Privacy Policy

1. Who we are

SponsorGuard is a compliance tool and a product of CortexLabs ("SponsorGuard", "we", "us"). SponsorGuard helps UK sponsor licence holders and their advisers track compliance duties, manage evidence, and prepare for audit. Our company registration and ICO data-protection registration details will be added here once incorporation is complete.

Depending on the relationship, we act as a data processor on behalf of the sponsoring organisation (our customer, who is the controller of their sponsored workers' data), and as a data controller for the account-holder and billing data we collect to provide the service. The customer organisation determines the purposes and means of processing sponsored-worker records held in their workspace.

SponsorGuard is a compliance and record-keeping tool. It is not a law firm and does not provide immigration legal advice, choose visa routes, or submit reports to the Home Office on your behalf.

2. What personal data we process

To deliver sponsor-compliance workflows we process the following categories of personal data, much of which relates to sponsored workers and is sensitive:

• Identity and contact data — name, date of birth, nationality, home address, personal email, phone number.
• Immigration data — passport number and expiry, visa type and dates, eVisa status, share codes, right-to-work evidence, Certificate of Sponsorship (CoS) details, National Insurance number.
• Employment and pay data — job title, SOC code, salary and hourly rate, weekly hours, work location, line manager, start date.
• Compliance evidence — DBS details, recruitment/genuine-vacancy notes, uploaded documents, absence records, and audit-pack contents.
• Account and billing data — account user names, email addresses, authentication factors (including MFA enrolment), workspace/role membership, and subscription/billing metadata.
• Technical data — session and security cookies, IP address, and basic request logs needed to operate and secure the service.

3. Why we process it and our lawful bases

We process personal data to provide the SponsorGuard service: maintaining a compliance record, tracking deadlines and reminders, managing evidence, preparing audit packs, and providing AI-assisted extraction that is routed for authorised human review.

Lawful bases under UK GDPR Article 6 include: (a) legitimate interests of the sponsoring organisation in meeting its sponsor-licence duties and operating its compliance programme; (b) contract, where processing is necessary to provide the service to our customer or account holder; and (c) legal obligation, where the sponsor must retain records to comply with Home Office sponsor duties. Where special-category or criminal-offence data (e.g. DBS information) is processed, the customer relies on the relevant Article 9/10 condition (such as employment, social security and social protection law).

4. Data subjects

The personal data we process relates to: (a) sponsored workers and prospective workers recorded by a customer organisation; and (b) account users — the employer, HR, and adviser staff who use SponsorGuard.

5. Retention

Sponsored-worker records are retained for as long as the customer's workspace requires them and in line with the sponsor's own retention obligations (UK sponsor-licence duties generally require certain records to be kept for the duration of sponsorship and for a defined period afterwards). The customer organisation controls retention within its workspace, including erasure of individual worker records.

Account and billing data is retained for the life of the account and for a reasonable period afterwards to meet legal, tax, and audit requirements, then deleted or anonymised.

6. Sub-processors

We use a limited set of vetted sub-processors to deliver the service. Each is bound by data-processing terms and processes data only on our instructions:

• Cloudflare R2 — encrypted object storage for uploaded evidence documents.
• Anthropic — AI-assisted extraction and compliance guidance. AI outputs are routed for authorised human review and are not used to make automated decisions about individuals.
• Our transactional email provider — sending account, verification, and notification emails.
• Our cloud hosting and database infrastructure provider — running the application and storing structured records.

7. International transfers

Where a sub-processor processes personal data outside the UK, we rely on an appropriate transfer mechanism — such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — together with appropriate technical and organisational safeguards. We will provide details of the specific safeguards on request.

8. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption of documents at rest in object storage, encryption in transit (HTTPS/TLS with HSTS), multi-factor authentication for accounts, role-based access controls, CSRF protection, strict HTTP security headers, and audit logging of sensitive actions. No system is perfectly secure, but we work to protect data against unauthorised access, loss, and misuse.

9. Your data-subject rights

Subject to UK GDPR, individuals have the right to: access their personal data; have inaccurate data rectified; have data erased (the "right to be forgotten"); restrict or object to processing; and data portability. SponsorGuard supports erasure of an individual worker's personal data within a workspace (anonymisation leaving a compliance tombstone and audit trail).

Because sponsored-worker data is controlled by the sponsoring organisation, requests about a worker's data should normally be made to that organisation (the controller). We will assist our customers in responding to such requests. Account users can exercise their own rights by contacting us directly.

10. How to exercise your rights and contact us

To make a data-subject request, ask a question about this policy, or raise a concern, contact us via the details on our Contact page. If you are a sponsored worker, please also contact your sponsoring employer, who controls your record. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.