1. Introduction
1.1 This Data Processing Agreement (“DPA”) forms part of and is incorporated by reference into the Rightcheck Terms of Use as published by T4 Communications UK Ltd (t/a Rightcheck) (“Rightcheck”) a company registered in England and Wales under company number 06240820.
1.2 This DPA reflects the requirements of the UK GDPR, the EU GDPR, and the Data Protection Act 2018, and ensures the protection of personal data processed by Rightcheck on behalf of the Subscriber (“Controller”) in connection with the provision of the Rightcheck platform and related services.
1.3 In the event of a conflict between this DPA and any other agreement between the Parties, this DPA shall prevail to the extent of the conflict, except where applicable law requires otherwise.
2. Definitions
2.1 In this DPA:
2.1.1 “Data Protection Law” means all applicable legislation protecting the fundamental rights and freedoms of individuals in relation to their personal data and right to privacy, including (but not limited to) the Data Protection Act 2018, the UK GDPR, and the EU GDPR, each as amended from time to time.
2.1.2 “UK GDPR” means the GDPR as implemented into UK law via domestic legislation including the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019.
2.1.3 “GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679).
2.1.4 “Subscriber” means the data controller that subscribes to use the Rightcheck platform.
2.1.5 “Processor”, “Controller”, “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach”, and “Supervisory Authority” have the meanings given in Article 4 UK GDPR.
2.1.6 “Sub-Processor” means any third party engaged by Rightcheck to process personal data on behalf of the Subscriber.
3. General Obligations
3.1 The Parties acknowledge that, for the purposes of this DPA:
3.1.1 the Subscriber acts as the Controller; and
3.1.2 Rightcheck acts as the Processor.
3.2 Rightcheck shall process personal data only on the documented instructions of the Subscriber, unless required to do so by law.
3.3 The Subscriber warrants that its instructions to Rightcheck comply with Data Protection Law and that any personal data provided has been lawfully obtained.
3.4 Rightcheck shall notify the Subscriber if it becomes aware that any instruction appears to infringe Data Protection Law.
4. Security of Processing
4.1 Rightcheck shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
4.1.1 encryption and pseudonymisation of personal data;
4.1.2 ensuring ongoing confidentiality, integrity, and resilience of systems;
4.1.3 ability to restore availability and access in a timely manner; and
4.1.4 regular testing and evaluation of security measures.
4.2 Rightcheck shall ensure that all persons authorised to process personal data are subject to confidentiality obligations.
4.3 The Subscriber is responsible for implementing appropriate controls within its own systems and for managing access to its Rightcheck accounts.
5. Sub-Processing
5.1 Rightcheck may engage Sub-Processors to support delivery of the Services.
5.2 A current list of Sub-Processors is available to Subscribers on request by contacting privacy@rightcheck.io.
5.3 Rightcheck shall ensure that any Sub-Processor is bound by written terms providing an equivalent level of protection as this DPA.
5.4 Rightcheck remains fully liable to the Subscriber for the performance of each Sub-Processor’s obligations.
5.5 Rightcheck is not required to seek prior written approval for routine Sub-Processor changes; however, it shall ensure continuity of data protection standards and inform Subscribers of material changes where appropriate.
6. Assistance to the Subscriber
6.1 Taking into account the nature of processing, Rightcheck shall assist the Subscriber by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Subscriber’s obligations to respond to data-subject requests under Data Protection Law.
6.2 Rightcheck shall promptly forward to the Subscriber any request received directly from a data subject.
6.3 Rightcheck shall provide reasonable cooperation to assist the Subscriber in:
6.3.1 conducting data-protection impact assessments; and
6.3.2 consulting with supervisory authorities where required.
7. Personal Data Breaches
7.1 Rightcheck shall notify the Subscriber without undue delay after becoming aware of a personal-data breach.
7.2 Such notice shall include:
7.2.1 a description of the nature of the breach;
7.2.2 categories and approximate number of data subjects affected;
7.2.3 likely consequences; and
7.2.4 measures taken or proposed to address the breach.
7.3 Rightcheck shall cooperate with and provide assistance to the Subscriber in relation to any remedial actions or regulatory notifications.
8. Deletion and Return of Data
8.1 The Rightcheck platform operates as a Software-as-a-Service (“SaaS”) system under which all personal data processed on behalf of the Subscriber remains at all times fully accessible to, and under the control of, the Subscriber through the platform.
8.2 During the term of the Agreement, the Subscriber may export, download, or delete personal data at any time using the features provided within the Rightcheck platform. Rightcheck shall not restrict or prevent such access or deletion.
8.3 Upon termination or expiry of the Agreement, Rightcheck shall automatically disable the Subscriber’s access to the platform and shall permanently delete the Subscriber’s account and all associated personal data from live systems, unless applicable law requires continued retention.
8.4 Copies of personal data held within Rightcheck’s disaster recovery and backup systems will be automatically overwritten and permanently deleted within ninety (90) days following deletion from live systems.
8.5 Rightcheck shall not be required to return any personal data to the Subscriber, given that the Subscriber has continuous access to export or remove such data at any time prior to termination.
8.6 If requested, Rightcheck shall provide written confirmation to the Subscriber upon completion of the post-termination deletion process.
9. Records, Audits, and Inspections
9.1 Rightcheck shall maintain written records of all categories of processing carried out on behalf of the Subscriber.
9.2 Such records shall include:
9.2.1 the name and contact details of the Subscriber and any Sub-Processors;
9.2.2 categories of processing activities;
9.2.3 any international transfers; and
9.2.4 a description of security measures implemented.
9.3 Rightcheck shall make these records available to the Subscriber or to a supervisory authority upon reasonable request and shall allow for audits or inspections where required by law.
10. International Transfers
10.1 Rightcheck shall not transfer personal data outside the UK or EEA except:
10.1.1 to a country subject to an adequacy decision;
10.1.2 under standard contractual clauses or equivalent safeguards; or
10.1.3 where a derogation under Article 49 UK GDPR applies.
10.2 Where transfers are necessary for international background checks, Rightcheck shall ensure appropriate safeguards are in place prior to processing.
11. Particulars of Processing
11.1 Subject Matter of Processing – Personal data processed to enable Subscribers to conduct right-to-work checks and other pre-employment screening.
11.2 Duration of Processing – The licence period as defined in the Subscription Agreement and for such additional retention as required by law.
11.3 Nature and Purpose of Processing – Verification and storage of identity and employment-related documentation to support lawful employment and screening decisions.
11.4 Type of Personal Data – May include:
11.4.1 name, contact details, and date of birth;
11.4.2 address and address history;
11.4.3 passport or ID details (including photograph and nationality);
11.4.4 images or biometric chip data; and
11.4.5 employment or reference details.
11.5 Categories of Data Subjects – Candidates and employees of the Subscriber.
11.6 Retention of Data – Typically retained for the duration of employment plus two years, or longer if legally required.
12. Governing Law and Jurisdiction
12.1 This DPA shall be governed by and construed in accordance with the laws of England and Wales.
12.2 The Parties agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA.