Privacy Notice
Version: 2026.1 · Last Updated: 14 September 2026
1. Who Operates the Service & Contact Details
This Privacy Notice explains how Sponsor Licence Ready AI (“we”, “us”, “our”) collects, uses, and protects personal data through the platform at sponsorlicenceready.co.uk.
Data Protection Inquiries: You can contact our Data Protection lead by email at privacy@sponsorlicenceready.co.uk or via our Contact Page.
2. Controller vs. Processor Distinction (UK GDPR)
Our role under data protection law depends on the type of personal data and the context of processing:
Where We Act as Data Controller:
We act as Controller for customer account administration, billing data, user profile credentials, customer support communications, platform security telemetry, and audit logging required for our own legal compliance.
Where We Act as Data Processor:
We act as Processor on behalf of the customer organisation for all sponsored-worker personal data, immigration documents (passports, BRPs, visas), employment contracts, and compliance evidence uploaded by the customer for its sponsor compliance purposes. This processing is governed by our Data Processing Agreement (DPA).
3. Categories of Personal Data Collected
We collect and process the following categories of information:
- Account & Profile Data: Name, professional email address, job role, telephone number, and hashed authentication credentials.
- Organisation Details: Employer business name, company registration, UKVI sponsor licence number, registered operating locations, and key personnel designations (Authorising Officer, Key Contact, Level 1 Users).
- Billing & Subscription Data: Stripe Customer ID, subscription tier, billing interval, and transaction records. Full credit card numbers are handled directly by Stripe and never touch our servers.
- Technical & Security Logs: IP address, browser user-agent, session identifiers, timestamps of system actions, and security telemetry stored in PII-safe format.
- Customer-Uploaded Compliance Data (Processed on Customer's Behalf): Sponsored worker names, nationality, date of birth, Home Office share codes, right-to-work verification metadata, salary, standard occupational classification (SOC) codes, and scanned evidentiary files.
4. Purposes and Lawful Bases of Processing
When acting as Data Controller, we rely on the following lawful bases under UK GDPR Article 6:
| Purpose | Lawful Basis |
|---|---|
| Provision of SaaS platform, account authentication, workspace routing | Performance of Contract (Art. 6(1)(b)) |
| Payment processing, invoicing, accounting, statutory tax records | Legal Obligation (Art. 6(1)(c)) & Contract (Art. 6(1)(b)) |
| Malware scanning, platform integrity, fraud prevention, DDoS protection | Legitimate Interests (Art. 6(1)(f)) |
| Customer service and technical support communications | Performance of Contract (Art. 6(1)(b)) |
5. Sub-processors & Service Providers
We use vetted third-party sub-processors to deliver the platform. All sub-processors are bound by written data processing terms complying with UK GDPR Article 28. Our core sub-processors include:
- Google Cloud Platform & Firebase (Google Ireland Ltd / Google LLC): Cloud infrastructure, managed database (Firestore), object storage (Cloud Storage), serverless execution (Cloud Run), malware scanning, and AI inference. Primary data location: europe-west4 (Netherlands/EU).
- Stripe, Inc. / Stripe Payments Europe Ltd: Secure subscription billing, invoicing, and payment processing.
- Resend, Inc.: Transactional email delivery for system alerts and team invitations.
For complete details and notification policies regarding sub-processor changes, visit our dedicated Sub-processors Register.
6. International Data Transfers
Our production databases and evidence storage are hosted in European data centers (Google Cloud region europe-west4). Where limited service provider administration involves transfers outside the UK or European Economic Area (e.g. to the United States), such transfers are safeguarded using:
- UK adequacy regulations where applicable.
- The UK International Data Transfer Addendum or UK International Data Transfer Agreement (IDTA) approved by the Information Commissioner.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Active Workspaces: Customer compliance records and evidence remain stored while the workspace is active or in read-only preservation mode.
- Financial & Billing Records: Invoices and transaction records are retained for seven (7) years in accordance with UK statutory accounting obligations.
- Audit & Access Logs: System security audit logs are retained for twelve (12) months.
- Account Deletion: Upon written request for workspace deletion, Customer Data is scheduled for permanent purge within thirty (30) days, subject to automated backup retention cycles of up to thirty (30) days.
8. Technical & Organisational Security Measures
We implement enterprise-grade security safeguards to protect customer data:
- Tenant Isolation: Logical multi-tenant segregation at the database and storage layers. Cross-tenant access is architecturally prevented.
- Encryption: Data is encrypted in transit using TLS 1.3 and at rest using AES-256 via Google Cloud.
- Malware Protection: All uploaded files undergo automated ClamAV byte scanning in an isolated sandbox with fail-closed quarantine enforcement before promotion.
- Disaster Recovery: Daily automated snapshots with 24-hour Recovery Point Objective (RPO) and multi-region recovery capabilities.
- Role-Based Access: Granular permissions restricting access based on designated roles (Authorising Officer, Level 1 User, HR Manager, Compliance Reviewer).
9. Automated Processing & AI Extraction
The platform utilizes deterministic rule evaluation and artificial intelligence (Google Gemini API) to assist customers with document extraction and rule cross-referencing against Home Office guidelines:
- No Legal Determinations: The platform does not make automated legal decisions regarding sponsored workers. It provides factual gap analysis and compliance posture scoring based on the evidence provided.
- Human-in-the-Loop: All readiness outputs and gap findings are subject to verification and review by the Customer's Authorising Officer.
10. Cookies & Tracking Technologies
Zero Non-Essential Trackers: Sponsor Licence Ready AI does not use third-party advertising cookies, marketing pixels, or invasive behavioral trackers. We use only strictly necessary first-party session cookies required for authentication and security. As a result, no cookie consent banner is required under the Privacy and Electronic Communications Regulations (PECR).
11. Your Individual Rights
Under the UK GDPR, you have the right to:
- Request access to your personal data.
- Request correction of inaccurate or incomplete personal data.
- Request erasure of personal data (“right to be forgotten”) where statutory retention grounds do not apply.
- Request restriction of processing or object to processing based on legitimate interests.
- Request data portability.
To exercise these rights, please email privacy@sponsorlicenceready.co.uk.
12. Right to Complain to the ICO
If you have concerns about our handling of your personal data, you have the right to lodge a complaint with the UK supervisory authority:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · Website: ico.org.uk
13. Updates to this Notice
We may update this Privacy Notice periodically to reflect changes in our operational architecture, sub-processors, or legal requirements. Material updates will be notified via our website or email to registered organisation administrators.