Data Processing Agreement

This Data Processing Agreement forms part of our Terms of Service. Questions about it can be sent to dataprotection@ukrtwchecker.co.uk.

Parties and background

This Data Processing Agreement (DPA) is between:

1. UK Right to Work Share Code API Ltd, a company registered in England and Wales under company number 15954783, whose registered office is at 8 Oakland Court, Cearns Road, Prenton, CH43 1XH, and which trades as "UK Share Code API" (the Supplier); and
2. the customer that has accepted the Supplier's Terms of Service (the Customer).

The Supplier provides an application programming interface that verifies UK right to work, right to rent and immigration status share codes against the GOV.UK online checking services (the Services). In providing the Services, the Supplier processes personal data on the Customer's behalf.

This DPA forms part of, and is incorporated into, the Supplier's Terms of Service (the Agreement). It applies whenever the Supplier processes Customer Personal Data in providing the Services, and takes effect on the date the Customer first accepts the Agreement or, if later, the date this DPA is published.

Supplier data protection contact: dataprotection@ukrtwchecker.co.uk. ICO registration reference: ZB918945.

1. Definitions and interpretation

1.1 In this DPA:

• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other law relating to the processing of personal data that applies in the United Kingdom, each as amended or replaced from time to time.
• UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
• Customer Personal Data means personal data submitted to, or generated by, the Services that the Supplier processes on behalf of the Customer, as described in Schedule 1.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor means any third party engaged by the Supplier to process Customer Personal Data.
• Restricted Transfer means a transfer of Customer Personal Data to a country outside the United Kingdom that is not covered by UK adequacy regulations.
• controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the UK GDPR.

1.2 If there is any conflict between this DPA and the rest of the Agreement in relation to the processing of Customer Personal Data, this DPA prevails.

2. Roles and scope of processing

2.1 For Customer Personal Data, the Customer is the controller and the Supplier is the processor. Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.2 The Supplier acts as an independent controller of personal data relating to the Customer's own account users and contacts (for example, names and email addresses of the Customer's staff, and billing information), which it processes to administer the account, take payment, provide support and send service communications. That processing is governed by the Supplier's Privacy Policy, not by this DPA.

2.3 The Customer is responsible for:

1. having a lawful basis for the processing and for submitting Customer Personal Data to the Services;
2. providing any privacy information required by Data Protection Laws to the data subjects, including candidates and tenants;
3. the accuracy of the Customer Personal Data it submits;
4. its own compliance with right to work, right to rent and immigration legislation and Home Office guidance, including deciding whether a check has been carried out correctly and keeping its own records of each check; and
5. ensuring its instructions comply with Data Protection Laws.

2.4 The Services are a tool to assist the Customer in carrying out checks. The Supplier does not decide whether a person has the right to work or rent, and does not retain check results or documents on the Customer's behalf for record-keeping purposes.

3. Processor obligations

3.1 The Supplier will:

1. process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless required to do so by UK law, in which case the Supplier will inform the Customer of that legal requirement before processing unless the law prohibits this;
2. ensure that anyone it authorises to process Customer Personal Data is bound by an appropriate duty of confidentiality;
3. not sell Customer Personal Data or use it for its own purposes, other than as necessary to provide, secure, maintain and support the Services, prevent abuse, and meet its legal obligations; and
4. promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Laws. The Supplier is not obliged to carry out a legal review of the Customer's instructions.

3.2 The Customer's documented instructions are set out in the Agreement and this DPA, and are given through the Customer's configuration and use of the Services. Any further instruction must be agreed in writing and is subject to any applicable charges.

3.3 The Supplier may create and use aggregated or anonymised data (which is not personal data) derived from use of the Services, such as usage volumes and error rates, to operate, bill for and improve the Services.

4. Sub-processors

4.1 The Customer gives general written authorisation for the Supplier to engage Sub-processors. The Sub-processors in place at the date of this DPA are listed in Schedule 3, which the Supplier will keep up to date on its website.

4.2 The Supplier will give the Customer at least 14 days' notice of any intended addition or replacement of a Sub-processor, by updating Schedule 3 and notifying the Customer by email or within the Services. The Customer may object on reasonable data protection grounds within that notice period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected Services by written notice as its sole remedy, without penalty, and will receive a pro rata refund of any prepaid fees for the unused period.

4.3 The Supplier will:

1. carry out reasonable due diligence on each Sub-processor before engaging it;
2. impose on each Sub-processor, by written contract, data protection obligations that are substantially the same as, and no less protective than, those in this DPA, to the extent applicable to the service provided; and
3. remain liable to the Customer for the performance of each Sub-processor's obligations, subject to clause 11.

4.4 Where the Supplier engages a Sub-processor that provides services on its own standard terms (for example, a large hosting or infrastructure provider), the Customer agrees that those standard terms satisfy clause 4.3(2) where they meet the requirements of Article 28(3) UK GDPR.

5. Security

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, the Supplier will implement appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 UK GDPR. The measures in place at the date of this DPA are described in Schedule 2.

5.2 The Supplier may update those measures from time to time, provided the updates do not materially reduce the overall level of protection.

5.3 The Customer is responsible for the security of its own systems and accounts, including keeping its API keys confidential, restricting access to them, and rotating them if it suspects they have been compromised. The Customer is also responsible for the security of results and documents once the Services have returned them to the Customer.

6. Personal data breaches

6.1 The Supplier will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach.

6.2 The notification will, to the extent the information is then available, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not yet available, the Supplier will provide it in phases as it becomes available.

6.3 The Supplier will take reasonable steps to contain, investigate and mitigate the breach, and will provide reasonable assistance to enable the Customer to meet its own obligations to notify the ICO and data subjects.

6.4 The Customer is responsible for deciding whether to notify the ICO or any data subject. The Supplier will not notify them on the Customer's behalf unless the Customer instructs it to or the law requires it.

6.5 Notification of, or response to, a Personal Data Breach is not an acknowledgement by the Supplier of any fault or liability.

7. Data subject rights and assistance

7.1 Taking into account the nature of the processing, the Supplier will provide reasonable assistance to the Customer, by appropriate technical and organisational measures where possible, in responding to requests from data subjects exercising their rights under Data Protection Laws.

7.2 If the Supplier receives a request directly from a data subject relating to Customer Personal Data, it will, where it can identify the Customer, forward the request to the Customer promptly and will not respond to it except to tell the data subject to contact the Customer.

7.3 Because the Services do not retain submitted data or check results, the Supplier will usually hold no Customer Personal Data relevant to a request, other than any error-monitoring events still within their 30-day retention period.

7.4 Taking into account the nature of the processing and the information available to it, the Supplier will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with the ICO, where these relate to the Services.

7.5 The Supplier may charge a reasonable fee for assistance under this clause that goes beyond what is reasonably necessary, or that results from the Customer's own act or omission.

8. International transfers

8.1 The Supplier's application hosting is located in the United Kingdom (London) and its error-monitoring data is stored in the European Union (Frankfurt, Germany), which is covered by UK adequacy regulations.

8.2 Some Sub-processors are headquartered outside the United Kingdom and may access or process Customer Personal Data from outside it, for example for support or maintenance. The Supplier will not make, or permit a Sub-processor to make, a Restricted Transfer unless it is protected by an appropriate safeguard under Data Protection Laws, such as:

1. UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified;
2. the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU Standard Contractual Clauses; or
3. another mechanism permitted by Data Protection Laws.

8.3 Where a Sub-processor's standard data processing terms provide such a safeguard, the Customer agrees that the Supplier may rely on it.

9. Audits and information

9.1 On reasonable written request, the Supplier will make available to the Customer the information reasonably necessary to demonstrate its compliance with Article 28 UK GDPR and this DPA. The Supplier will normally do this by completing a security or data protection questionnaire and providing relevant documentation.

9.2 The Customer may request a questionnaire under clause 9.1 no more than once in any 12-month period, unless a Personal Data Breach has occurred or the ICO requires it.

9.3 An on-site audit or inspection is available only where the information provided under clause 9.1 is reasonably insufficient to demonstrate compliance, or where the ICO or Data Protection Laws require it. Any such audit must:

1. be agreed in advance, with at least 30 days' written notice;
2. take place during normal business hours and without unreasonable disruption to the Supplier's business;
3. be carried out by the Customer or an independent auditor bound by confidentiality obligations, who is not a competitor of the Supplier; and
4. be at the Customer's cost, including the Supplier's reasonable time and expenses.

9.4 Audits do not extend to the Supplier's Sub-processors. The Supplier will instead provide any relevant certifications or reports that a Sub-processor makes available to it, where it is permitted to do so.

9.5 All information provided under this clause is the Supplier's confidential information.

10. Return and deletion

10.1 The Services are designed not to retain Customer Personal Data. Submitted data, check results and documents are returned to the Customer in the API response and are not stored by the Supplier afterwards. The Customer is responsible for retrieving and keeping its own copy of each result.

10.2 Any Customer Personal Data held in error-monitoring events or logs is deleted automatically in line with the retention periods in Schedule 1.

10.3 On termination of the Agreement, the Supplier will not be required to return Customer Personal Data, as it is not retained. Any remaining Customer Personal Data will be deleted in line with clause 10.2. The Supplier may retain data where UK law requires it, in which case clause 3.1(2) and clause 5 will continue to apply to it.

11. Liability, term and governing law

11.1 Each party's liability arising out of or in connection with this DPA, whether in contract, tort (including negligence) or otherwise, is subject to the limitations and exclusions of liability in the Agreement, and counts towards the same aggregate cap. Nothing in this DPA limits either party's liability where it cannot be limited by law.

11.2 This DPA remains in force for as long as the Supplier processes Customer Personal Data on the Customer's behalf, and survives termination of the Agreement until that processing ends.

11.3 The Supplier may update this DPA from time to time, for example to reflect changes in Data Protection Laws, ICO guidance or the Services. Changes that materially reduce the protection given to Customer Personal Data will be notified to the Customer at least 30 days in advance. Continued use of the Services after a change takes effect constitutes acceptance of it.

11.4 If any provision of this DPA is found to be invalid or unenforceable, the rest of the DPA remains in effect.

11.5 This DPA and any dispute or claim arising out of or in connection with it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Schedule 1 – Details of processing

Schedule 2 – Technical and organisational measures

Schedule 3 – Authorised sub-processors

Sub-processors that process Customer Personal Data:

Other service providers, which process only the Customer's own account and billing data (not Customer Personal Data) and are listed for transparency:

Last updated: 8 November 2026.