This is a draft for specialist review. It describes how the platform is actually built, so it is accurate about data flows. It must be reviewed by a data-protection specialist, and the controller details completed, before launch.
Who is the controller
BacktoTrack Ltd is the controller for the personal data described here. Our data protection officer can be reached at the address on our contact page.
What we collect, and why
If you are looking for work
| What | Why | Lawful basis |
|---|---|---|
| Name, email, phone, town and postcode | To create your account and show you jobs within reach | Contract |
| Your skills, work history, qualifications and availability | To match you to vacancies and build your CV | Contract |
| Your answers about ID, right to work, a bank account, an address for post, phone and internet access, travel and other practical barriers | To assess employment readiness and offer the right support | Contract, and legitimate interests in providing employment support |
| Documents you choose to upload | To evidence qualifications, identity or right to work when a role requires it | Contract, and legal obligation where an employer must check right to work |
| Support you ask for, and referrals you agree to | To arrange that support | Consent for each referral |
| Information about a criminal record, only if you choose to use the disclosure-support feature or a specific role lawfully requires it | To give you guidance, and to support a lawful disclosure to one employer for one role | See the separate section below |
| Access logs, IP address and device information | Security, fraud prevention and audit | Legal obligation and legitimate interests |
If you are an employer, agency or provider
Organisation details, verification evidence, the accounts of your staff who use the platform, your vacancies and your recruitment activity. Lawful basis: contract, and legitimate interests in preventing fraud and misuse.
Criminal-offence data
Information about convictions, cautions and other disposals is criminal-offence data. We treat it under Article 10 of the UK GDPR and the conditions in Schedule 1 of the Data Protection Act 2018, and we keep an appropriate policy document, which you can read on our criminal-offence data policy page.
In practice:
- You can register, search and apply for jobs without ever telling us about a criminal record.
- If you use the disclosure-support feature, what you record is for your own guidance. It is not shared with any employer unless you specifically release it for a specific role.
- It is stored separately from the rest of your profile, encrypted, and every single access is logged with the reason for it.
- Most of our staff cannot see it at all. It takes a separate, named role that very few people hold.
- We never let an employer search candidates by offence, and there is no index that would make that possible.
- We do not publish, sell or share a register of anybody's record.
What employers can see
Employers see your professional profile — skills, experience, qualifications, availability and whether you meet their stated requirements. Employers never see:
- whether you have a bank account, or anything else from the banking section;
- your housing or accommodation situation;
- any support you have asked us for, or any referral;
- your residential address;
- anything about a criminal record, unless the law requires a check for that role and you have released the information for that role.
Your profile is private until you choose to make it searchable, and you can make it private again at any time.
Who else we share with
- Support and training providers — only on a referral you have agreed to, and only the details shown to you before you agree.
- Service providers who host and run the platform, send our email, and take payment from employers. They act on our instructions only.
- Authorities, where we are legally required to.
We do not sell personal data. We do not use your data to train AI models.
How long we keep it
| Record | Retention |
|---|---|
| Candidate account with no activity | 2 years from last activity, then deleted |
| Applications | 12 months after the vacancy closes |
| Uploaded documents | 2 years, or sooner if you delete them |
| Disclosure records | 6 months, or immediately when the related application ends |
| Messages | 3 years |
| Audit logs | 7 years (security and accountability) |
You can ask us to delete your account at any time; we will keep only what we must for legal or audit reasons.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, ask us to restrict processing, and withdraw any consent. You can do most of this yourself from your privacy settings. We respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Data is encrypted in transit and sensitive fields are encrypted at rest. Documents are kept in private storage and are only reachable through short-lived, signed links — never a public URL. Staff accounts that can reach sensitive data require two-factor authentication, and every access is logged.