GDPR & data protection

Sponsoro is sponsor licence compliance software for UK licensed employers. The platform helps HR, payroll and compliance teams manage sponsored workers, Right to Work, salary compliance, reporting obligations, evidence, audit trails and related Home Office duties.

Because Sponsoro processes personal data — including immigration-related records — we design the product and our operations around UK GDPR and the Data Protection Act 2018.

• Data Protection Officers and privacy teams evaluating Sponsoro for procurement
• Authorising Officers and key personnel responsible for sponsor governance
• HR and compliance leads who need to explain how worker data is handled in the platform
• Sponsored workers who want to understand who controls their data (typically their employer)

Sponsoro provides compliance workflow software — it does not provide immigration advice. Your organisation remains responsible for its sponsor duties and for providing appropriate privacy information to workers and key personnel.

Sponsoro is built and operated in the United Kingdom for UK licensed sponsors. Our approach includes:

• Privacy by design — tenant isolation, role-based access, audit trails and data minimisation built into the product
• Clear controller/processor split between Sponsoro and customer organisations
• Documented subprocessors with customer notification before material changes
• Security controls documented for customers and procurement (see our Security page)
• Incident response procedures aligned to UK GDPR breach notification requirements
• No sale of customer or worker personal data

When Sponsoro is the controller

We act as a data controller for personal data we collect to run our own business, including:

• Marketing website visitors and free-tool users
• Account registration, billing and subscription administration
• Security monitoring, fraud prevention and platform integrity
• Product communications and support (where permitted)

When Sponsoro is the processor

We act as a processor when we store and process personal data on behalf of a customer organisation in the Sponsoro application. In those cases, the customer organisation is the controller and determines why and how worker, key personnel and compliance data is processed.

Customer organisations may store the following categories of personal data in Sponsoro:

• Identity and contact details — names, emails, phone numbers, addresses
• Employment data — job titles, SOC codes, salary, hours, contract dates, work locations
• Immigration & sponsorship data — CoS references, visa expiry, nationality, passport or BRP/eVisa references, share codes
• Right to Work records — check dates, routes, outcomes, recheck dates and evidence references
• Compliance workflow data — reporting events, salary assessments, recruitment evidence, decision records
• Documents — passports, visas, contracts, payslips, address proof, qualifications
• Key personnel data — Authorising Officer and Level 1/2 user details, declarations
• Technical data — sign-in events, session metadata, audit log entries (actor, action, timestamp)

Free tools on sponsoro.co.uk may process search queries against public Home Office datasets. Optional email capture for monitoring alerts is only used if you choose to provide an address.

Sponsor compliance software inevitably handles sensitive information. Depending on what your organisation uploads, Sponsoro may process special category personal data under UK GDPR, including:

• Immigration status and nationality-related information
• Criminal conviction declarations for key personnel (stored encrypted where collected)
• Health or disability information only if your organisation chooses to record it in compliance workflows

Sponsoro as controller

For account, billing and platform operation data, we rely on lawful bases such as:

• Contract — to provide the Services you subscribe to
• Legitimate interests — security, fraud prevention, product improvement and support
• Legal obligation — where we must retain records for tax, accounting or regulatory purposes
• Consent — where required for optional communications (you may withdraw consent)

Customer organisations as controller

As a licensed sponsor, your organisation typically processes worker data because:

• You have a legal obligation to maintain sponsor records and comply with Home Office duties
• Processing is necessary for employment, immigration compliance or the performance of a contract with the worker
• You may rely on explicit consent or another Article 9 condition for special category data where applicable

You must provide your own privacy notice to sponsored workers, key personnel and other individuals whose data you upload or manage in Sponsoro.

We implement technical and organisational measures appropriate to the sensitivity of sponsor compliance data, including:

• PostgreSQL row-level security — strict tenant isolation between organisations
• Role-based access control — Authorising Officer, Level 1, Level 2, read-only and adviser roles
• Argon2 password hashing, mandatory MFA for privileged roles, encrypted MFA secrets
• Private document storage (Cloudflare R2) with short-lived signed download URLs
• Hash-chained immutable audit trail for compliance accountability
• Upload validation, optional malware scanning, rate limiting and bot protection
• Structured logging with redaction — passport numbers and document contents are not logged

Full control documentation is available on our Security page, including subprocessors, incident response and customer responsibilities.

We use carefully selected subprocessors to deliver Sponsoro. Always-on production subprocessors include:

• Vercel — application hosting
• Neon — PostgreSQL database
• Upstash — rate limiting
• Cloudflare R2 — private document storage (when configured)

Feature subprocessors (when enabled)

• Stripe — subscription billing
• Google Workspace (Gmail) — transactional email
• Cloudflare Turnstile — bot protection on authentication
• Anthropic — AI Copilot completions
• OpenAI — embeddings for guidance search
• ClamAV — malware scanning on uploads
• Inngest — background job orchestration (when configured)

We notify customer organisations at least 30 days before adding a new subprocessor that processes personal data on their behalf. AI providers receive only the minimum context needed for the requested feature — customer data is not used to train third-party models.

Some subprocessors may process data outside the United Kingdom depending on infrastructure region and vendor configuration. Where personal data is transferred outside the UK, we ensure appropriate safeguards such as:

• UK International Data Transfer Agreement (IDTA) or Addendum
• EU Standard Contractual Clauses where applicable
• Transfers to countries with UK adequacy regulations
• Selecting EU/UK regions for database and storage where available

Retention in Sponsoro is designed around sponsor record-keeping requirements and configurable category policies, including:

Authorised administrators can place legal holds to block deletion while an investigation, dispute or regulatory matter is ongoing. See our Privacy Policy for full retention detail.

Rights when Sponsoro is controller

Key personnel users and others whose data we control directly may exercise UK GDPR rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent (where applicable).

Rights for sponsored worker data

For worker records uploaded by your organisation, your employer is the controller. Workers should contact their organisation in the first instance. Sponsoro assists customer organisations in responding to requests as processor where required by our data processing terms.

To exercise rights regarding data Sponsoro controls directly, contact privacy@sponsoro.co.uk. We respond within one month, extendable where requests are complex.

Sponsoro includes features to help customer organisations meet their GDPR obligations:

• Role-based access — control who can view, edit or export worker and compliance data
• Tenant isolation — each organisation's data is separated at the database layer
• Audit trail — immutable record of who changed what, when and why
• Document retention policies — category-based retention with optional automated deletion
• Legal holds — block deletion during investigations or disputes
• Profile → Data & privacy — key personnel can access, rectify, restrict, object, export, request erasure, and delete their own account in-app
• Account deletion — closes login immediately and anonymises identity fields; Home Office audit records are retained where legally required
• Organisation settings — privacy contact and a DPO queue to review data subject requests within one month
• Worker portal — scoped access for sponsored workers to submit evidence without full HR access

Sponsoro includes an optional AI Copilot to help users explore compliance guidance and organisation data. Under UK GDPR:

• AI outputs are informational — they do not constitute immigration advice or a final compliance determination
• Compliance decisions remain subject to human review by authorised personnel
• The assistant may decline to answer when data is insufficient rather than invent a response
• Sponsoro does not make solely automated decisions with legal or similarly significant effects without human involvement
• When enabled, Anthropic and OpenAI process only the minimum context needed for the feature

Business customers who need formal processor terms can request a Data Processing Agreement (DPA). Our DPA covers:

• Subject matter, duration and nature of processing
• Types of personal data and categories of data subjects
• Processor obligations under UK GDPR Article 28
• Subprocessor governance and notification
• Security measures and assistance with data subject requests
• Deletion or return of data on termination
• Audit and inspection rights (subject to confidentiality and security constraints)

Enterprise customers may also request our subprocessor list, control summary and security questionnaire responses. Contact privacy@sponsoro.co.uk with your organisation name and requirements. Security reviews under mutual NDA are available for enterprise procurement.

We maintain an internal incident response runbook with defined severity levels and notification timelines. In the event of a personal data breach likely to affect individuals' rights:

• We notify affected customer organisations (as controllers) without undue delay
• We comply with UK GDPR reporting obligations to the ICO where Sponsoro is controller
• Customer organisations remain responsible for notifying the ICO and affected individuals where they are controller
• We assist controllers with breach investigation, containment and documentation as processor

Report a security concern to privacy@sponsoro.co.uk. See our Security page for more detail.

• Privacy Policy — full detail on collection, use, cookies and individual rights (/privacy)
• Security — technical controls, tenant isolation, subprocessors and incident response (/security)
• Terms of Service — contractual terms including data processing and acceptable use (/terms)

For GDPR, privacy and DPA enquiries:

• Email: privacy@sponsoro.co.uk
• Security questionnaires & DPA: privacy@sponsoro.co.uk (include your organisation name)
• General sales: sales@sponsoro.com

If you have concerns about how we handle personal data, contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.