Impact Academy Limited

Last updated: March 2026

1. Who we are

Impact Academy Limited ("Impact Academy", "we", "us", or "our") is a company limited by guarantee registered in England and Wales. Our registered address is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can contact us at info@impactacademy.org.

We are the data controller for the personal data described in this policy. This means we decide how and why your personal data is processed.

2. What we do

Impact Academy is a talent accelerator that identifies and supports experienced professionals transitioning into roles at AI safety organisations. Our activities include sourcing candidates from publicly available data, conducting outreach, providing career transition support, and connecting candidates with hiring partners.

This policy explains how we handle personal data across all of these activities.

3. What personal data we collect

3.1 Data we collect directly from you

When you apply to our programme, contact us, or engage with us as a candidate, we may collect:

• Name, email address, and phone number

• CV or resume, and details of your professional experience and accomplishments

• Career preferences and interests

• Logistical details such as work authorisation status and location

• Any other information you choose to share with us

3.2 Data we collect from publicly available sources

As part of our talent sourcing activities, we compile professional profiles from publicly available sources. These include academic publications (e.g. ArXiv, OpenReview), coding platforms (e.g. GitHub, Kaggle), professional networks (e.g. LinkedIn), conference proceedings, university and research lab websites, and similar public sources.

For each profile, we may collect and store information such as name, professional title, institutional affiliation, publication history, technical skills, educational background, and publicly listed contact information. We enrich these profiles with additional publicly available data points to assess potential fit for AI safety roles.

Important: We do not collect sensitive personal data (such as health data, political opinions, or religious beliefs) as part of this sourcing activity. We only process data that individuals or institutions have made publicly available.

3.3 Data we receive from others

We may receive personal data about you from referrals by colleagues or contacts, from partner organisations we work with, or from other professionals in the AI safety ecosystem. We will always inform you when we begin actively engaging with you as a candidate.

3.4 Website data

Our website (impactacademy.org) does not currently use cookies or analytics tracking. If this changes, we will update this policy and implement appropriate consent mechanisms.

4. Why we process your data and our legal basis

4.1 Candidates who engage with us directly

When you apply to our programme or otherwise engage with us as a candidate, we process your data to provide you with career transition support, match you with suitable roles at partner organisations, and manage our relationship with you.

• Legal basis: Legitimate interest — it is in both your interest and ours to provide effective career transition support and talent matching.

• Where we share your data with partner organisations: We only do so with your consent.

4.2 Talent sourcing from public data

We compile and analyse publicly available professional data to identify individuals who may be well suited for careers in AI safety. This allows us to conduct targeted, personalised outreach to professionals who might not otherwise discover opportunities in this field.

• Legal basis: Legitimate interest — our mission is to address talent bottlenecks in AI safety, and identifying potential candidates from public data is necessary to achieve this goal. We have conducted a balancing assessment and concluded that this processing does not override your rights, given that we only use publicly available professional data and provide an easy way to opt out.

4.3 AI-assisted processing

We use AI tools (including large language models) to help analyse, categorise, and enrich candidate data for the purpose of identifying potential fits for roles. These tools assist our team but do not make autonomous decisions about candidates. All consequential decisions (such as whether to recommend a candidate to a partner) involve human review.

• Legal basis: Legitimate interest — AI-assisted processing is necessary for us to operate at scale while maintaining quality.

4.4 Communications

If you have signed up for our newsletter or communications, we process your contact details to send you relevant updates.

• Legal basis: Consent — you can unsubscribe at any time.

4.5 Job applicants

If you apply for a role at Impact Academy, we process your application data to assess your suitability and manage the recruitment process.

• Legal basis: Legitimate interest — necessary to evaluate candidates for employment.

4.6 Legal obligations

We may process personal data where necessary to comply with legal or regulatory obligations, such as financial reporting or responding to lawful requests from authorities.

• Legal basis: Legal obligation.

5. Who we share your data with

We may share your personal data with:

• Partner organisations (e.g. AI safety organisations with open roles) — only with your consent, and only information relevant to the specific role or opportunity.

• Service providers who help us operate, including our CRM/database platform (Airtable), AI processing tools (Anthropic), and other operational tools. These providers act as data processors on our behalf under appropriate contractual terms.

• Professional advisors (e.g. accountants, legal counsel) where necessary.

• Authorities where required by law.

We do not sell personal data to anyone.

6. International data transfers

Some of our service providers (such as Airtable and Anthropic) are based in the United States. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as the provider's participation in recognised data protection frameworks, standard contractual clauses, or an adequacy decision by the UK government.

7. How long we keep your data

We retain personal data for as long as necessary to fulfil the purposes described in this policy. In general:

• Data of candidates we are actively supporting is kept for the duration of our engagement and for up to 2 years after, unless you ask us to delete it sooner.

• Sourced profiles from public data are retained for as long as they remain relevant to our mission. You can request deletion at any time (see section 8).

• Job applicant data is retained for up to 1 year after the recruitment process concludes.

• Financial and legal records are kept as required by law (typically 6–7 years).

8. Your rights

Under UK data protection law, you have the right to:

• Access your personal data and obtain a copy of it.

• Rectify inaccurate or incomplete data.

• Erase your data in certain circumstances (e.g. if it is no longer needed, or you withdraw consent).

• Restrict processing in certain circumstances.

• Object to processing based on legitimate interest. If you object, we will stop processing your data unless we have compelling grounds to continue.

• Data portability — receive your data in a structured, commonly used format.

• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at info@impactacademy.org. We will respond within one month.

If you were identified through our public data sourcing and do not wish to be contacted or have your data in our database, simply let us know and we will remove your data promptly.

9. Opting out of our talent database

If we have contacted you based on publicly sourced data and you are not interested, you can:

• Reply to our message and ask us to remove your data, or

• Email info@impactacademy.org with the subject line "Remove my data".

We will delete your profile from our database within 30 days and add your details to a suppression list to ensure we do not contact you again.

10. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These measures include access controls, encryption in transit, and limiting data access to authorised team members on a need-to-know basis.

No system is completely secure. If you believe your data has been compromised, please contact us immediately.

11. Links to other websites

Our website may contain links to external websites. This privacy policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to read the privacy policies of any websites you visit.

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. If we make significant changes that affect your rights, we will take reasonable steps to inform you.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@impactacademy.org so we can try to resolve your concern.

You also have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO) Website: ico.org.uk Phone: 0303 123 1113