Last Updated: 25th November 2025

1. Introduction

This Privacy Policy explains how the My Rightcheck App (“the App”) collects, uses, stores, and retains your personal information when completing a Right to Work check on behalf of your prospective or current employer (“the Employer”).

Rightcheck (“Rightcheck”, “we”, “us”, “our”) acts as Data Processor, and your Employer is the Data Controller.

2. How and why data is collected

Data is collected and processed on behalf of your prospective employer to enable them to:

  • Conduct Right to Work checks in line with UK legislation to obtain a Statutory Excuse against Civil Penalty under the Immigration, Asylum and Nationality Act 2006 and related regulations; and
  • Conduct a wider range of pre-employment and background-screening checks as part of their recruitment and compliance processes.

These may include, without limitation:

  • Criminal-record checks (UK or international)
  • Directorship and corporate-record checks
  • Financial and credit checks
  • Employment and reference verification
  • Education and qualification checks
  • Adverse-media or sanctions screening and other lawful checks requested by the employer

All data is collected via the My Rightcheck app, which you download and use to submit information and documents securely.

3. What information we collect

Depending on the checks your employer requests, the information and documents collected through the app may include:

  • Name, address, contact details (email, phone number)
  • Date of birth, gender, birthplace
  • Address and employment history
  • Passport, visa, identity cards, biometric data
  • Share codes, National Insurance number, or residence documentation
  • Bank details (where required for payroll verification)
  • Photographs or video images for identity validation

For additional background-screening services, we may also process:

  • Criminal-record or police-certificate information (where legally permitted)
  • International equivalents of right-to-work or criminal-checks
  • Directorship, company-officer and insolvency information
  • Financial background or credit history
  • Education and qualification verification
  • Reference details and responses

4. Face Data (Photographs and Video of Your Face)

What face data we collect

When you use the App, you may be required to submit:

  • A selfie photograph, and/or
  • A short live video of your face

These are used to verify your identity and confirm that you are a real, live person.

The App does NOT:

  • generate biometric face templates
  • generate mathematical faceprints
  • process biometric data beyond simple image/video comparison

Only standard images/video are collected.

How we use your face data

Your face images or video are used exclusively to:

  1. Compare your face to the image on your identity document
  2. Perform liveness checks
  3. Support fraud and impersonation prevention
  4. Enable your Employer to meet UK Right to Work obligations

We do not:

  • use your face data for marketing
  • use your face for biometric enrolment or wider facial recognition
  • use your face data for analytics or profiling
  • sell or licence your face data

Sharing of face data

Rightcheck does not share your face images or video with any third parties.

Face data is processed only by Rightcheck and provided only to your Employer, who is the Data Controller.

There are no external identity-verification providers, processors, or sub-processors involved.

Where your face data is stored

All face images/video are stored:

  • securely within Rightcheck-controlled UK-based servers
  • encrypted in transit and at rest
  • accessible only to authorised Rightcheck personnel operating under instructions from your Employer

Retention of face data

  • If you are employed, your face images/video are retained for the duration of your employment plus up to two years, to enable your Employer to maintain compliance with UK Government legislation.
  • If you are not employed, your Employer determines the retention period and instructs deletion.

Once deletion is instructed:

  • the data is removed from active systems
  • encrypted disaster-recovery backups remain for up to 90 days before permanent deletion

Rightcheck does not store biometric templates and does not retain face data longer than necessary.

5. Legal Basis for Processing

The Employer (as Data Controller) establishes the legal basis for processing. This typically includes:

  • Compliance with legal obligations (Right to Work checks)
  • Consent (for optional information)
  • Legitimate interest in fraud prevention and identity verification

6. Data Storage and Retention

All personal data is stored within the United Kingdom on secure, encrypted servers controlled by Rightcheck.

Data retention is determined by your Employer. Rightcheck retains data only as instructed and maintains encrypted system backups for 90 days for disaster-recovery purposes.

See Section 4 for specific retention rules relating to face data.

7. Use of Personal Information

Your personal data is used solely for the purpose of completing Right to Work and other background-screening checks on behalf of your prospective employer. This may include identity verification, document validation, and other pre-employment checks necessary to assess your suitability for employment.

Rightcheck does not use your personal data for any independent purpose, marketing, or profiling.

8. Sharing Your Information

Access to your data is strictly controlled and limited to:

  • Your prospective employer (Data Controller)
  • Rightcheck (Data Processor) and
  • Third-party sub-processors engaged by Rightcheck to perform specific checks or technical functions

Third-party providers may include:

  • Identity-verification and document-authentication suppliers
  • Criminal-record disclosure bodies
  • Credit reference agencies
  • International screening partners
  • Academic and professional verification bodies
  • Referees or previous employers

All third parties are bound by written data-processing agreements ensuring that:

  • They act only on Rightcheck’s documented instructions
  • They maintain appropriate technical and organisational security measures
  • Data is used only for the purposes of the requested background checks

Some of our verification partners require us to link directly to their own privacy notices so that candidates can understand how their data is processed for those specific checks. You can view these notices here:

The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by https://www.cifas.org.uk/fpn

Where international data transfers are necessary (for example, to verify overseas criminal records or qualifications), these are conducted in accordance with UK data-protection law using approved mechanisms such as:

  • An adequacy decision
  • The UK International Data Transfer Agreement (IDTA) or
  • Standard Contractual Clauses (SCCs) with appropriate safeguards

A list of associated third-party privacy policies and sub-processors is available on request by emailing privacy@rightcheck.io

9. Your Rights

As determined under applicable data-protection laws, you have rights to:

  • access your personal data
  • request corrections
  • request deletion (subject to the Employer’s legal obligations)
  • restrict or object to processing

Rightcheck will act on instructions issued by your Employer.

10. Children’s Privacy

The App is not intended for children under 16, except where used in accordance with employment laws and with appropriate consent where required.

11. Changes to this Policy

The date at the top of this Policy reflects the most recent update. We may update this Policy from time to time. Material changes will be communicated through the App or our website.

12. Contacting us

If you have any questions or concerns about this Privacy Policy or how your data is handled, please contact:
📧 privacy@rightcheck.io