Data Processing Agreement

1. Parties and how this takes effect

SponsorGuard is provided by CORTEXLABS AI LTD, a company registered in England and Wales (company no. 17385502). Registered office: Fenchurch House, 12 King Street, Nottingham, England, NG1 2AS. ICO registration number: 00015777033. Contact: support@sponsorguard.com.

This Data Processing Agreement ("DPA") is between you, the customer organisation ("you", the controller), and us ("we", "us", the processor). It is incorporated into the Terms of Service and takes effect when you accept those terms — you do not need to sign a separate copy. If your procurement process requires a signed counterpart on your own paper, ask us and we will sign one.

This DPA records the terms required by Article 28(3) of the UK GDPR (the retained EU General Data Protection Regulation as it forms part of UK law) read with the Data Protection Act 2018. Terms such as personal data, processing, controller, processor, sub-processor, data subject, personal data breach and supervisory authority have the meanings given in those laws.

2. Roles and scope

You are the controller and we are your processor for the personal data described in Annex A. We will process that personal data only to provide the service and only on your documented instructions — which include these documents, your configuration of your workspace, and anything else you instruct us in writing.

We will tell you promptly if, in our opinion, an instruction you give us would breach data protection law. We will not process your personal data for our own purposes, and we will never use the data in one workspace to serve another customer.

Where you are an adviser or solicitor firm using a multi-client workspace, you remain the controller (or joint controller with your client company, under your own client-care and data-sharing arrangements) for each client's worker data, and we are your processor in respect of all of it. We do not contract directly with your client companies and we take instructions only from you. Each client workspace keeps a separate compliance record with its own access control.

3. Our obligations as processor

• Confidentiality — every person we authorise to process your personal data is bound by a written duty of confidentiality that survives the end of their engagement.
• Security — we implement the technical and organisational measures required by Article 32, described in Annex C.
• Sub-processors — we engage sub-processors only on the terms in clause 4.
• Data-subject rights — taking into account the nature of the processing, we will assist you in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). The service includes self-service tooling for worker erasure and for data export, so most requests need no involvement from us.
• Assistance — we will assist you in meeting your own obligations under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us. Ask us for our security pack and we will supply it to support your DPIA.
• Deletion or return — at the end of the provision of the service we will delete or, at your choice, return all of your personal data, and delete existing copies, unless we are required by law to keep it. The timings are in clause 7.
• Audit and information — we will make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, by you or an auditor you mandate. Audits are subject to reasonable notice, confidentiality, and a limit of once per twelve months except where there has been a breach affecting your data or a supervisory authority requires more.

4. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Annex B below. We impose data-protection obligations on each of them that are no less protective than those in this DPA, and we remain liable to you for what they do.

We will tell you by email at least 30 days before adding or replacing a sub-processor, which gives you the opportunity to object on reasonable data-protection grounds. If you object and we cannot resolve it, you may terminate the affected part of the service without penalty.

5. Personal data breaches

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your personal data, so that you can meet your own 72-hour reporting deadline to the ICO.

Our notification will tell you, so far as we know it at the time: what happened and when; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures we have taken or propose to take. We will keep you updated as the picture becomes clearer, and we will help you notify the ICO and affected individuals where you decide you must.

We will not delay telling you while we investigate. The 48-hour commitment is an outer limit, not a target. Report anything you think is a security problem to support@sponsorguard.com.

6. International transfers

Any transfer of your personal data outside the UK is subject to an appropriate safeguard under data protection law — a UK adequacy regulation (which covers the EU and EEA), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The current location and mechanism for each sub-processor is in Annex B.

7. Deletion and return at the end

You can export your data at any time while your account is open, and for 30 days after it ends. After that export window we delete your personal data from our production systems within 30 days. It ages out of our encrypted database backups within a further 14 days, because backups are retained on a rolling 14-day cycle and are not selectively edited.

Generated audit-pack download artifacts expire 24 hours after they are produced and are then purged automatically; the record of what was generated and when is kept as part of your compliance history until your data is deleted.

We will confirm deletion to you in writing on request. Where we are required by law to retain something (for example billing records), we keep only what the law requires and continue to protect it under this DPA.

8. Liability, term and law

Liability under this DPA is as set out in the Terms of Service.

This DPA takes effect when you accept the Terms of Service and continues for as long as we process personal data on your behalf.

This DPA is governed by the laws of England and Wales and the courts of England and Wales have exclusive jurisdiction.

Annex A — details of the processing

On the employer's documented instruction, SponsorGuard submits the worker's share code and date of birth to the GOV.UK "View a job applicant's right to work details" service (gov.uk/view-right-to-work) and retrieves the result, worker photo, permission details and result PDF into the workspace. The Home Office operates that service as an independent controller, not our sub-processor. You remain the controller responsible for the lawful basis, including legal obligation where applicable to your right-to-work duties; we are your processor.

Retrieved right-to-work results, photos and PDFs are retained with the worker record under your retention instructions and clause 7 deletion periods. You must retain check evidence for the duration of employment and two years afterwards and export it before workspace deletion. Share code expiry is not an evidence-retention deadline. The employer must confirm the photo match and review the official result before completing the check. This deterministic workflow uses no AI and makes no solely automated decision with legal or similarly significant effect.

• Subject matter: provision of the SponsorGuard UK sponsor-licence compliance service.
• Duration: the term of the Terms of Service, plus the deletion periods in clause 7.
• Nature and purpose: storing, organising and retrieving compliance records; monitoring deadlines and sending reminders; generating compliance evidence and audit packs; AI-assisted extraction and summarisation routed for authorised human review.
• Categories of data subject: your sponsored workers and prospective workers; your own staff users of the service; for adviser firms, the sponsored workers of your client companies.
• Types of personal data: identity and immigration data (name, date of birth, nationality, passport number and expiry, visa and leave details, eVisa status, right-to-work share codes), National Insurance number, home address and contact details, salary and employment and CoS details, absence records, and uploaded documents such as passport, visa and DBS scans; account data for staff users (name, email, role, authentication and audit metadata).
• Special-category data (Article 9): may be present in uploaded documents and in absence records — for example health information in a sickness-absence note. You choose the Article 9 condition.
• Criminal-offence data (Article 10): DBS certificate details. You choose the Article 10 condition and the appropriate policy document.

Annex B — authorised sub-processors

This annex is maintained on our sub-processors page so that it is always current. The table below is that same list.

Annex C — technical and organisational measures (Article 32)

• Encryption in transit: HTTPS/TLS with HSTS on all endpoints.
• Encryption at rest: application-layer AES-SIV encryption of the highest-sensitivity personal data fields (passport number, date of birth) with key separation from the database; encrypted hourly database backups.
• Document storage: private object storage; no bare object URLs — downloads are served through short-lived, application-proxied signed URLs.
• Access control: strict multi-tenant isolation; role-based access control with least privilege (owner, admin, compliance manager, viewer); workspace-wide enforceable multi-factor authentication; active session review and revocation.
• Authentication: Argon2id password hashing, a 12-character minimum, authenticated password change, and rate limiting on authentication endpoints.
• Application hardening: CSRF protection, strict HTTP security headers, server-side input validation, and tenant-scoped authorisation on every data path.
• Auditability: an exportable security audit log of sensitive actions, including authentication events and data exports.
• Data-subject support: built-in right-to-erasure that anonymises the record and deletes the underlying document bytes from object storage, plus a documented retention and cleanup process.
• Staff access: access to customer content is restricted to support and security purposes, requires authorisation, and is logged.
• We have no third-party security certifications (such as ISO 27001 or SOC 2), and no independent penetration test has been completed yet. An assurance programme is planned.