SkillProof Personal privacy notice

OneProof Ltd, trading as SkillProof, is the controller for the Personal service purposes described here. Our registered office is 124 City Road, London, EC1V 2NX, United Kingdom. Contact [email protected] about privacy, a data-rights request, consent withdrawal or a complaint.

A Personal account is separate from an employer's workspace. An employer does not receive access merely because it uses SkillProof. If you share information with an employer, it is responsible for its own subsequent purposes and the lawful basis and conditions for its use.

For records in an employer-controlled team workspace we may act as that organisation's processor. That different arrangement does not make the employer controller of your Personal account.

We use the following categories where relevant to your use of the service:

• Account information: name, email address, authentication information, optional profession and account status.
• Your records: professional registrations and checks, numbers and dates, training and certificates, CPD, hours, reflections, documents, attachments, changes and retained history.
• Reminder information: dates, settings, messages and delivery-related records.
• Sharing information: selected content, link identifiers, expiry, PIN protection and revocation.
• Viewer and security information: event time, keyed-hash IP information used in application access logs, browser user agent, PIN attempts, page access and PDF-download events, and relevant technical and security records.
• Billing information: chosen plan, billing information needed for the transaction, payment status, invoices, credits, refunds and payment-provider references.
• Choices and evidence: terms acceptance, early-start requests, privacy and marketing choices, any required DBS tracker consents, wording versions, times and withdrawal records.
• Support and complaints: correspondence, identity checks necessary to deal with a request and the steps taken.
• Sign-up protection: security signals used by Cloudflare Turnstile, including relevant IP and browser information.

Technical providers can receive raw connection information in providing their services even where application logs use a keyed hash. Such hashing reduces direct identification but does not make all associated information anonymous. We do not ask share-link viewers to provide their names.

We receive account and record information from you, technical information from use of the service and transaction and status information from our providers. Avoid including another person's personal information in your records.

We use a basis only to the extent its legal conditions are met. In particular, describing something in terms does not make it necessary for the contract. For legitimate interests we assess the purpose, necessity and balance against people's interests and rights. Security and product improvement are not blanket exemptions from data-protection law.

Account information is necessary to provide an account. A paid plan needs the billing information required to process it. Optional profession, DBS tracker details, uploaded files, sharing and marketing choices are not required to create an ordinary Personal account. Without a particular optional item we cannot provide the function that depends on it, but that does not prevent use of unrelated functions.

Personal is a professional-record organiser. It does not support health records, vaccination or occupational-health files, DBS certificates or criminal-record results. Do not add that content in an attachment, import, photograph, note or reflection. A result showing no convictions is still criminal-record information. Ordinary training about a health-related subject is different from information about a person's own health.

The designated DBS tracker can keep your certificate number and relevant dates. It does not perform a check, retrieve a result or certify that you are cleared for work. A link to the official service does not itself transfer its records into Personal.

DBS tracker details are personal data. Where their context makes them criminal-offence data, our UK basis for optional tracking is your consent under Article 6(1)(a), with the consent condition in Schedule 1 paragraph 29 of the Data Protection Act 2018 for Article 10 processing. A required tracking choice must be specific to this purpose. The corresponding optional disclosure needs its own sharing choice. Agreement to the terms or permission for an employer to use the DBS service does not supply these choices.

You can decline optional DBS tracking or sharing and still use unrelated Personal functions. You can stop sharing the tracker without deleting the private tracker, or withdraw tracking consent by deleting its details or contacting [email protected]. We stop future processing that depends on withdrawn consent and remove the relevant live and retained content without undue delay, subject to a particular lawful exception that we explain. We do not change legal basis merely to override withdrawal. Saved recipient copies cannot be recalled. Backup and minimal accountability-record treatment are explained below.

Do not send excluded files to support. If excluded information reaches us accidentally, contact [email protected] without attaching another copy. We restrict access and arrange appropriate removal or correction, considering any specific legal duties and necessary incident evidence. A user warning is not a guarantee that every mislabelled file will be detected.

The UK consent condition is not represented as the law of Jersey, Guernsey or the Isle of Man. We must establish the applicable local conditions before offering affected processing there.

We disclose information only to the extent needed for the relevant purpose and subject to the applicable legal requirements.

The service-provider functions disclosed for Personal are:

Public website activity is separate from the records in your Personal account. The published website disclosures also identify Web3Forms for public enquiries, Google Analytics and Google Ads for optional measurement, and Microsoft Clarity and Contentsquare for public-site behaviour analysis. The website privacy notice and Cookie Policy explain those public functions and choices. Those disclosures do not give permission to analyse or disclose private Personal records for website advertising. A public enquiry is processed to respond to your request; an optional website measurement choice is separate from a Personal marketing-email choice.

For processing performed on our behalf, we require the appropriate processor terms, confidentiality, security and assistance with rights and deletion. A provider can have separate controller purposes for some activities. Stripe, for example, may process payment information for its own fraud-prevention, regulatory and legal purposes under its own privacy notice. This notice does not describe all providers as processors for every purpose.

People holding a link you create can receive the content it permits, subject to its expiry and PIN where set. A recipient may save or forward information. We cannot recall copies it already holds.

We may disclose necessary information to professional advisers, authorities or other recipients for a legal obligation, a properly assessed lawful legal-claims or protective purpose, or a permitted business transaction. We do not treat a possible business sale as permission for unrestricted access to records. Any disclosure must be limited and the applicable notice, basis, sensitive-data and transfer requirements addressed.

We do not sell your records. An employer, agency or regulator does not receive them merely because it is interested in your work.

Personal information may be processed or accessed outside the United Kingdom through a relevant provider or a recipient to whom you choose to disclose it. A billing-address restriction does not control where a link is opened.

Where a disclosure is a restricted international transfer under UK law, it requires an applicable adequacy route, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or a valid legal exception. Where required, we assess the protection under the applicable data-protection test. Selecting a provider does not by itself establish that the necessary safeguards exist.

You can ask [email protected] for information about the recipients and countries relevant to your data and for a copy of applicable safeguards, with legitimate confidential details protected. Information sent directly to you about yourself is not automatically a restricted transfer to another controller, although it must still be sent securely.

The UK transfer framework does not displace any additional local requirements that apply to island data. This notice makes no promise that all processing or storage is in the UK.

We must use technical and organisational measures appropriate to the nature and risks of processing. This includes limiting access to a legitimate need, protecting data in transmission and storage as appropriate, maintaining service resilience and assessing the effectiveness of safeguards.

A share link is a bearer link. A PIN and expiry reduce some risks but do not identify the recipient or prevent a person saving information. We cannot guarantee that a recipient will keep a forwarded copy secure.

If you believe an account or link has been misused, contact [email protected]. We will investigate and take appropriate action, including notification where the law requires it. We do not claim a particular security certification or an absolute guarantee against incidents in this notice.

We keep identifiable information only for as long as needed for its stated purposes or a justified legal requirement. Retention depends on the record, the account's status, whether you request deletion, any unresolved transaction or complaint and relevant legal duties or claims.

The recovery window is not a mandatory waiting period for erasure. Tell us if you want earlier deletion. We will explain any material that cannot lawfully be erased immediately and the reason. We do not promise that closing an account instantly removes every provider record or backup.

You can ask to access and correct your personal data. Where the legal conditions apply, you can also ask for erasure, restriction, portability and object to processing.

If we rely on legitimate interests, you can object on grounds relating to your situation. If information is used for direct marketing, you have the right to stop that use. Where we rely on consent you can withdraw it at any time using the relevant controls or [email protected].

The account download helps you obtain your records. It is not the only way to make a rights request and is not represented as containing every item that might be covered by an access request. Portability and access have different scopes.

We respond without undue delay and normally within one month. If a lawful extension, necessary identity information or a legally permitted clarification changes the timing, we will explain it and any applicable deadline. We will not ask you to provide unnecessary identification or force you to narrow an access request. Where we cannot comply fully, we will explain the relevant reason and complaint options.

You do not have to close an account, pay for a plan or use a special form to exercise a right.

The shared Cookie Policy describes the public website's analytics and marketing-measurement choices, including the Cookie preferences control. Website choices are separate from account authentication and private record processing.

The service can use storage or access technologies needed to authenticate you, maintain a requested session, protect the service or operate a PIN-protected link. The legal test depends on the actual purpose; calling something “security” does not automatically make every use necessary.

Where optional technologies require consent, we will give you clear information and a choice before the relevant use, and provide a way to change that choice. If a narrow statutory exception instead permits particular statistical or appearance functions without consent, its information, purpose and objection requirements still apply. It is not blanket permission for profiling or advertising.

Marketing consent, DBS tracker consent and device-storage and access choices are separate matters. A privacy-notice acknowledgement does not provide all of those consents.

We use your contact details for messages necessary for your account, records, payments, contractual information and legal obligations. Those messages are separate from optional product-news marketing.

We send Personal product-news marketing only if you choose to receive it. You can unsubscribe at any time using the message's unsubscribe route or by contacting [email protected]. Withdrawing marketing consent does not stop necessary account or legal messages.

We retain a minimal suppression record to respect an opt-out. We do not use acceptance of these terms, an early-start request or a DBS tracker choice as marketing consent.

Personal records and trackers present information entered by you and calculations based on it. They do not amount to a decision by SkillProof that you are fit to practise, employable or professionally compliant.

An employer or regulator makes its own decisions and must meet its own legal obligations. This notice does not authorise a new use of your records for significant automated decisions or an unrelated purpose without the information, basis and safeguards that would be required.

Personal is offered only to people aged 18 or over. That eligibility restriction does not remove our obligations if we become aware that children's personal data has been processed. Contact [email protected] if you believe a child has an account or their information has been included.

You can raise a privacy complaint at [email protected] or our postal address. We facilitate complaints without requiring a particular form, acknowledge them within 30 days and take appropriate steps without undue delay to investigate, keep you informed and tell you the outcome.

You can complain to the UK data-protection regulator through the ICO website. You can also use a competent local regulator where the applicable law gives you that right:

• Jersey: Jersey Office of the Information Commissioner.
• Bailiwick of Guernsey: Office of the Data Protection Authority.
• Isle of Man: Isle of Man Information Commissioner.

Contacting us does not remove a right to seek regulatory assistance or a court remedy. Which local law or regulator can deal with a particular matter depends on its legal scope.

We will keep this notice accurate and make material changes available before a relevant new processing purpose begins. Where a change needs consent, a notice alone does not supply it. Earlier processing is assessed against the information and law applicable at the time.