NC5 - Digital Identity & RTW Compliance

1. Introduction

NC5 Digital Identity & Compliance Platform ("we", "our", or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Right to Work compliance platform.

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

We collect the following types of personal information:

Identity Data: Full name, date of birth, nationality, National Insurance number
Contact Data: Email address, phone number, postal address
Employment Data: Agency affiliation, work locations, employment history
Right to Work Data: Share codes, visa information, work permits, expiry dates
Document Data: Passport copies, birth certificates, National Insurance documents, photographs
Technical Data: IP address, browser type, device information, login times
Usage Data: How you use our platform, pages visited, features accessed

2.2 Special Category Data

We process special category personal data including biometric data (photographs for identity verification) and data concerning nationality and immigration status. We process this data under Article 9(2)(b) UK GDPR (employment, social security and social protection law) and with your explicit consent.

3. How We Use Your Information

We use your personal information for the following purposes:

Right to Work Verification: To verify your eligibility to work in the UK by checking with the UK Home Office
Compliance Obligations: To fulfill our legal obligations under UK immigration law
Identity Verification: To confirm your identity and prevent fraud
Platform Operations: To provide and maintain our services
Communication: To send you important notifications about your RTW status, expiry reminders, and system updates
Audit Trail: To maintain an immutable record of all verification checks as required by law
Security: To protect against unauthorized access and maintain data integrity
Analytics: To improve our services and user experience

4. Legal Basis for Processing

We process your personal data under the following legal bases:

Legal Obligation: Processing necessary for compliance with UK immigration law and Right to Work requirements
Legitimate Interests: Fraud prevention, security, and platform improvement
Consent: For marketing communications and certain optional features (you can withdraw consent at any time)
Contract: Processing necessary for the performance of our services

5. Data Sharing and Disclosure

5.1 Who We Share With

We may share your personal information with:

UK Home Office: For Right to Work verification via their official API
Your Employer/Agency: To confirm your work authorization status
Compliance Officers: Authorized personnel conducting audits
Service Providers: Email services (SendGrid), SMS services (Bird.com), cloud storage, analytics providers
Legal Authorities: When required by law or to protect our legal rights

5.2 International Transfers

Some of our service providers are located outside the UK. We ensure adequate safeguards are in place through Standard Contractual Clauses or adequacy decisions as required by UK GDPR.

6. Data Retention

We retain your personal data for the following periods:

Right to Work Records: Minimum 3 years from the end of employment (as required by UK immigration law)
Audit Trail Records: 7 years (best practice for compliance records)
Identity Documents: Retained for the duration of employment plus 3 years
Marketing Consent: Until you withdraw consent or 3 years of inactivity
Account Data: 30 days after account closure (unless longer retention required by law)

After the retention period expires, we securely delete or anonymize your data.

7. Your Data Protection Rights

Under UK GDPR, you have the following rights:

Right of Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your data (subject to legal retention requirements)
Right to Restriction: Request limitation on processing of your data
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
Right to Lodge a Complaint: Complain to the Information Commissioner's Office (ICO)

To exercise any of these rights, please contact us at: privacy@nc5.uk

You can also use our GDPR Data Request Portal to submit requests electronically.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

Encryption of data in transit (TLS/SSL) and at rest
Multi-factor authentication for account access
Role-based access controls
Regular security audits and penetration testing
Secure data centers with ISO 27001 certification
Staff training on data protection
Incident response procedures

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use tracking cookies for advertising purposes. You can control cookies through your browser settings.

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on our platform. The "Last Updated" date at the top of this policy indicates when it was last revised.

12. Contact Information

Data Controller: NC5 Digital Ltd

Email: privacy@nc5.uk

Address: 123 Compliance Street, London, EC1A 1BB, United Kingdom

Data Protection Officer: dpo@nc5.uk

ICO Registration Number: [To be obtained]

Supervisory Authority: Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113