Reading this site sets no cookies, stores nothing on your device and identifies nobody. We count visits, in aggregate, with analytics that work without any of that. The only personal data we ever hold is an email address you have deliberately given us, and only if you ask for the email digest.
Who we are
henry.careers is operated by Captivated Ltd, a company registered in England and Wales, company number 15936109. Registered office: Electric Works C/O Captivated Ltd, 3 Concourse Way, Sheffield, United Kingdom, S1 2BJ.
Captivated Ltd is the data controller for this site and is registered with the Information Commissioner's Office, reference ZC010118. For anything on this page, write to [email protected].
If you only read the site
We set no cookies and use no local storage. There are no social widgets, no advertising pixels and no embedded fonts from anyone else's server. Search runs entirely in your browser. There is no Google Analytics here and never will be.
There is one third-party script, and it is the analytics we do use: Plausible. We need to know roughly how many people read the site — a jobs board that cannot say that cannot honestly sell anything to an employer — and Plausible is how we do it without following anyone around.
It records the page, where you arrived from, and your browser, operating system, device type and country. It does not set a cookie, use local storage, or create any identifier that persists across days or devices. Your IP address and user-agent are used to work out the country and the browser and are never stored. To count a visitor once rather than twice, Plausible hashes your IP and user-agent with a salt that is rotated and deleted every 24 hours, so there is nothing that can link today's visit to tomorrow's.
Plausible Analytics OÜ is an Estonian company and the data stays in the EU. That is worth noting beside the section below: it is the one processor here that is not US-incorporated, so it is the one where EU hosting really does put the data outside US jurisdiction. We have no way to identify you from any of it, and neither does Plausible.
The site is hosted on Cloudflare Pages, and like any web host Cloudflare processes the network request needed to serve a page — including your IP address — and keeps short-lived operational logs for security and abuse prevention. We do not have access to a per-visitor record, and we do not build one.
If you join the email digest
The digest is opt-in and is not an account. We ask for an email address and which list you want. There is no profile, no CV, no password and no login.
What is stored:
- · Your email address and the list you chose.
- · A consent record: what you did, when, the page you did it from, and your browser's user-agent string.
- · Your IP address only as a salted SHA-256 hash, never in the clear. It exists to make the consent record defensible and to limit abuse, and it cannot be read back as an address.
You confirm by clicking a link in an email before we send you anything (double opt-in), and that confirmation is what we rely on. The legal basis is your consent — UK GDPR Article 6(1)(a), and regulation 22 of PECR for the email itself. You can withdraw it at any time and it costs you one click.
We do not track opens or clicks. That is not a statement of intent: tracking is switched off at the point of sending, on every message, so there is no open pixel and no rewritten link. We therefore cannot tell you whether you read an email, and neither can we tell anyone else.
The sign-up form is protected by Cloudflare Turnstile, which checks that a submission is not automated. It loads only on the page carrying the form, and only when the digest is open.
Who else touches it
Three processors, all under a data processing agreement:
- · Cloudflare — hosting, and the database holding subscriptions. The database is created in Cloudflare's Western Europe region, so the data is resident in the EU/UK area. Encrypted at rest and in transit.
- · Mailgun (a Sinch company) — sending the emails, on its EU region, with recipient data and email content held in Frankfurt, Dublin and Amsterdam.
- · Plausible Analytics OÜ — aggregate visit counts, as described above. Estonian, EU-hosted, and it never receives your email address: it has nothing to do with the digest.
Worth being straight about the limit of that. Cloudflare and Mailgun are US-incorporated, so EU hosting gives residency, not immunity from US jurisdiction — the standard contractual clauses in each processor's agreement are what make the position lawful, not the location of the servers. We would rather say that plainly than imply a guarantee that hosting alone cannot give.
We do not sell your data, share it with recruiters or advertisers, or pass it to anyone else. Subscribing to one list never adds you to another.
How long we keep it
Until you unsubscribe or ask us to delete it. When you unsubscribe we keep a minimal suppression record so that a stale form cannot resubscribe you by accident — that record exists to honour your choice, not to contact you.
One technical detail, because it is true and most policies leave it out: the database keeps a point-in-time recovery window of roughly 30 days. An erased record can persist inside that window before it ages out. We cannot reach into it to delete you sooner, and nothing reads from it in normal operation.
Your rights
Under UK GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, and withdraw consent. We can do all of those — export and erasure are built in rather than manual — and we will respond within one month.
Email [email protected] from the address you subscribed with, or use the unsubscribe link in any email. If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office, though we would rather you told us first so we can fix it.
Job listings and applications
We do not accept applications, host CVs or collect candidate details. Every listing links out to the original advert, and everything you do there is between you and whoever posted it, under their privacy policy and not ours. Following one of our links tells us nothing — we do not use click trackers or redirect through our own server.
Job adverts are published by employers and recruiters. Where an advert names a person, that is their publication, not ours. Ask us to correct or remove a listing and we will.
Changes
If this policy changes in a way that affects what we collect or who processes it, the date at the top changes with it. This version is dated 28 September 2026.