Data Processing Agreement
Version: 2026.1 · Effective Date: 14 September 2026
1. Background & Incorporation
This Data Processing Agreement (“DPA”) forms part of the Terms of Service (“Agreement”) between Sponsor Licence Ready AI (“Processor”) and the customer entity agreed to the Terms (“Controller”).
This DPA governs the processing of personal data by Processor on behalf of Controller in connection with the provision of the Sponsor Licence Ready AI compliance software platform, in compliance with Article 28 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
2. Roles & Scope of Processing
- Controller: The Customer determines the purposes and essential means of processing sponsored worker documents, right-to-work records, and compliance evidence.
- Processor: Sponsor Licence Ready AI processes such personal data solely on documented instructions from Controller to provide the services described in the Agreement.
3. Processor Obligations
Processor shall:
- Documented Instructions: Process personal data only on documented instructions from Controller, including with regard to transfers outside the UK, unless required to do so by applicable law.
- Confidentiality: Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Security (Article 32): Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Schedule 2 (TOMs).
- Sub-processors (Article 28(2)/(4)): Not engage another processor without prior specific or general written authorization of Controller, imposing equivalent data protection obligations on any sub-processor engaged.
- Assistance with Data Subject Rights (Chapter III): Taking into account the nature of the processing, assist Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to requests exercising data subject rights.
- Security Incident Notification: Notify Controller without undue delay (and in any event within 48 hours) upon becoming aware of a confirmed Personal Data Breach affecting Controller's data.
- DPIA & Regulatory Consultation (Articles 35 & 36): Assist Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the UK GDPR, taking into account the nature of processing and information available to Processor.
- Deletion or Return: At the choice of Controller, delete or return all personal data to Controller after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires storage of the personal data.
- Audit & Compliance Verification: Make available to Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28, and allow for and contribute to audits, including inspections, conducted by Controller or an independent auditor mandated by Controller (subject to reasonable advance notice, confidentiality agreements, and operational non-disruption).
4. Sub-processors
Controller hereby grants general written authorization to Processor to engage the sub-processors listed in the Sub-processors Register as of the effective date.
Processor shall inform Controller of any intended changes concerning the addition or replacement of other sub-processors at least thirty (30) days in advance via written notice or update to the platform register, thereby giving Controller the opportunity to object to such changes on reasonable data protection grounds.
5. International Data Transfers
Primary processing occurs within the UK and European Economic Area (Google Cloud region europe-west4). Any transfer of personal data to a third country not subject to an adequacy decision shall be governed by standard contractual clauses or the UK International Data Transfer Addendum.
Schedule 1: Processing Details
| Subject Matter: | Provision of digital compliance vault, right-to-work tracking, and Home Office sponsor duty assessment tools. |
| Duration: | For the duration of the commercial subscription plus post-expiry data preservation and retention cycles. |
| Categories of Data Subjects: | Sponsored workers, prospective sponsored workers, Authorising Officers, Level 1 Users, and Key Contacts employed by or affiliated with Customer. |
| Types of Personal Data: | Names, dates of birth, nationality, addresses, job titles, salary and SOC codes, Home Office share codes, right-to-work verification timestamps, passport/BRP numbers and copies, employment contracts, Certificates of Sponsorship, and attendance records. |
Schedule 2: Technical and Organisational Security Measures (TOMs)
Processor maintains the following verified operational safeguards:
Logical database isolation enforcing strict organization-scoped querying. Cross-tenant access is rejected at the API and database layers.
All web and API traffic is encrypted via TLS 1.3. Cloud databases and evidence buckets are encrypted at rest using AES-256 via Google Cloud.
Dedicated Cloud Run malware scanner with ClamAV engines and automated signature updates every 2 hours. Uploaded files remain quarantined until clean scan verdicts are verified.
Compliance assessments and readiness reports are stored with immutable SHA-256 checksums and exact provenance metadata, preventing silent tampering.
Daily automated snapshot backups guarantee a 24-hour Recovery Point Objective (RPO) with point-in-time recovery protection.
Role-based authorization restricting sensitive worker documents to authenticated organisation roles. Operational logs scrub PII and credentials.