Introduction
Rightcheck are committed to protecting and respecting your privacy and to ensuring compliance with applicable data protection legislation.
Your Company has subscribed to the Rightcheck platform. In providing the platform, Rightcheck acts as a Data Processor.
This Privacy Policy applies to your use of the Rightcheck platform, including the online web portal and mobile applications.
The Rightcheck platform enables candidate Right to Work checks and a wider range of pre-employment and background screening checks to be conducted by a subscribing employer. The Subscriber (your company) is the Data Controller of candidate personal data associated with these checks, and you should contact them directly if you have any questions or concerns regarding candidate data.
This Privacy Policy applies only to the personal data collected in order to allow you, as an authorised recruiter or user, to access and use the Rightcheck platform, and sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
Definitions
- Data protection legislation – The UK Data Protection Act 2018 (as amended) and the UK General Data Protection Regulation (UK GDPR), as in force from time to time.
- Data controller – A controller determines the purposes and means of processing personal data.
- Data processor – A processor is responsible for processing personal data on behalf of a controller.
- Data subject – A natural person.
- Categories of data – Personal data and special categories of personal data.
- Personal data – Any information relating to an identifiable person who can be directly or indirectly identified, for example, name, passport number, home address, private email address, or online identifiers such as IP addresses and cookies.
- Special category personal data – Includes genetic data, biometric data for unique identification, racial or ethnic origin, sexual orientation, health data, trade union membership, political opinions, and religious or philosophical beliefs.
- Processing – Any operation performed on personal data, whether by automated means or not, such as collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
- Third party – Any natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised by the controller or processor.
The purposes of processing your personal data
We use your personal data for the following purposes:
- Customer Support: To provide support in your use of the Rightcheck platform, including diagnosing technical issues, rectifying errors, and providing other support services.
- Customer Engagement and Communication: To communicate with you regarding service-related matters, such as user account confirmations, platform updates, invoices, and operational notifications.
- Account Administration: To manage your user account within the platform, including enabling secure access, authentication, and audit trail functions.
- Regulatory and Security Obligations: To comply with legal and regulatory requirements, including information security standards, anti-fraud obligations, and audit requirements.
Categories of personal data processed
We process the following categories of personal data about recruiter users of the platform:
- Full Name
- Organisation
- Job Title
- Business Email Address
- Business Phone Number
- User Account Credentials (username, password, authentication tokens, activity logs)
Legal basis for processing
The legal bases we rely upon include:
- Legitimate Interests: Where the processing is necessary for our legitimate interests in providing, securing, and improving the Rightcheck platform, and these do not override your rights and freedoms.
- Legal Obligations: Where processing is required for us to comply with a legal or regulatory obligation, such as responding to a lawful request by authorities.
- Contractual Necessity: Where processing is necessary for the performance of our contract with your Company under the Terms of Service governing its subscription to the Rightcheck platform.
Sharing your personal data
Your personal data will be treated as strictly confidential and will only be shared internally within Rightcheck for the purposes explained above.
We may also share your personal data with trusted third-party service providers engaged to support the operation of the Rightcheck platform (for example, hosting providers, IT support, cloud service providers). These parties act only on our instructions and are bound by contractual and legal obligations to protect your information.
We do not sell or otherwise disclose your personal data for unrelated marketing purposes.
Data retention
We keep your personal data for no longer than is reasonably necessary. Retention periods are determined using the following criteria:
- User account data is retained for the duration of your Company’s subscription to the Rightcheck platform and for a period thereafter as required for audit, compliance and legitimate business purposes.
- Contact details provided for newsletters or updates are retained until you unsubscribe or request deletion.
- Data obtained via support requests or contact forms is retained until the issue is resolved and for a reasonable period thereafter for audit and service improvement.
Providing us with your personal data
You are not under a statutory obligation to provide us with your personal data. However, if you do not provide the required information:
- We may not be able to create or maintain your user account.
- We may not be able to provide customer support or communicate important updates.
- We may not be able to ensure the secure operation of the platform.
Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access – to request a copy of the personal data we hold about you.
- Right of rectification – to request correction of inaccurate or incomplete data.
- Right of erasure – to request deletion of data where it is no longer necessary to retain it.
- Right to withdraw consent – where consent has been given as a legal basis for processing.
- Right to data portability – to request transfer of your data to another controller, where processing is based on consent or contract and is automated.
- Right to restrict processing – to request restriction where accuracy or legality is contested.
- Right to object – to object to processing based on legitimate interests.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you are concerned about how your data has been handled.
International transfers
Personal data is generally processed and stored within the UK. Where international transfers of personal data occur (for example, where cloud service providers operate outside the UK/EEA), such transfers will be carried out in compliance with applicable data protection law, using adequacy decisions, the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCCs), or equivalent safeguards.
Further processing
If we wish to use your personal data for a new purpose not covered by this Privacy Policy, we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant lawful bases.
Changes to this Privacy Policy
Any changes we may make to this Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email or via the platform. Please check back regularly to stay informed of updates.
Contact us
If you would like more information about how we use and store your data, or have any issues concerning your data, please contact us at: support@rightcheck.io
If you are not satisfied with our response, you may contact the Information Commissioner’s Office (ICO).