Privacy policy, UK and EU
This policy applies where the UK GDPR or the EU GDPR governs what we do with your personal data. It sits alongside our Australian and New Zealand policy, which covers the same product under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ).
The two describe the same system and the same handling. They differ because the two sets of law give you different rights and require us to explain different things, and writing one document that satisfied both would have served neither.
- Our application and database are in Australia, and files are held in storage that is not tied to one country. Australia does not have an EU or UK adequacy decision, so we use Standard Contractual Clauses. This is the most important thing on the page and it is not buried.
- For candidate and referee data we are a processor, not a controller. The agency that requested the reference decides what happens to it. We act on their instructions.
- No automated decision-making. Nothing here scores, ranks or recommends. Article 22 does not bite because there is nothing for it to bite on.
- No advertising or analytics cookies, so no consent banner, the two cookies we set are strictly necessary.
- We do not sell personal data and we do not use it to train anybody's model.
Why UK and EU law applies at all
CheckedWell is operated by IHR Group sp. z o.o. (KRS 0000788567, NIP PL8883141067), of ul. Długa 61, 87-800 Włocławek, Poland, a company established in Poland.
That is the whole reason this page exists. Article 3(1) of the GDPR follows the establishment of the controller, not the location of the customer or the data. Because we are established in the EU, the GDPR applies to our processing wherever in the world our customers are, including customers in Australia who may be surprised to read it. Where we offer the service to people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply as well.
Write to us about anything on this page at support@checkedwell.com.
Controller or processor, and why it changes your answer
Most privacy policies skip this. It decides who you should be writing to, so it is near the top rather than in a schedule.
For the people who hold accounts with us: recruiters and agency staff, their names, work contact details, sign-in records and audit trail, and the billing contact for the agency. Also for anyone who writes to us. Here, the decisions are ours and so are the obligations.
For candidates and referees. The agency that requested the reference is the controller: it decided to seek the reference, it chose the questions, it decides who sees the report and how long to keep it. We process on its documented instructions under Article 28, and we do not use that data for any purpose of our own.
So if you are a candidate or a referee, the agency is the right first destination for a request about your data, it holds the context we do not. Come to us anyway if you cannot identify or reach them, and we will either help or tell you plainly that we must refer you on, and why.
What we hold, and on what lawful basis
Name, work email, phone if given, job title. A password stored only as an Argon2id hash, which we cannot read. Two-factor enrolment data. Sign-in times, IP addresses, and a record of what you did.
- Article 6(1)(b), performance of the contract, for the account itself and for billing.
- Article 6(1)(f), our legitimate interests in keeping the service secure and keeping an audit trail that cannot be quietly edited. We have weighed that against your interests; the trail records professional actions taken at work, not private life, and an audit log nobody can tamper with is the thing that protects a recruiter accused of altering a reference as much as it protects us.
- Article 6(1)(c), legal obligation, for the invoices and records we are required to keep.
Candidate name, contact details, the role being checked, the referees nominated, and everything the referees say. Referee name, contact details, employer, job title, relationship to the candidate, their answers including free text, and the date, time and IP address of the submission, recorded so that a reference can be shown to be genuine if it is ever disputed.
The lawful basis is the agency's to choose and to document, not ours to announce on their behalf. In practice it is usually Article 6(1)(f), the legitimate interest of an employer in verifying the account a candidate has given of their own work history.
Special category and criminal offence data
Our question sets do not ask about health, disability, racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, genetic or biometric data, sex life or sexual orientation, the categories in Article 9, and they do not ask about criminal convictions or offences, which Article 10 restricts further still. Agencies writing their own questions should not ask either, and our terms say so.
If a referee volunteers something of that kind anyway, and people occasionally do, it is stored as part of their answer, encrypted like every other answer, and visible only to the agency. We do not index it, act on it or rely on it. Tell us and we will remove it.
Where your data goes, and why that needs a safeguard
The application, the database and its backups are in Australia, and we do not currently offer a European region. Files, meaning finished reports, agency logos and data exports, are held in Laravel Cloud's object storage, which runs on Cloudflare R2 and is not tied to a single country.
Australia has no adequacy decision from the European Commission or from the UK. New Zealand does; Australia does not, which surprises people who assume the two go together. So every transfer of UK or EU personal data to our own infrastructure is a restricted transfer under Chapter V, and it is made under the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved, supported by a transfer risk assessment.
We send through Postmark. Anything in an email, a candidate's name, a referee's name, the invitation link, passes through and is retained there for a limited period. Under Standard Contractual Clauses, and the UK Addendum where it applies.
Card details are typed on Stripe's own payment page and never reach our servers. What returns to us is the card brand, its last four digits, its expiry and a billing contact. This concerns the customer who pays us and nobody else: no candidate and no referee is ever asked for payment details, so none exist to transfer.
Three features send text to Anthropic in the United States, which does not use it to train its models. The help chat for signed-in users sends what the user types, and it needs no candidate details to answer a question. Call-note drafting, only if the agency turns it on, sends the notes a consultant takes on a phone reference so they can be placed into the answer boxes as a draft the consultant then corrects and submits. CV reading in PresentWell sends the CV a consultant uploads so it can be formatted. None of this is kept by us beyond what the consultant chooses to save.
We keep an up-to-date list of these sub-processors and tell customers before we add one, so an agency has the chance to object before it happens rather than after.
Automated decision making, and there is none
Nothing in CheckedWell makes a decision about anybody. No scoring, no ranking, no recommendation to hire or reject, no number a recruiter could mistake for a verdict. The hiring decision is made by a person, on the basis of a reference a human being gave and a human being read. There is therefore no decision based solely on automated processing, and Article 22 is not engaged.
The one place a computer touches what somebody said is the call-note drafting above, and three things constrain it: it only produces a draft a consultant must submit under their own attestation; an answer is discarded, not corrected, if the supporting words do not appear verbatim in the notes or the value is outside the allowed scale; and it is off unless the agency switched it on.
If that ever changes, this section will say so before we ship it.
How long we keep it
Our default is 7 years from the completion of a reference, chosen against Australian employment record-keeping norms. That default is longer than the storage limitation principle will usually justify for UK or EU data, and we would rather say so than let a customer inherit it by accident: each agency can set a shorter period, and a controller in the UK or the EU should.
Account data is kept while the account exists and for as long afterwards as we are required to keep financial records. When an agency deletes its organisation everything goes, references, answers, files and audit records, subject only to backups, which age out on their own cycle.
Your rights
Under the UK and EU GDPR you can ask for:
- Access, a copy of your personal data, Article 15.
- Rectification, Article 16. We will not delete a referee's opinion because a candidate disagrees with it, since that would defeat the point of a reference, but we will record that it is disputed and correct anything factual that is wrong.
- Erasure, Article 17, where one of its grounds applies.
- Restriction, Article 18, including while a dispute about accuracy is being resolved.
- Portability, Article 20, where the basis is consent or contract and the processing is automated.
- Objection, Article 21, where we or an agency rely on legitimate interests.
- Withdrawal of consent, where consent was the basis, without affecting what was done before you withdrew it.
No charge. We answer within one month, extendable by two further months for genuinely complex requests, and we will tell you inside the first month if that happens.
Where we are the processor rather than the controller, candidate and referee data, we will pass your request to the agency without delay and help them answer it. We say this so the referral is not a surprise: it is a division of responsibility the law creates, not one we invented to avoid you.
Complaints
Us first, at support@checkedwell.com, marked “Privacy complaint”. We acknowledge within 30 days and respond without undue delay, which is what the UK's Data (Use and Access) Act 2025 now requires of us. In practice we aim to acknowledge in five working days.
You can also complain to a regulator, and you do not have to come to us first.
- In the UK, the Information Commissioner's Office, ico.org.uk, 0303 123 1113.
- In the EU, the supervisory authority in the country where you live or work, or where you think the problem happened. Our lead supervisory authority is the Urząd Ochrony Danych Osobowych (UODO), Poland , because that is where we are established.
Our UK representative
We have no establishment in the United Kingdom. Until a UK representative is named here, people in the UK should contact us directly at support@checkedwell.com, and we will answer within the same time limits as if you had written to a representative.
Data protection officer, and why we have not appointed one
Article 37 requires a DPO where an organisation's core activity is large-scale regular and systematic monitoring, or large-scale processing of special category data. We do neither: we do not monitor anybody's behaviour, and we deliberately do not collect special category data at all.
So there is no DPO, and we would rather tell you that than list a title nobody holds. Privacy questions go to support@checkedwell.com and reach a person who can answer them. If the service grows into either of those categories, we will appoint one and say so here.
If we suffer a personal data breach
Where we are the controller and a breach is likely to result in a risk to your rights and freedoms, we notify the supervisory authority within 72 hours of becoming aware of it, and we notify you directly without undue delay where the risk is high.
Where we are the processor, we notify the agency without undue delay so that it can meet its own deadline, which is the obligation that actually matters to a customer, because their 72 hours starts when we tell them.
How we protect it
Names, email addresses, phone numbers and free-text answers are encrypted at the column, not just the disk. Two independent mechanisms keep one agency out of another's data. Referee links are stored only as a one-way hash and expire after fourteen days. Passwords are Argon2id. Two-factor is mandatory for owners. The audit log is append-only and cannot be quietly tidied, including by us.
The detail, including what we have not done and what we are not certified against, is on the security page.
Cookies, and why there is no banner
A session cookie to keep you signed in, and a Cloudflare Turnstile cookie on public forms to tell a person from a bot. Both are strictly necessary to provide a service you asked for, which is the exemption that means we do not need your consent and do not show you a banner.
No advertising cookies, no analytics, no third-party trackers, and the fonts on this page are served from our own machines rather than a font network. If that ever changes you will get a real consent banner, with a reject button as easy to find as the accept one.
Changes
If we change this policy in a way that materially affects how we handle personal data, account holders get an email before it takes effect. The date at the top is always the current version.