People Group Services Limited Company Number: 11570329

Privacy Policy

Purpose of this Policy 

This Privacy Policy explains how we collect, use, store, and protect personal data processed through our verification services. Our services are used for the verification of identity, right-to-work eligibility, and criminal background checks for individuals seeking employment or engagement within establishments in the United Kingdom. 

 Lawful Basis for Processing 

We process personal data only where lawful under the UK GDPR and the Data Protection Act 2018. Our lawful bases include: 

• Legal obligation – to comply with UK employment verification, immigration and background check requirements. 
• Legitimate interests – ensuring individuals’ identity and eligibility are verified accurately and securely. 
• Contractual necessity – where data is processed under an agreement between People Group Services and its client. 
• Consent – where the individual explicitly agrees to the use of their personal data for verification checks. 

Information We Collect 

We collect only the information necessary to verify a person’s identity and their right to work. This may include: 

• Personal details: full name, date of birth, address history, national insurance number (or equivalent), contact information, photograph. 
• Employment details: employer name, establishment, role applied for. 
• Verification data: verifier details, GPS location and time-stamped records, verification outcome and notes regarding document authenticity. 
• Identification documents including but not limited to: 
• Passports, biometric residence permits, eVisas, national identity cards. 
• UK and overseas driving licences. 
• Birth and adoption certificates. 
• Marriage or civil partnership certificates. 
• Utility bills, bank statements, HMRC letters, P45/P60s. 
• Criminal records certificates, police clearance certificates (UK or overseas). 

All documents are viewed and verified in line with accepted guidelines for right to work and background checks. 

How We Use Personal Data 

Personal data is used solely for the purpose of verifying: 

• The individual’s identity and likeness. 
• The authenticity and validity of identification documents. 
• The individual’s right to work and immigration status in the UK. 
• Criminal background confirmation through appropriate checks. 
  We do not use the data for marketing, profiling for unrelated purposes, or any activity outside the explicit verification purpose. 

Data Storage, Security and Encryption 

All data is processed and stored on secure UK-based servers managed by People Group Services  or its appointed UK data processors. Data will not leave the United Kingdom unless expressly stated in writing to you. 

Security measures include: 

• 256-bit AES encryption for all data at rest. 
• TLS (Transport Layer Security), version 1.3 or higher, for all data transmissions between devices and servers. 
• Role-based access control (RBAC) ensuring only authorised personnel access verification data. 
• Two-factor authentication (2FA) for all administrative users. 
• Time-stamped audit trails logging every verification session, including document views, uploads, and outcomes. 
• Automatic session time-outs and forced log-out after periods of inactivity. 
• Daily encrypted backups retained on isolated UK-based systems. 
• Verification data captured by authorised verifiers is transmitted directly via the platform and is not stored on local devices unless explicitly permitted under contract. 

Retention Periods 

Verification records and associated document metadata will be retained for a minimum of two (2) years from completion of the verification process. After this period, all personal data will be securely destroyed or irreversibly anonymised, unless otherwise required to comply with legal or regulatory obligations. 

Data Sharing and Transfers 

Data may be shared only with: 

• Authorised verifiers operating under the instruction of People Group Services
• Registered employers or agencies that require confirmation of identity, right to work or criminal background. 
• UK government departments and statutory bodies (e.g., immigration authorities, law enforcement) where legally required. 
  We do not share data with third parties for marketing or analytics. If we ever need to store or process data outside the UK, this will only occur with your explicit written consent, and suitable safeguards will be implemented. 

Your Rights 

Under UK GDPR you have the following rights in relation to your personal data: 

• Access – you may obtain a copy of the personal data we hold about you. 
• Rectification – you may request that inaccurate or incomplete data is corrected. 
• Erasure – you may request deletion of your data where we no longer need it or processing is unlawful. 
• Restriction – you may request we limit our processing of your data in certain circumstances. 
• Data portability – you may receive your personal data in a structured, commonly used electronic format and transmit it to another controller where applicable. 
• Objection – you may object to processing based on legitimate interests. 
• Withdrawal of consent – where processing is based on consent, you may withdraw that consent at any time. 

To exercise any of these rights, please contact our Data Protection Officer at compliance@peoplegroupservices.co.uk

  Children and Vulnerable Groups 

Where individuals under the age of 18 or vulnerable adults are subject to verification, we will handle their data with heightened protection, in line with safeguarding obligations and best-practice guidance. 

Data Breach Notification 

In the event of a personal data breach, we will: 

• Notify the Information Commissioner’s Office (ICO) within 72 hours if required. 
• Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms. 
• Maintain a record of all breaches, remedial actions taken, and lessons learned. 

International Data and Overseas Checks

Where verification requires viewing of overseas documents (for example passports, driving licences, or police clearance certificates from abroad), those documents may be submitted for review. However, all copies and verification records will be stored exclusively on UK-based servers, and data will not be transferred overseas without explicit consent and suitable safeguards. 

Data Protection Officer and Contact Details 

Data Protection Officer (DPO): mark.clarke@peoplegroupservices.com 
Contact email: compliance@peoplegroupservices.com
Postal address: People Group House, Three Horseshoes Walk, Warminster, Wilts BA12 8BT

If you believe your data has been mishandled, you may also contact the ICO at: 
Information Commissioner’s Office (ICO) - Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. https://ico.org.uk 

Changes to this Policy 

We may update this Privacy Policy periodically to reflect legal, technical or operational changes. The latest version will always be available on our website. We recommend you review this policy regularly.

Declaration

This Policy is approved by the Board of Directors of: People Group Services Limited Company Number: 11570329

Last updated: 23rd February 2026