Privacy Notice
Sponsor Licence Compliance Guru, operated by Nara Solicitors, Spaces Canary Wharf, 25 Cabot Square, London E14 4QZ, United Kingdom. Last updated: 15 July 2026.
This is a draft pending data-protection sign-off.
Who we are
Sponsor Licence Compliance Guru is a compliance platform used by sponsoring employers to meet UK sponsor-licence duties. Nara Solicitors is authorised and regulated by the Solicitors Regulation Authority (SRA No. 8006464) and registered with the Information Commissioner’s Office (registration: ZB670355).
Your employer (our customer) is the controller of worker data; Nara Solicitors acts as processor on their instructions, and as controller for account and security data. Our Data Protection Officer is Ravina Kaul — dpo@narasolicitors.com. General data-protection queries: privacy@narasolicitors.com, or by post to the address above.
What we process, why, and our lawful bases
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Identifying workers and meeting sponsor record-keeping duties | Identity & contact details | Processed on your employer’s instructions — your employer establishes the basis, normally Art. 6(1)(c) legal obligation |
| Preventing illegal working and meeting UKVI duties | Immigration & right-to-work records (passport, visa, CoS, RTW evidence) | On your employer’s instructions — normally Art. 6(1)(c) legal obligation |
| Administering sponsored employment | Employment & financial details (role, salary, bank details) | On your employer’s instructions — Art. 6(1)(b) contract / 6(1)(c) legal obligation |
| Sponsor reporting duties | Attendance & absence records | On your employer’s instructions — Art. 6(1)(c) legal obligation |
| Operating the service securely (accounts, audit logs, abuse prevention) | Account, security & audit data | We act as controller — Art. 6(1)(b) contract and 6(1)(f) legitimate interests |
Special-category data. Immigration records can reveal special-category information. Where we process worker records we do so as processor: your employer, as controller, is responsible for the Article 9 condition (commonly Art. 9(2)(b) — employment and social-security law). The platform does not solicit any other special-category data.
Who we share it with
We use a small number of infrastructure sub-processors, each under a data-processing agreement, to run the service:
- Supabase — database and document storage (hosted in the EU — Ireland,
eu-west-1). - Vercel — application hosting (processed in the UK — London,
eu-west-2). - Amazon Web Services (Amazon SES) — sending transactional emails (sign-up confirmation, reminders, account notices; processed in the UK — London,
eu-west-2). - Functional Software, Inc. (Sentry) — error monitoring (technical error reports; our systems are designed not to include worker records in them).
- postcodes.io — UK address lookup (postcode only; no personal data sent).
We do not sell your data or use it for advertising, and we do not share it with any other third party except where required by law. Our current sub-processor list is available on request, and we will give notice before adding or replacing one.
Where your data lives (international transfers)
Worker records and documents are hosted in the UK and EU (Supabase in Ireland; Vercel in London). Limited data leaves the UK/EU only through the sub-processors above — transactional email (Amazon SES) and technical error reports (Sentry). Any such transfer is protected by the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment. The full commitments are in our Data Processing Agreement.
How we protect it
Data is encrypted in transit and at rest. Sign-in requires mandatory two-factor authentication. Each customer’s records are isolated from every other customer’s; documents are only reachable through time-limited signed links; access follows least-privilege; and security-relevant actions are audit-logged. A fuller description of our technical and organisational measures is in the Data Processing Agreement, and more detail is available on request.
How long we keep it
Sponsored-worker records are retained for the duration of sponsorship plus one year (UKVI Appendix D); other data per our retention schedule. Deleted data also leaves our short-cycle backups within the backup retention window. See our retention and erasure procedure for detail.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent for equality data. To exercise them, contact your employer (the controller) or privacy@narasolicitors.com. You can complain to the ICO (ico.org.uk).
Cookies
We use only strictly necessary cookies, all HttpOnly and set for security:
- Session cookie (
cs_session) — keeps you signed in securely; essential to the service. - Trusted-device cookie (
cs_device) — set only if you choose “remember this device” at the two-factor step, so that device can skip the code for up to 30 days.
These are not used for tracking or advertising, so they do not require consent under PECR. We set no analytics or marketing cookies. The full list, including lifetimes and the small amount of local storage the app uses, is in our Cookie Policy.