Skip to content
SponsorFort

Pre-launch versions. These documents are being finalised with professional legal review, and the operating company's registered details will be published before any payment is taken. No charges apply while this notice is shown. Questions: privacy@sponsorfort.com.

Data processing agreement

Last updated: 6 July 2026 · This DPA forms part of the terms of service for every customer and satisfies Article 28 UK GDPR. It applies for as long as we process personal data on your behalf and prevails over the terms in any conflict about personal data.

1. Roles

The customer is the controller of personal data entered into SponsorFort (worker records, documents, right-to-work checks, events). SponsorFort is the processor. For account, billing and website data, SponsorFort is an independent controller — see the privacy policy.

2. Details of processing

  • Subject matter and duration: provision of the SponsorFort service for the subscription term, plus the 90-day export window, plus the 7-day deletion grace period.
  • Nature and purpose: storage, organisation, deadline computation, document handling, reminder delivery and reporting support for sponsor-licence compliance.
  • Data subjects: the customer's employees, workers, candidates and team members.
  • Categories of data: identity and contact details; employment terms (role, salary, hours, location); immigration document references (passport, visa, CoS, share codes); absence records; uploaded documents; check histories. Immigration documentation may reveal nationality; the customer is responsible for its lawful basis, transparency to its workers, and the accuracy of what it enters.

3. Our obligations as processor (Art. 28(3))

  • (a) Instructions: we process only on your documented instructions — namely, operating the features of the service as you and your users direct — including as regards international transfers, unless UK law requires otherwise (in which case we tell you first, unless that law prevents it). We will inform you if, in our opinion, an instruction infringes UK data protection law.
  • (b) Confidentiality: anyone we authorise to process the data is bound by confidentiality obligations.
  • (c) Security (Art. 32): appropriate technical and organisational measures, including: UK data residency (London region); encryption in transit (TLS) and at rest; per-organisation row-level isolation enforced in the database; role-based access; time-limited signed URLs for documents; append-only audit logging; rate limiting; least-privilege credentials; tested backups.
  • (d) Sub-processors: you give general written authorisation for the sub-processors listed in the privacy policy (Supabase, Vercel, Stripe, Resend, PostHog, Sentry, and Anthropic only where you enable AI drafting). We will give at least 30 days' notice before adding or replacing any sub-processor; you may object on reasonable data-protection grounds, and if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund of prepaid fees. We impose data-protection obligations on every sub-processor equivalent to this DPA and remain liable for their performance.
  • (e) Data-subject rights: taking into account the nature of the processing, we assist you with appropriate technical and organisational measures to respond to data-subject requests. If a data subject contacts us directly we will not respond substantively (beyond directing them to you) unless you instruct us, and will notify you within 3 working days.
  • (f) Breach and assistance: we notify you without undue delay after becoming aware of a personal-data breach affecting your data, providing (as it becomes available) the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken — sufficient to support your obligations under Articles 33–34. We assist you, where required, with security, breach-notification and data-protection impact assessments (Arts. 32–36).
  • (g) Return and deletion: at the end of the service you may export all data (self-serve, any time). After the 90-day export window we delete personal data and existing copies, except where UK law requires retention (e.g. billing records). Written certification of deletion is available on request.
  • (h) Audits: we make available the information reasonably necessary to demonstrate compliance with Article 28 and allow audits (including inspections) by you or your mandated auditor: no more than once per 12 months, on 30 days' notice, during business hours, without access to other customers' data, each party bearing its own costs. Written security summaries and available third-party attestations satisfy audit requests where reasonable.

4. International transfers

Application data is stored in the UK. Where a sub-processor processes limited personal data outside the UK, the transfer is protected by a UK adequacy regulation or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, as applicable.

5. Liability and precedence

The liability provisions of the terms of service (section 12) apply to this DPA. Nothing in this DPA limits either party's liability to data subjects or regulators where the law does not permit it. If this DPA conflicts with the terms regarding personal data, this DPA prevails.