Privacy Policy

This Privacy Policy explains how Sponsoro collects, uses, stores, shares and protects personal data when you visit our website at sponsoro.co.uk, use our free tools, create an account, or use the Sponsoro sponsor compliance platform at app.sponsoro.co.uk (together, the “Services”).

Sponsoro is sponsor licence compliance software for UK employers. The platform helps organisations manage sponsored workers, Right to Work, salary compliance, reporting obligations, evidence, audit trails and related Home Office duties. It provides compliance information and workflow support — not immigration advice.

We are committed to handling personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In this policy, “Sponsoro”, “we”, “us” and “our” refer to the operator of the Sponsoro platform.

For questions about this policy or our use of personal data, contact us at privacy@sponsoro.co.uk.

Where we process personal data on behalf of a customer organisation, that organisation remains responsible for providing its own privacy notice to workers, key personnel and other individuals whose data it uploads or manages in Sponsoro.

This policy applies to:

• Visitors to the Sponsoro marketing website and users of public free tools (such as sponsor licence lookup, salary checkers and health check tools)
• Individuals who register for a Sponsoro account or are invited to join a customer organisation's workspace
• Key personnel users who access the Sponsoro application (Authorising Officers, Level 1/2 users, read-only users and advisers)
• Sponsored workers who are given access to the Sponsoro worker portal or evidence submission links
• Billing contacts and other representatives of customer organisations

It does not replace a customer organisation's privacy notice to its employees or sponsored workers. Customers are responsible for their own lawful basis for uploading worker and immigration data into Sponsoro.

When Sponsoro is the data controller

We act as a controller for personal data we collect to operate our own business, including:

• Marketing website usage and enquiries
• Account registration, billing and subscription administration
• Security, fraud prevention and platform integrity
• Communications about the Services, product updates (where permitted) and support
• Our own personnel and vendor management

When Sponsoro is the data processor

We act as a processor when we store and process personal data on behalf of a customer organisation in the Sponsoro application, including sponsored worker records, Right to Work checks, compliance documents, key personnel registers, audit logs and related compliance data. In those cases, the customer organisation is the controller and determines why and how that data is processed.

Business customers may request a Data Processing Agreement (DPA) covering processor obligations. Contact privacy@sponsoro.co.uk for DPA enquiries.

5.1 Account and organisation data

When you sign up or manage an organisation in Sponsoro, we may collect:

• Full name, work email address and organisation name
• Password (stored as a secure hash — we never store plain-text passwords)
• Sponsor licence number, company number, licence rating and primary sponsorship route
• Team invitation details (email addresses and assigned roles)
• Billing contact details and subscription metadata when billing is enabled
• Compliance alert preferences and onboarding choices

5.2 Key personnel user profile data

• Job title, department, phone number and portal role
• Multi-factor authentication (MFA) enrolment data (TOTP secrets stored encrypted)
• Notification, audit visibility and privacy preference settings
• Support ticket messages you submit
• Session records, sign-in events and security-related activity

5.3 Sponsored worker and immigration compliance data

Customer organisations may store extensive worker data in Sponsoro, typically including:

• Identity and contact details (name, email, phone, home and work addresses)
• Employment details (job title, SOC code, salary, hours, contract dates, work location)
• Immigration and sponsorship data (Certificate of Sponsorship reference, visa expiry, nationality, passport or BRP/eVisa references, share codes where recorded)
• Right to Work check records (check date, route, method, outcome, recheck dates and related evidence references)
• Recruitment evidence, salary assessments, reporting events and compliance decisions
• Uploaded documents such as passports, visas, contracts, payslips, address proof and qualification records
• Worker portal credentials where portal access is enabled

Some of this data may constitute special category personal data under UK GDPR (for example immigration status, criminal declarations for key personnel, or other sensitive information). See section 8.

5.4 Key personnel and governance data

• Key personnel register entries (names, roles, contact details, appointment dates)
• Key personnel declarations, which may include encrypted criminal conviction declarations required for sponsor governance
• CoS allocation records, ISC calculations and organisation compliance documents

5.5 External register and integration data

• Public UKVI sponsor register information matched to your organisation name during onboarding or External Radar monitoring
• Companies House company profile and officer data when the integration is enabled
• Payroll integration metadata and encrypted OAuth credentials where Xero or other payroll connections are configured
• UK address search queries when you use address lookup (postcodes or street text sent to third-party lookup services)

5.6 Technical and security data

• IP address and request metadata used for rate limiting, security and troubleshooting
• Browser type, device information and HTTP logs
• Cloudflare Turnstile tokens when bot protection is enabled on sign-in or sign-up
• Structured application logs (with personal data redacted where possible)
• Immutable hash-chained audit log entries recording compliance actions, exports, privacy events and system activity

5.7 AI assistant data

When the AI Copilot is enabled, we may process:

• Questions you submit to the assistant and retrieved guidance context
• Query metadata (such as outcome, length and referenced guidance chunks)
• Embeddings generated from guidance text and queries for search retrieval

Sponsoro is designed so that passport numbers and similar highly sensitive identifiers should not be submitted to the AI assistant. Do not paste passport scans or full document contents into AI prompts.

5.8 Free tools and marketing site

• Search queries entered into public tools (for example sponsor register lookup)
• Email addresses if you request monitoring alerts on a free tool (where offered)
• Standard server logs for website visits

We use personal data to:

• Provide, maintain and improve the Sponsoro platform and website
• Create and manage user accounts, organisations and worker records
• Authenticate users, enforce MFA, prevent unauthorised access and protect against abuse
• Send transactional emails (verification, password reset, team invites, worker portal invites, compliance alerts, export notifications and privacy request updates)
• Run compliance workflows: salary checks, reporting deadlines, Right to Work rechecks, document retention, External Radar monitoring and audit trail generation
• Process billing and subscriptions through Stripe when enabled
• Provide customer support and respond to enquiries
• Generate compliance exports, audit packs and personal data exports
• Process data subject access and erasure requests
• Apply document retention policies and legal holds
• Operate optional AI-assisted compliance guidance
• Monitor platform health, diagnose errors and maintain security
• Comply with legal obligations and respond to lawful requests

We do not sell personal data. We do not use product analytics SDKs to track individual behaviour across third-party sites. A “usage analytics” preference may appear in account settings; if present, it is intended for optional product improvement only and is not linked to advertising networks.

Where Sponsoro is the controller, we rely on the following legal bases under UK GDPR:

Where Sponsoro is a processor, the customer organisation must identify and document the appropriate legal basis for processing worker and immigration data — typically legal obligation under UK immigration and sponsor licence rules, contractual necessity for sponsorship, and/or legitimate interests in managing compliance.

Sponsoro may process special category personal data on behalf of customer organisations, including:

• Immigration status and Right to Work information for sponsored workers
• Health or ethnicity data only where recorded incidentally in documents uploaded by the customer
• Encrypted key personnel criminal declaration data where required for sponsor governance

When we process this data as a processor, the customer organisation is responsible for identifying the appropriate condition under Article 9 UK GDPR and Schedule 1 DPA 2018 (for example legal obligation, substantial public interest, or employment law purposes).

Sponsoro applies role-based access controls, tenant isolation, encryption for sensitive fields, audit logging and retention controls to reduce unnecessary exposure of special category data.

We share personal data only where necessary to operate the Services, with appropriate safeguards. Categories of recipients include:

We may also disclose data where required by law, court order or regulatory authority, or to protect the rights, safety and security of Sponsoro, our customers or others.

We will notify customer organisations of new subprocessors that process personal data on their behalf in accordance with our data processing terms, giving reasonable notice before changes take effect where required.

Some subprocessors may process data outside the United Kingdom depending on project region, infrastructure choices and vendor configuration. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• UK International Data Transfer Agreement (IDTA) or Addendum
• EU Standard Contractual Clauses where applicable
• Transfers to countries with UK adequacy regulations
• Selecting EU/UK regions for database and storage where available

You can request more information about transfers and safeguards by contacting privacy@sponsoro.co.uk.

Account and key personnel data

• Profile and account data: retained for the life of the account and typically up to 6 years thereafter where needed for audit, tax or legal claims alignment
• Session metadata: rolling retention (approximately 12 months) before aggregation or deletion where implemented
• Privacy request records: retained until the request is completed and for the period needed to demonstrate compliance

Worker documents and compliance records

Document retention in Sponsoro follows category-based policies aligned to sponsor record-keeping requirements, including:

Automated deletion may run when enabled by deployment configuration. Legal holds placed by authorised organisation administrators can block deletion while an investigation, dispute or regulatory matter is ongoing.

Audit trail

Hash-chained audit log entries may be retained for statutory minimum periods required for sponsor compliance and may not be automatically deleted when they relate to ongoing legal or regulatory obligations. Erasure requests may be restricted where deletion would conflict with these obligations.

Billing records

Stripe billing events and subscription metadata are retained for the duration of the commercial relationship and as required for accounting and tax law.

We implement technical and organisational measures appropriate to the sensitivity of sponsor compliance data, including:

• Encryption in transit (TLS/HTTPS) and httpOnly session cookies
• Argon2 password hashing; encrypted storage for MFA secrets and sensitive declaration fields
• Mandatory MFA for privileged roles in production environments
• PostgreSQL row-level security for strict tenant isolation between organisations
• Role-based access control (Authorising Officer, Level 1, Level 2, read-only, adviser)
• Email verification before full account access
• Optional Cloudflare Turnstile bot protection on authentication flows
• Rate limiting on authentication, exports and webhooks
• Upload validation (MIME and magic-byte checks) and optional ClamAV malware scanning
• Private object storage for documents (Cloudflare R2) — no public document URLs without authentication
• Hash-chained immutable audit trail for compliance accountability
• Structured logging with personal data redaction; prohibition on logging full passport numbers or document contents
• Webhook signature verification for billing events
• Production environment validation and security testing in our development lifecycle

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately at privacy@sponsoro.co.uk.

Marketing website (sponsoro.co.uk)

The marketing site uses minimal cookies necessary to operate the site. We do not use third-party advertising or cross-site tracking cookies on the marketing site.

Sponsoro application (app.sponsoro.co.uk)

The application uses strictly necessary cookies including:

Cloudflare Turnstile may set additional cookies when bot protection is enabled on sign-in or sign-up pages.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from signing in to Sponsoro.

Sponsoro includes an optional AI Copilot that helps users explore compliance guidance and organisation data. Important points:

• AI outputs are informational and do not constitute immigration advice or a compliance determination on their own
• Compliance decisions remain subject to human review by authorised personnel
• The assistant may respond that it cannot determine an answer when data is insufficient
• Query metadata may be logged for quality and security; full prompts should not contain passport numbers
• When enabled, Anthropic processes completion requests and OpenAI generates embeddings for guidance retrieval

Sponsoro does not make solely automated decisions with legal or similarly significant effects about individuals without human involvement in the compliance workflow.

Customer organisations may invite sponsored workers to the Sponsoro worker portal or send tokenised evidence links. In those cases:

• The customer organisation is the controller of worker personal data
• Workers may be asked to confirm details, upload documents or complete Right to Work actions
• Worker portal access uses a separate authentication cookie (sponsoro_worker_session)
• Evidence pack links may allow document submission without a full account, scoped to a specific token
• Workers should refer to their employer's privacy notice for how their data is used

Our public free tools (including sponsor register lookup, salary checkers, going rate checker, reporting deadline calculator, Right to Work recheck calculator and licence health check) may:

• Process search queries you enter to return results from public Home Office datasets or embedded reference data
• Log standard server metadata for security and performance
• Offer optional email capture for monitoring alerts — only if you choose to provide an email address

Free tool results are informational. They do not replace official Home Office registers, legal advice or your organisation's own compliance assessment.

If Sponsoro is the controller of your personal data, or where you are a key personnel user with data held in your own account profile, you have the following rights (subject to exemptions):

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data via profile settings or by contacting us
• Right to erasure — request deletion where applicable (may be restricted by audit, legal obligation or open compliance matters)
• Right to restrict processing — in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format where applicable
• Right to object — to processing based on legitimate interests, where applicable
• Right to withdraw consent — where processing is based on consent (for example optional communications)

Key personnel users can download a personal data export from Profile → Data & privacy in the application. You can also submit formal access or erasure requests through the same panel. Erasure requests are reviewed by your organisation's data protection contact; automatic deletion may be blocked where conflicts exist (for example active audit logs, legal holds, or ongoing sponsor compliance records).

We respond to valid requests within one month, unless an extension is permitted under UK GDPR.

If you are a sponsored worker and your employer uses Sponsoro, your employer is the data controller. Sponsoro processes your data on their instructions only.

To exercise your privacy rights regarding worker records, contact your employer or their Data Protection Officer directly. The Sponsoro application may provide a contact route to your organisation's DPO, but Sponsoro cannot fulfil worker erasure or access requests without the controller's instruction unless required by law.

Sponsoro is a business-to-business service for organisations sponsoring workers. It is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact privacy@sponsoro.co.uk.

We may update this Privacy Policy from time to time to reflect changes in the Services, legal requirements or subprocessors. We will post the updated policy on this page and update the “Last updated” date. For material changes affecting customer organisations, we will provide notice through the application or by email where appropriate.

If you have concerns about how we handle personal data, contact us first at privacy@sponsoro.co.uk. We will try to resolve your complaint promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113

For privacy enquiries, data subject requests or DPA questions:

• Email: privacy@sponsoro.co.uk
• Website: sponsoro.co.uk
• Application: app.sponsoro.co.uk

For support with using Sponsoro (non-privacy), use the in-app support feature or your account administrator.