Privacy Policy

Last updated: 1 January 2025

1. Introduction

WFC360 (“we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including WFC Control and WFC Verify. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

WFC360 is the data controller for personal data collected through our website and services. Our registered address is: Devonshire House, Stanmore, HA7 1JS, United Kingdom.

3. Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, phone number, company name, and job title
  • Employee vetting data: identity documents, employment history, address history, DBS check results, SIA licence details, and Right to Work documentation (processed on behalf of our customers)
  • Usage data: log files, IP addresses, browser type, pages visited, and time spent on the platform
  • Communication data: emails and messages sent to our support team

4. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: to provide the services you have subscribed to
  • Legitimate interests: to improve our services, prevent fraud, and ensure security
  • Legal obligation: to comply with applicable laws and regulations
  • Consent: where you have given explicit consent for specific processing activities

5. How We Use Your Data

We use your personal data to:

  • Provide, operate, and improve our services
  • Process transactions and send related information
  • Send administrative information, such as updates and security alerts
  • Respond to your comments and questions
  • Comply with legal obligations

6. Data Sharing

We do not sell your personal data. We may share your data with trusted third-party service providers who assist us in operating our platform (such as cloud hosting providers and payment processors), subject to appropriate data processing agreements. We may also disclose data where required by law.

7. Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Employee vetting data is retained in accordance with BS7858:2019 requirements and applicable employment law. Upon account termination, we will delete or anonymise your data within 90 days, unless longer retention is required by law.

8. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate personal data
  • Erase your personal data (right to be forgotten)
  • Restrict processing of your personal data
  • Data portability
  • Object to processing based on legitimate interests
  • Withdraw consent at any time

To exercise any of these rights, please contact us at privacy@wfc360.com.

9. Cookies

We use cookies and similar tracking technologies to improve your experience on our website. You can control cookie settings through your browser preferences. For more information, see our Cookie Policy.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, and regular security assessments.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

12. Contact Us

For privacy-related questions or to exercise your rights, please contact our Data Protection Officer at privacy@wfc360.com or write to: WFC360, Devonshire House, Stanmore, HA7 1JS, United Kingdom.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.