Privacy Notice

Updated June 2026

PeopleCheck Limited (PeopleCheck) is engaged to provide pre-employment/ engagement and employment/engagement background checking services (the 'Services') for our clients (the 'Clients'). In compliance with relevant privacy laws, the Client is the Data Controller and PeopleCheck is the Data Processor. PeopleCheck processes personal data to undertake the Services on behalf of and in accordance with the instructions of our Clients.

PeopleCheck respects your privacy and is committed to ensure that your personal data is protected. This Privacy Notice explains how your personal data is used by PeopleCheck in undertaking the Services.

This Privacy Notice provides you with information about:

• Our lawful basis for processing your information

• The types of information we process

• The source of the information, if it does not come from you directly

• What we are going to do with your personal information

• Any legitimate interests relied upon

• The categories of people we share your information with

• Whether or not we transfer your information outside the United Kingdom

• How long we will retain your information

• Your rights

PeopleCheck as a Data Processor processing your personal data

Our Clients determine what personal data is collected and processed, and we always act under their instruction as a data processor. For more information about processing activities, please see your prospective employer/company's Privacy Notice.

Purpose and lawful basis

PeopleCheck's purpose for collecting and processing personal data is to carry out background checks on our Clients' candidates and independent consultants/contractors. In accordance with our Clients' instructions, we may also undertake refresher checks on current employees and independent consultants/ contractors.

Our Clients, as data controllers, determine the lawful basis, purpose and reason for data processing. It is our Clients' legitimate interest to verify background information provided by candidates and independent consultants/contractors to enable safe recruitment and employment decisions.

Type and source of information

Your prospective or current employer/company will share your contact information with us so that we can contact you to inform you that we have been engaged to carry out the checks. In some cases, as required by the process, the prospective employer/company may also provide us with a copy of your CV and other relevant documents.

If you consent to the checks and to the processing of your personal information as part of the checks, we may collect the following information from you:

Full name, former names, date of birth, gender, National Insurance Number or country-specific similar ID, nationality (at birth and current), place of birth, current address and address history, telephone number, email address, employment history (including gaps), education and professional qualification history, education certificates, copies of ID documentation such as passport/and or driving licence (and the information contained within them)/visa, proof of current address, other supporting documents as relevant to complete the process (Jobseekers Allowance documents etc.).

We may collect, store, handle, and use personal information about criminal convictions and offences, and court judgments and insolvency notices, as required by the process. This information is obtained from authorised criminal and credit reference agencies such as the Disclosure and Barring Service (DBS), Call Credit/TransUnion, LexisNexis, and Cifas, amongst others. We will also collect verification information from your former employers/companies, recruitment agencies, named referees and places of education. This is for the purposes of completing the required checks.

What we do with it

We will only use your personal data when the law allows us to do so and only for the purposes of conducting the checks required to satisfy the hiring/onboarding process of your prospective employer/company or refresher checks. We need all the categories of information listed above primarily to allow us to perform the required checks and to enable us to comply with the requirements of your prospective employer/company's hiring/onboarding and compliance obligations. We do not use this information for any other purpose.

How long we keep your personal data

PeopleCheck retains your personal data for as long as stipulated within Client contracts. Typically, cases relating to background checking for candidates are retained for 6 or 12 months from the date of completion, unless otherwise requested by the Client.

Who we share your information with

We may disclose information about you to any of our employees as is reasonably necessary to fulfil our obligations for the purposes set out in this Privacy Notice.

Whilst undertaking background checks we may share your data with our sub-processors who we instruct to carry out the Services on our behalf:

• UK and/or international criminality checks

• UK and/or credit checks

• Digital Right to Work and/or identity checks

• Education/Professional qualification verification checks

• Employment/Unemployment verification/reference checks

• International Sanctions, Politically Exposed Persons (PEPs), directorship and adverse media checks

In addition, we may disclose your personal data:

• to the extent that we are required to do so by law

• in connection with any legal proceedings or prospective legal proceedings

• to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention); and

We may transfer your personal data outside the UK, only if specifically required to conduct a check within that country, as required by your prospective employer/company. In the event of a restricted transfer, we will seek to ensure that appropriate safeguards to protect your data are in place which could include entering into standard contractual clauses approved by the Information Commissioner's Office and the European Commission.

The Disclosure & Barring Service mandates that any applicant undergoing a criminality check reads the Privacy Notice for DBS Disclosure Services DBS Disclosure Services Privacy Notice - GOV.UK to understand how DBS will process personal data and the options available for submitting an application.

Data Security

We use third-party cloud server hosting providers to host data in a secure environment within the UK.

We have put in place appropriate and robust security measures to protect your personal data from accidental or unauthorised loss, use, access, alteration or disclosure. Third parties will only process your personal data on our instructions and are required to treat the information confidentially and to keep it secure.

We will securely and permanently destroy your personal data (both hard and electronic versions) in accordance with our data retention policy and applicable laws and regulations.

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Your rights

Under certain circumstances, you may have the right to:

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you updated or corrected.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.

Object to processing of your personal data where we are relying on our legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your personal information to another party.

Right to withdraw consent: Where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent to that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer using the information provided in the 'How to contact us' section. Once we receive your notification, we will stop processing your information for the purposes you originally agreed to.

If you wish to review, verify, correct, or request the erasure of your personal data, object to its processing, or request its transfer to another party, please contact the Data Protection Officer in writing using the information provided in the 'How to contact us' section.

No fee is usually required. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, a reasonable fee may be applied if your request for access is unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. If you make a request, we have one calendar month to respond to you.

We may need specific information from you to help us confirm your identity and verify your right to exercise any of your rights. This security measure ensures that your personal information is only disclosed to you.

Please be aware that the exemptions set out in the Data Protection Act 2018 may apply. This means that we do not have to grant your request in full. We will always meet your request as far as we are able to.

How to contact us

Our Data Protection Officer (DPO) is responsible for ensuring that our business processes and decision making are in line with data protection laws within the UK. Our DPO is: The DPO Centre Limited. If you have any questions about this Privacy Notice or how we handle your personal data, please contact the DPO at dpo@peoplecheck.com

Complaints

If you have any complaints regarding the processing of your personal data, or our compliance with the UK GDPR and Data Protection 2018, please contact the DPO at dpo@peoplecheck.com

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. Their UK contact details are:

• Website: www.ico.org.uk

• Telephone: 0303 123 1113

• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this Privacy Notice

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.