Privacy Policy

Compliance Track is a software service that helps UK employers keep records relating to right to work and visa sponsorship compliance. This policy explains how we handle personal data.

For the purposes of this policy, "we", "us" and "our" mean Maxword Ltd, a company registered in England and Wales, which operates this service under the trading name Compliance Track UK. Our address is 118 Downland, Two Mile Ash, MK8 8HW. We are registered with the Information Commissioner's Office under registration number [pending registration].

If you have any question about this policy or about how we handle personal data, you can contact us at admin@compliancetrackuk.com.

This policy covers the personal data we handle through our website at compliancetrackuk.com and through the Compliance Track application. It explains what we collect, why, how long we keep it, who we share it with, and the rights available to the people whose data we hold.

It is important to understand that we handle two different kinds of data in two different roles, set out next, because your rights and the right point of contact depend on which applies.

For data about our customers, we are the controller. When a business signs up to Compliance Track, we decide how we handle the account holder's details, such as their name, business name, email address and billing information. For that data we are the data controller, and this policy explains how we use it.

For data about workers, we are a processor acting for our customer. When a customer records information about their workers in Compliance Track, for example identity documents, visa and immigration details, right to work checks, pay and attendance, the customer decides why that data is held and is the data controller of it. We only hold and process that worker data on the customer's instructions, to provide the service. For that data the customer is responsible as controller, and our handling of it is governed by the Data Processing Agreement between us and that customer. If you are a worker and you want to exercise your rights over your data, the employer who holds your record is the right first point of contact, and we will support them in responding.

Customer account data, where we are the controller. When you create or hold an account we may collect and hold your name, business or organisation name, email address, login credentials, the plan you are on, billing and payment status, and records of your use of the service such as logins and activity.

Worker data, where we act as processor for our customer. On our customers' instructions, the application holds information that customers enter about their workers. This can include a worker's name, date of birth, job title, identity documents such as a passport, immigration and visa status, online right to work share codes and check results, salary and role details, Certificate of Sponsorship details, attendance, and uploaded documents and evidence. This information is sensitive, and we treat it accordingly.

Technical data. When you use the website or application we collect technical information such as your device and browser type, and we keep logs and records of activity, including records of when an administrator accesses an account, for security and to keep the service running.

Where we are the controller of your account data, we use it to provide and administer the service, to manage your account and trial, to take payment, to communicate with you about the service, to keep the service secure, and to meet our own legal obligations. We rely on the following lawful bases under UK data protection law: performance of our contract with you, our legitimate interests in running and securing the service, and compliance with our legal obligations. Where we rely on legitimate interests, we have considered the impact on you and do not use your data in ways you would not reasonably expect.

We do not sell personal data, and we do not use the worker data in customer accounts for our own purposes. We do not serve advertising in the service.

We use a small number of trusted suppliers to run the service. They act as our sub-processors, handle data on our behalf under their own data protection terms, and are not permitted to use it for their own purposes. They are:

• Lovable, which provides the application platform and backend, including the database, authentication and file storage.
• Supabase, which provides the underlying database, authentication and storage infrastructure.
• Stripe, which processes payments. Card details are handled directly by Stripe and are not stored by us.
• Resend, which sends the service's emails, such as reminders and invitations.

We keep a current list of our sub-processors at /sub-processors. We may also share data where we are required to by law, or to establish, exercise or defend legal claims.

Personal data is stored in the United Kingdom and the European Economic Area. Where any data is transferred outside the UK, we rely on an appropriate safeguard recognised under UK data protection law, such as adequacy or standard contractual clauses.

We keep customer account data for as long as the account is active, and for a reasonable period afterwards to meet our legal and accounting obligations, after which it is deleted.

For worker data, retention is decided by our customer as the controller, in line with their own legal duties. Right to work records, for example, are commonly kept for the duration of a worker's employment and for two years afterwards. When a customer ends their use of the service, or instructs us to do so, we delete or return their worker data in accordance with our Data Processing Agreement.

We take the security of personal data seriously, particularly given the sensitive nature of the worker data we hold. Our measures include access controls that keep each customer's data separated from every other customer's, encryption of data in transit and at rest, restricted and logged administrator access, and regular backups. No system can be guaranteed completely secure, but we work to protect data using appropriate technical and organisational measures.

Under UK data protection law you have rights over your personal data, including the right to be informed, to access your data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, and to data portability. To exercise any of these rights in relation to your account data, contact us at admin@compliancetrackuk.com or use our data protection request form.

If you are a worker whose data is held in Compliance Track by your employer, your employer is the controller of that data and is the right first point of contact for a request. We will assist the employer in responding to you.

The website and application use cookies and similar technologies that are strictly necessary to make the service work, such as keeping you signed in and recording your cookie preference. We do not currently set non-essential, analytics, or advertising cookies. If that changes, we will update this policy and ask you to accept or decline those before they are set.

If you have a concern about how we handle your personal data, please contact us first at admin@compliancetrackuk.com or via our data protection request form so we can try to put it right. We acknowledge complaints on receipt and respond within one month. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or by calling 0303 123 1113.

We may update this policy from time to time. When we make a material change we will update the date at the top and, where appropriate, let customers know.

Maxword Ltd, trading as Compliance Track UK
118 Downland, Two Mile Ash, MK8 8HW
admin@compliancetrackuk.com