Privacy Policy

1. Who we are

SponsorGuard is provided by CORTEXLABS AI LTD, a company registered in England and Wales (company no. 17385502). Registered office: Fenchurch House, 12 King Street, Nottingham, England, NG1 2AS. ICO registration number: 00015777033. Contact: support@sponsorguard.com.

SponsorGuard helps UK sponsor licence holders and their advisers track compliance duties, manage evidence, and prepare for audit. It is not a law firm and does not provide immigration legal advice, choose visa routes, or submit reports to the Home Office on your behalf.

Data-protection position: no Data Protection Officer is appointed because one is not required for our processing; our privacy lead is the founder/director. Contact us about anything in this policy at privacy@sponsorguard.com, or by post at Fenchurch House, 12 King Street, Nottingham, England, NG1 2AS.

2. When we are a processor and when we are a controller

These two roles are separate, and the lawful bases are different. Keeping them apart matters, because it decides who answers a worker's data-subject request.

• As your PROCESSOR — for the sponsored-worker records held in your workspace. You are the controller: you decide why the data is processed, you choose the Article 6 lawful basis and the Article 9/10 condition for special-category and criminal-offence data, and you instruct us. We process that data only on your documented instructions, on the terms of our Data Processing Agreement.
• As a CONTROLLER — for our own account, authentication, billing, support, security-log and website-analytics data. Here our lawful bases are: contract (to provide the service to you and to operate your account), legitimate interests (to secure the service, prevent abuse, and run our business), legal obligation (tax and accounting records), and consent (website analytics cookies only, which are off until you accept them).
• For an adviser or solicitor firm workspace, the firm is normally the controller or joint controller of its client company's worker data under its own client-care and data-sharing arrangements, and we are the firm's processor. The chain is described in the Data Processing Agreement.

3. What personal data we process

To deliver sponsor-compliance workflows we process the following categories of personal data, much of which relates to sponsored workers and is sensitive:

On the employer's instruction, SponsorGuard submits a worker's share code and date of birth to the GOV.UK "View a job applicant's right to work details" service (gov.uk/view-right-to-work). We retrieve the official result, including the worker photo, permission details and result PDF, and retain these as evidence in the employer's workspace. The Home Office operates that official service as an independent controller; it is not a SponsorGuard sub-processor.

The employer remains the controller of this workflow and must identify its lawful basis, including legal obligation where applicable to its right-to-work duties. SponsorGuard acts as processor on documented instructions. The employer must still confirm that the photo matches the person and review the result before recording a completed check. The automation uses no AI and makes no solely automated decision with legal or similarly significant effect.

• Identity and contact data — name, date of birth, nationality, home address, personal email, phone number.
• Immigration data — passport number and expiry, visa type and dates, eVisa status, share codes, right-to-work evidence, Certificate of Sponsorship (CoS) details, National Insurance number.
• Employment and pay data — job title, SOC code, salary and hourly rate, weekly hours, work location, line manager, start date.
• Compliance evidence — DBS details, recruitment/genuine-vacancy notes, uploaded documents, absence records, and audit-pack contents. Criminal-offence data (DBS) is processed under Article 10 on your instructions and condition.
• Account and billing data — account user names, email addresses, authentication factors (including MFA enrolment), workspace/role membership, record of your acceptance of these documents, and subscription/billing metadata.
• Technical data — session and security cookies, IP address, and basic request logs needed to operate and secure the service.

4. Data subjects

The personal data we process relates to: (a) sponsored workers and prospective workers recorded by a customer organisation; and (b) account users — the employer, HR, and adviser staff who use SponsorGuard.

5. Retention

Right-to-work share codes, dates of birth, retrieved results, photos and PDFs follow the worker-record retention and erasure rules below. The employer sets retention in line with its applicable obligations and must retain right-to-work check evidence for the duration of employment and two years afterwards, exporting required evidence before deletion. A share code expiry does not by itself delete the retained check evidence.

Sponsored-worker records are retained for as long as your workspace requires them and in line with your own retention obligations (UK sponsor-licence duties generally require certain records to be kept for the duration of sponsorship and for a defined period afterwards). You control retention within your workspace, including erasure of individual worker records.

When your account ends you can export your data for 30 days. We then delete it from production within a further 30 days, and it ages out of our encrypted database backups within 14 days of that deletion. Generated audit-pack downloads expire 24 hours after they are produced.

Account and billing data is retained for the life of the account and for the period we are required to keep it for legal, tax, and audit purposes, then deleted or anonymised. Security and audit-trail events are kept as compliance evidence; erasure anonymises the personal data in them but preserves the structural audit trail.

6. Sub-processors

We use a limited set of sub-processors to deliver the service. Each is bound by data-processing terms and processes data only on our instructions. The full table — name, purpose, data categories, processing location and transfer mechanism — is published on our sub-processors page, which also serves as Annex B of the Data Processing Agreement. In summary:

• Cloudflare, Inc. — Object storage for uploaded evidence documents and hourly encrypted database backups (R2), plus DNS for the SponsorGuard domains.
• Anthropic, PBC — AI-assisted document extraction, audit-pack narrative summaries, and CortexAI answers. Every output is routed for authorised human review.
• Postmark (ActiveCampaign, LLC) — Transactional email delivery — account verification, password reset, worker-portal invitations and reminder digests.
• Stripe Payments UK Ltd — Subscription billing and payment processing after a trial or pilot converts to a paid plan. No card details are stored on SponsorGuard systems.
• Google Analytics 4 (Google Ireland Limited) — Optional website analytics on public marketing pages only, loaded solely after the visitor opts in to analytics cookies. No analytics runs in the signed-in application, authentication pages, worker portal or platform administration, even with prior public-page consent.
• Hetzner Online GmbH — Running the SponsorGuard application, its PostgreSQL database and its Redis instance.

7. International transfers and data location

Where a sub-processor processes personal data outside the UK we rely on an appropriate transfer mechanism — UK adequacy regulations (which cover the EU and EEA), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with appropriate technical and organisational safeguards.

The specific location and mechanism for each provider, including where we have not yet pinned the region down, is set out per-provider on the sub-processors page. We will provide the details of any specific safeguard on request.

8. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including: application-layer encryption of the highest-sensitivity fields (passport number, date of birth) with key separation; encrypted database backups taken hourly; encryption of documents at rest in object storage with short-lived, application-proxied signed download URLs; encryption in transit (HTTPS/TLS with HSTS); multi-factor authentication, enforceable workspace-wide; role-based access control; strict multi-tenant isolation; CSRF protection and strict HTTP security headers; rate limiting on authentication endpoints; and an exportable audit log of sensitive actions.

Staff access to customer content is restricted to support and security purposes and is logged. No system is perfectly secure, but we work to protect data against unauthorised access, loss, and misuse. We have no third-party security certifications (such as ISO 27001 or SOC 2), and no independent penetration test has been completed yet. An assurance programme is planned.

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your personal data, so that you can meet your own 72-hour reporting deadline to the ICO.

9. AI-assisted features

SponsorGuard uses an AI provider for document extraction, audit-pack narrative and CortexAI answers. What is sent, what is not sent, how long it is retained, whether it can be used to train models, and where it is processed are all set out on our AI Disclosure page.

AI outputs are never used to make an automated decision about an individual with legal or similarly significant effect: every output is routed to an authorised human for review before it can be acted on.

10. Website analytics and cookies

Our public marketing site uses Google Analytics 4, and it loads only after you accept analytics cookies — nothing is fetched from Google and no analytics cookie is set until you do. The signed-in application, authentication pages, worker portal, and platform administration do not run analytics, even if you opted in on a public marketing page. Strictly necessary cookies (session, CSRF, workspace selection) need no consent. See our Cookie Policy for the detail.

11. Your data-subject rights

Subject to UK GDPR, individuals have the right to: access their personal data; have inaccurate data rectified; have data erased (the "right to be forgotten"); restrict or object to processing; and data portability. SponsorGuard supports erasure of an individual worker's personal data within a workspace, including deletion of the underlying document files from object storage, leaving an anonymised compliance tombstone and audit trail.

Because sponsored-worker data is controlled by the sponsoring organisation, requests about a worker's data should normally be made to that organisation. We will assist our customers in responding. Account users can exercise their own rights by contacting us directly.

To make a request, ask a question, or raise a concern, contact privacy@sponsorguard.com. If you are a sponsored worker, please also contact your sponsoring employer, who controls your record. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes to this policy

This policy is version 2026-10-03. We will notify account owners by email of material changes and publish the current version here.