubSpot CRM sync.
• Member accounts (registration): First name, last name, email address, password (stored as a hash by Supabase Auth), UK mobile number, service status, ICA membership status, optional ICA membership number, and an explicit GDPR consent record.
• Member profile additions: Optional profile photo, ROSE Network role/position, and (for verified Service Leavers and Networkers) self-declared security clearance level, used internally to match opportunities and never shown publicly.
• OPSEC acknowledgement: When you first log in (and again whenever the notice is updated), we record your user ID, the version and full text of the notice you accepted, the timestamp, and the user-agent string of the browser used to accept it. See section 7 for the full text.
• Member interactions: If you save, hide, or contact-record a fellow member, opportunity, or business inside the member area, we store that link to support your dashboard and "view-as" admin tooling. These records are visible only to you and to administrators.
• Event attendance: When you RSVP to an event, we record the event, your member ID, RSVP status, and timestamp.
• Mentoring or registration enquiries: Name, email address, service status, and related details submitted via email.

3.2 Data collected automatically

• Google Analytics 4 data (via Google Tag Manager, container GTM-WS8WK4Q9): pages visited, time on site, referral source, browser, device, and approximate (country/city) geography. Only loaded if you accept analytics cookies; runs under Google Consent Mode v2 with ads-data redaction.
• HubSpot tracking data: page views, form interactions, and session data — only loaded after you accept analytics cookies. The HubSpot script is served from js-eu1.hs-scripts.com.
• Vercel Web Analytics: aggregated, cookieless pageview pings used to measure traffic to each page. No personal identifiers are stored; this runs under legitimate interest.
• Vercel hosting logs: standard request logs (IP, user-agent, URL, status code) kept by Vercel for the operational lifetime of the deployment for security and reliability purposes.
• Sentry error reports: JavaScript error message, stack trace, page URL, browser, approximate geography, and your IP address (used to associate related errors). Sent to Sentry's EU region. Sensitive form values are scrubbed by the Sentry SDK.

3.3 Data we do not collect

• We do not collect financial or payment information.
• We do not collect special category data (e.g. health, ethnicity, political opinions). Self-declared security-clearance level on a member profile is held strictly for opportunity-matching inside The ROSE Network; we do not record protectively-marked information.
• We do not knowingly collect data from children under 16.

4. How We Use Your Data

We use your personal data for the following purposes:

5. Tools We Use and Where Your Data Is Stored

We do not sell, rent, or trade your personal data. The following third-party processors handle your data on our behalf. Each is engaged under a written data-processing agreement and processes data only on documented instructions from us.

5.1 Public-sector data sources (incoming, not outgoing)

Job and contract listings are ingested from the public APIs below by scheduled Supabase Edge Functions. We do not send your personal data to these services; they are listed for transparency about where opportunities on the site originate:

• Adzuna and (where enabled) Reed — for the Opportunities feed.
• UK Contracts Finder and Find a Tender Service (FTS) — for the Contracts feed.
• HM Government Public Appointments portal — for the Appointments listings.

5.2 Internal recipients

• The Intelligence Corps Association — as the parent organisation and registered charity, ICA may receive data necessary to fulfil its charitable objectives.
• Approved fellow members — once approved you become visible inside the member area at the levels set out in section 8 below; this is the deliberate purpose of the network.
• Mentees (Service Leavers) — where you have applied as a mentor, we share relevant details from your mentor profile with Service Leavers seeking guidance. If you elect anonymous-mentor status, mentees see only your alias and redacted bio.
• Hermes Digital UK — designed, built, and operates the website pro bono on behalf of ICA. See section 5.3 below for full disclosure of this relationship.

Public-facing submissions (approved opportunities, events, business listings, tenders) are published on the website. Submitter contact details are held internally and are not published unless you expressly include them in the public content.

We will never share your data with commercial recruitment agencies or employment brokers. The ROSE Network does not act as a recruitment intermediary.

5.3 Who built and runs the platform — and why we are transparent about it

The ROSE Network website was designed, built, and is managed entirely pro bono by Hermes Digital UK on behalf of the Intelligence Corps Association. No money changes hands; the site sits on Hermes's existing digital infrastructure (Vercel hosting, Supabase database, monitoring and CRM tooling already in place) because doing so is the most efficient way to give the Corps Family a professional digital platform without diverting charitable funds.

This arrangement exists because the Chair of The ROSE Network, Stephen James, also chairs Hermes Digital UK and the independent organisation British Veteran Owned (BVO). We disclose this openly because:

• Neither Hermes Digital UK nor BVO has any commercial interest in The ROSE Network. They do not sell products or services to our members through this platform, do not receive referral, recruitment, or finder's fees from our work, and do not use ROSE Network member data for their own marketing or business development.
• BVO is a separate organisation, not part of The ROSE Network. We collaborate with BVO where it is in the interests of the Corps Family, but no member data is exchanged between the two organisations except where you have explicitly opted in.
• Engineers at Hermes Digital UK who maintain the infrastructure may, in the course of operating it, gain incidental knowledge of how the platform works. To prevent that knowledge or any member data from leaking between the organisations the Chair is involved in, we maintain a digital "Chinese wall" between systems as far as practicable: separate cloud accounts, separate authentication, separate environments, separate audit logs, and access on a strict need-to-know basis. The Hermes engineers operating the site do so in their capacity as data processors for ICA, not as employees of any other organisation Stephen chairs.

If you have any concern about this relationship or wish to ask further questions about how it is governed, please contact ica_hq@roseandlaurel.uk.

6. Where in Supabase Your Data Sits

For full transparency, the table below maps each item of personal data to the Supabase table or storage location that holds it. All items live in the project listed in section 5 (London, eu-west-2) and are protected by row-level security (RLS) so users can read only what their role permits.

7. OPSEC Acknowledgement on Login

Because The ROSE Network serves Regulars, Reserves, Veterans, and the wider Corps Family, the member area is governed by an active operational-security undertaking. You are required to read and tick this acknowledgement before you can enter the dashboard, and again whenever the wording is updated. The current text reads:

This member area is for the Corps Family and carefully selected trusted partners only. I will not post or share information that is personally sensitive, commercially sensitive, or operationally sensitive. I understand that even informal comments, introductions, or discussions may carry sensitivity when viewed in a wider context. I will not share member details, opportunities, contracts, or conversations beyond this trusted community without clear permission. I will maintain sound OPSEC at all times, particularly when discussing transition plans, employment matters, or commercially sensitive activity. If in doubt, I will treat information as restricted and seek guidance from The ROSE Network team before posting or sharing.

Each acknowledgement is stored in the public.member_security_acknowledgements table with the notice version, the verbatim text accepted, the timestamp of acceptance, and the user-agent of the browser used. The table is append-only — superseding a notice creates a new row rather than overwriting old ones — so historical evidence is preserved. You can request a copy of your own acknowledgement record at any time using your rights in section 9.

8. Levels of Access in the Member Area

The site is built around five access tiers, enforced both in the navigation and at the database layer through Supabase row-level security:

Within each tier, a user can always see and manage their own submissions in full; they can see other members' data only at the level above. Anonymous mentors' real names, photos, civilian roles and locations remain administrator-only and are excluded from the HubSpot CRM sync.

Discretionary access by the Chair. The Chair of The ROSE Network has discretion to grant ICA-member-equivalent access (the fourth tier above) to individuals who bring clear value to the Network even where they are not ICA members and not Service or ex-Service. To preserve an audit trail, the Chair will only do so where two existing members are willing to propose and second the candidate; the proposer, the seconder, the date, and the Chair's decision are recorded against the user's profile in Supabase. This route does not bypass the approval workflow, the OPSEC acknowledgement in section 7, or any of the other safeguards in this policy.

8.1 Visibility controls you have over what you submit

Across the network, submitters choose how visible their submissions are. The two controls below operate independently and can be combined:

• Submit anonymously. Mentor applicants can elect anonymous-mentor status as described in sections 3.1 and 5.2. When posting an opportunity or an event, you can equally leave your name out of the public copy of the listing — submitter contact fields are stored only for moderation and are not published unless you explicitly include them in the public description.
• Restrict to ICA members. Opportunities, events, and business listings carry a members-only flag. When set, the listing is visible only to authenticated ICA members and to administrators; anonymous visitors and non-ICA authenticated users do not see the row at all. This is enforced at the database layer by the row-level security policies referenced in section 8 and by the public.is_ica_member() check, not just in the page UI.

Combined, these controls allow an ICA member to post an opportunity or event that does not identify them publicly and that is shown only to other ICA members. Administrators retain access to the full record for moderation, abuse handling, and to allow follow-up where necessary.

9. Data Retention

• Contact form submissions: Retained for up to 24 months, then deleted unless there is an ongoing relationship.
• Opportunity and event submissions: Published listings are retained until their deadline or event date has passed, then archived for up to 12 months. Submitter contact details are retained for up to 24 months after publication. Rejected submissions are deleted within 3 months.
• Business directory and tender listings: Retained while the listing remains active. Removed within 3 months of a request from the listing owner, or when the business ceases to be active.
• Mentor applications: Retained for the duration of your involvement in the programme, plus 12 months after your last activity. Withdrawn applications are deleted within 3 months.
• Member accounts: Retained while your account remains active. Inactive accounts (no login for 24 months) may be deleted after written notice.
• Marketing communications preferences: Opt-out records are retained indefinitely to honour your preference.
• Analytics data: Retained according to Google Analytics and HubSpot default retention policies (typically 14–26 months).
• Cookie consent preferences: Stored locally in your browser (localStorage) and retained until you clear your browser data or change your preference.

10. Your Rights

You can fully delete your own account and the data we hold about you, and you can request an export of that data, in line with UK GDPR and the Data Protection Act 2018. You do not need a reason and there is no charge.

• Self-serve deletion. From your account area you can permanently delete your member account, your profile, your uploaded images, your saved interactions, and any opportunities, events, business listings, mentor application, or RSVPs you have submitted. The deletion cascades through Supabase and removes the corresponding records from the HubSpot CRM where they were synced. A small set of items must be kept for legal or audit reasons (e.g. opt-out records, OPSEC acknowledgements, and accounting records); these are listed in section 9.
• Data export. Email info@therosenetwork.co.uk and we will provide a structured, machine-readable copy of the personal data we hold about you, normally within one calendar month.

You also have the full set of rights granted by UK GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data where there is no compelling reason for its continued processing. The self-serve deletion above is the fastest route; you can also ask us to do it on your behalf.
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — request transfer of your data in a structured, commonly used format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, or for anything else relating to your data, contact us at info@therosenetwork.co.uk. We will respond within one calendar month. The data controller of record is the Intelligence Corps Association — see section 2 for the formal controller address.

To opt out of marketing communications from The ROSE Network (e.g. updates about events, opportunities, or initiatives), email info@therosenetwork.co.uk or click the unsubscribe link in any message we send. Opting out does not affect communications about an active submission or your member account.

11. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS / TLS encryption for all data transmitted to and from our website.
• Encryption at rest in Supabase (AES-256) for the primary database and the member-assets storage bucket.
• Row-level security (RLS) on every table holding personal data, with the access tiers in section 8 enforced inside the database itself rather than only in the front-end.
• Use of established, reputable third-party processors (Supabase, Vercel, HubSpot, Resend, Sentry, Google) with their own security certifications and written data-processing agreements.
• Restricted administrator access, multi-factor authentication on administrator accounts, and an append-only audit trail of OPSEC acknowledgements.

12. International Transfers

Some of our third-party processors (notably Google) may transfer data outside the UK. Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner's Office (ICO).

HubSpot processes data in the EU (eu1 region), which is covered by the UK adequacy decision.

13. Cookies

Our website uses cookies. For full details of the cookies we set, how they are used, and how to manage your preferences, please see our Cookie Policy.

14. Links to Other Websites

Our website contains links to external sites including the ICA main site, Veterans Gateway, SSAFA, the Royal British Legion, and COBSEO. We are not responsible for the privacy practices of these external sites and encourage you to read their privacy policies.

15. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

16. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated "Last updated" date. We encourage you to review this page periodically.