Privacy Policy

Scope of This Policy

This Privacy Policy applies to:

1. Visitors to our website
2. Organisations using our platform
3. Users with accounts on the platform
4. Individuals whose personal data is uploaded to the platform by client organisations

3. Data Controller and Data Processor Roles

Depending on how our platform is used:

1. Client organisations are typically the Data Controllers of personal data they upload.
2. Anchor Support Systems Ltd acts as a Data Processor when processing personal data on behalf of client organisations.

For website enquiries, marketing communications, and direct contracts, Anchor Support Systems Ltd acts as a Data Controller.

4. Personal Data We Collect

We may collect and process the following types of personal data:

Website & Enquiries

• Name
• Email address
• Organisation name
• Contact details
• Enquiry content

Platform Use

1. Identification documents
2. Right to work evidence
3. Background check status (e.g. DBS)
4. Training records
5. Compliance-related documentation
6. System usage data
7. Etc.

The exact data processed depends on how client organisations configure and use the platform.

5. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases:

1. Performance of a contract
2. Legitimate interests
3. Legal obligations
4. Consent (where applicable)

Client organisations are responsible for identifying the lawful basis for data they upload to the platform.

6. How We Use Personal Data

We use personal data to:

1. Provide and operate the platform
2. Maintain system security and performance
3. Respond to enquiries and support requests
4. Improve platform functionality
5. Meet legal and regulatory obligations

We do not sell personal data to third parties.

7. Data Storage & Security

We take appropriate technical and organisational measures to protect personal data, including:

1. Secure cloud infrastructure
2. Encrypted data transmission
3. Role-based access controls
4. Restricted access to sensitive information

Data is stored within the UK.

8. Data Retention

Personal data is retained only for as long as necessary:

1. To fulfil contractual obligations
2. To meet legal or regulatory requirements
3. As instructed by client organisations

Client organisations control retention periods for data they upload.

9. Data Sharing

We may share personal data with:

• Trusted service providers (e.g. hosting, security, email services)
• Legal or regulatory authorities where required by law

All third-party processors are required to meet appropriate data protection standards.

10. Individual Rights

Under UK GDPR, individuals have rights including:

1. Right to access
2. Right to rectification
3. Right to erasure
4. Right to restrict processing
5. Right to data portability
6. Right to object

Requests relating to platform data should usually be directed to the relevant client organisation (the Data Controller).

Requests relating to our website or direct services can be sent to us.

11. Cookies

Our website may use cookies and similar technologies to improve user experience and analyse site usage.

You can manage cookie preferences through your browser settings.

A separate Cookie Policy may apply.

12. International Transfers

If personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

1. Adequacy decisions
2. Standard contractual clauses

13. Changes to This Policy

We may update this Privacy Policy from time to time.

The latest version will always be available on our website.