Privacy notice
Version of 17 October 2026
This notice explains how Data Solutionz Limited (company no. 14984453, registered in England and Wales) handles personal data in Sponsorwyn. We have two different roles, and they are explained separately below.
1. Summary
- Records your company keeps in Sponsorwyn (employees' details, right-to-work evidence, absence, pay and documents): your company is the controller and decides why and how that data is used. We are its processor (section 3).
- Information about the people who use Sponsorwyn (your name, email, sign-in history and, for the authorising officer, billing contact): we are the controller (section 2).
- Data is stored in the UK. We do not sell personal data or use it for advertising.
2. People who use Sponsorwyn — we are the controller
What we collect
- Your email address, and the role your company gives you.
- Sign-in records (when sign-in links were requested and used), and a log of the changes you make, which is shown to your company's authorising officer.
- For the person who subscribes: billing name, address and the payment status Stripe reports to us.
- Messages you send us.
Why, and on what lawful basis
- To provide the service your company signed up for, sign you in and keep it secure — performance of our contract with your company and our legitimate interest in running a secure service.
- To send you sign-in links, invitations, deadline alerts and account notices — the same bases. These are service emails, not marketing.
- To take payment and keep accounting records — contract and legal obligation.
How long we keep it
While your account is active, and for 90 days after it closes. Billing records are kept for six years as UK tax law requires. Sign-in request logs are kept for 30 days.
3. Your company's records — we are the processor
When your company uses Sponsorwyn, it instructs us to store and process its records. For that data we commit to the following (UK GDPR Article 28):
- We process it only to provide Sponsorwyn and on your company's documented instructions — these terms, and what your users do in the app.
- Everyone at Data Solutionz who can access it is bound by confidentiality. By default we see only counts (how many people and documents a company has), not the records. We open a company's records only when it asks us for help; that access is read-only, limited to at most 24 hours, needs a written reason, and is recorded in that company's own activity log.
- Each company's data is separated by security rules in the database itself. Evidence such as right-to-work checks cannot be edited or deleted once recorded, and every change is logged.
- Data is encrypted in transit and at rest. Documents are stored privately and opened through links that expire after 10 minutes.
- We use the sub-processors listed below. We will tell authorising officers before adding a new one, so they can object.
- We will help your company respond to requests from employees exercising their rights, and with data-protection impact assessments, where the information is in Sponsorwyn.
- We will tell the authorising officer without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your company's records.
- When your company closes its account, we delete its records after 90 days (backups within a further 12 weeks), and you can export everything first.
- We will make available the information needed to show we meet these commitments.
Employees whose details are held by their employer in Sponsorwyn should contact that employer first about their data; the employer's own privacy notice applies. We will pass on any request we receive.
4. Who else handles data (sub-processors)
| Provider | What for | Where, and safeguards |
|---|---|---|
| Supabase | Database, file storage and sign-in accounts | UK (London). Supabase Inc. is a US company; access by its staff is covered by the UK International Data Transfer Addendum / UK–US Data Bridge. |
| Vercel | Runs the Sponsorwyn application | Application servers in London; Vercel Inc. is a US company (UK–US Data Bridge / standard contractual clauses with UK Addendum). |
| Resend | Sends sign-in links, invitations and alerts | EU (Ireland). Emails contain names of companies and the items due, not employee documents. |
| Stripe | Takes subscription payments | Stripe Payments Europe / Stripe Inc. Card details go to Stripe directly; we never see or store them. |
| Anthropic | Answers questions in the optional Guide | US. Only used when someone at your company asks the Guide a question. It receives roles, dates and open checklist items with people shown as "Worker A" — never names, NI or passport numbers, addresses or pay. Anthropic does not train on this data. |
5. Your rights
You can ask to see, correct or delete personal data we hold about you, to restrict or object to how we use it, or to receive it in a portable form. Email rashid@datasolutionz.co.uk. We reply within one month. If your request is about records your employer keeps in Sponsorwyn, we will refer it to them.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk — but please contact us first so we can try to put it right.
6. Cookies
Sponsorwyn uses only the cookies needed to keep you signed in. There are no analytics or advertising cookies.
7. Changes
We will update this notice when how we handle data changes, and tell authorising officers about material changes. See also our Terms of service.
Contact
Data Solutionz Limited · rashid@datasolutionz.co.uk