Privacy Policy

1. About this Privacy Policy

CompCheck.IO is a product of Waris International Consulting Ltd ("WICL", "we", "us" or "our").

Waris International Consulting Ltd is a company registered in England and Wales under company number 09531683, with its registered office at:

C/O Hr Accountants, 222 Branston Road, Burton On Trent, England, DE14 3BT

Email: compcheck@warisconsulting.co.uk

This Privacy Policy explains how we collect, use, store and otherwise process personal information when individuals interact with CompCheck.IO, our website, applications and associated services.

It also explains the distinction between circumstances where WICL acts as a controller of personal information and circumstances where WICL processes information on behalf of our customers.

2. The CompCheck.IO Services

CompCheck.IO is an integrated software platform which may include:

• compliance management;
• HR and workforce management;
• Academy and learning management;
• employee and personnel records;
• recruitment and onboarding;
• time and attendance;
• workforce scheduling;
• leave and absence management;
• payroll-related functionality;
• appraisals and workforce analytics;
• training management;
• risk assessments;
• audits and checklists;
• policies, procedures and other documents;
• forms and records;
• document management;
• electronic signatures and acknowledgements;
• tasks, tickets and corrective actions;
• sites and locations;
• consultant/Super Admin functionality;
• client relationship management;
• proposals;
• subscriptions;
• invoicing and payments;
• communications; and
• related functionality made available from time to time.

3. When WICL is the Controller

WICL acts as a controller where we determine why and how personal information is used.

This may include information processed for:

• creating and administering CompCheck.IO Accounts;
• managing subscriptions;
• billing and payment administration;
• responding to enquiries;
• arranging demonstrations;
• providing customer support;
• managing our relationship with customers;
• maintaining contractual records;
• operating and securing CompCheck.IO;
• preventing fraud and misuse;
• administering our website;
• communicating service information;
• improving our products and services;
• marketing where permitted;
• maintaining appropriate business records;
• complying with legal and regulatory requirements; and
• establishing, exercising or defending legal claims.

Where WICL acts as controller, this Privacy Policy applies directly to our processing of that information.

4. When WICL Acts on Behalf of a Customer

A substantial amount of information stored within CompCheck.IO is not collected by WICL for WICL's own purposes.

Our customers may use CompCheck.IO to process information about employees, workers, contractors, job applicants, learners, customers, clients, suppliers, visitors, consultants and other individuals.

In these circumstances, the CompCheck.IO customer will ordinarily determine why the information is processed and WICL will process that information on the customer's behalf.

For example, an employer may use CompCheck.IO HR to maintain employee records, record attendance, administer absence or assign training. The employer determines why those records are maintained. CompCheck.IO provides the software through which the information is processed.

Similarly, a consultant may use CompCheck.IO to manage information relating to its own clients.

Where WICL acts as a processor or sub-processor, the relevant customer or other controller is primarily responsible for providing privacy information to affected individuals and determining the lawful basis for processing.

Our processing in those circumstances is also governed by the CompCheck.IO Data Processing Agreement.

5. Information We May Collect as Controller

Identity information

This may include name, title, username, job title, organisation and user/account identifiers.

Contact information

This may include email address, telephone number, business address and correspondence details.

Account information

This may include Account details, Subscription, Account status, permissions, organisation details and sites or locations associated with an Account.

Commercial and transaction information

This may include Subscription information, purchases, invoices, payment status, billing information, transaction identifiers, promotional codes, proposals and commercial arrangements.

We do not intend to store complete payment-card details ourselves where payments are processed through an external payment provider.

Communications

This may include enquiries, support requests, emails, correspondence, feedback, complaints and demonstration requests.

Technical and security information

This may include IP address, browser information, device information, login information, timestamps, security events, Account activity, application logs and diagnostic information.

The precise technical information collected will be updated following final technical verification.

Marketing information

This may include marketing preferences, communication preferences, campaign interactions and promotional enquiries.

Website information

We may collect information about how individuals interact with our website and online services through cookies and similar technologies.

Further information is contained in our Cookie and Similar Technologies Policy.

6. Information Customers May Store in CompCheck.IO

Customers control what information they enter into many areas of CompCheck.IO. Consequently, Customer Personal Data may include:

• employee details;
• contact information;
• employment information;
• HR records;
• recruitment information and CVs;
• attendance;
• clock-in/out information;
• working hours;
• shifts;
• leave;
• absence;
• payroll-related information;
• training records;
• competency information;
• appraisal information;
• risk assessment records;
• accident and incident records;
• audit information;
• checklist responses;
• corrective actions;
• photographs;
• forms;
• policies and procedures;
• electronic signatures;
• acknowledgements;
• documents and attachments;
• communications;
• client information;
• CRM information; and
• other information entered by customers and their Authorised Users.

In relation to this information, WICL will generally act as processor rather than controller where it is processed solely to provide the Services on the customer's instructions.

7. Special Category Personal Data

CompCheck.IO functionality may enable customers to process Special Category Personal Data.

This may include information concerning health, sickness and absence, disability, occupational health, workplace adjustments, injuries or accidents, racial or ethnic origin, religious or philosophical beliefs, trade union membership and other Special Category Personal Data entered by customers.

The availability of functionality capable of storing such information does not mean that WICL requires customers to collect it.

Where a customer controls this information, the customer is responsible for determining whether processing is lawful and establishing any necessary lawful basis and additional condition.

Customers should avoid entering unnecessary sensitive information into free-text fields or documents.

8. Criminal Offence Information

Customers may, in limited circumstances, enter criminal offence information into CompCheck.IO, for example as part of recruitment or HR documentation.

Where the customer determines the purpose of that processing, the customer is responsible for ensuring it has appropriate legal authority to process that information.

WICL does not require customers to collect criminal offence information merely because CompCheck.IO is technically capable of storing documents or information containing it.

9. How We Use Personal Information

Where WICL acts as controller, we may use personal information for the following purposes:

10. Our Legitimate Interests

Where we rely upon legitimate interests, those interests may include:

• operating CompCheck.IO;
• administering customer relationships;
• providing customer support;
• securing our systems;
• preventing misuse and fraud;
• improving the Services;
• understanding how our Services are used;
• communicating with business customers;
• protecting our business;
• recovering amounts owed to us; and
• establishing, exercising and defending legal rights.

We consider whether those interests are overridden by the rights and interests of affected individuals before relying on legitimate interests.

11. Marketing

We may send information about CompCheck.IO, new features, services, promotions and related WICL products or services where permitted by law.

Where consent is required for electronic marketing, we will seek appropriate consent.

Where applicable law permits us to rely upon another lawful basis, including legitimate interests, we may do so subject to the relevant requirements.

Individuals can unsubscribe from marketing communications at any time using the unsubscribe facility contained in relevant communications or by contacting us.

12. Service Communications

Operational communications concerning an Account or the Services are different from promotional marketing.

We may send communications concerning Account security, password resets, Account activation, Subscription status, invoices and payments, changes to the Services, important legal changes, service interruptions, security incidents and other information necessary to administer the relationship.

It may not be possible to opt out of essential service communications while maintaining an active Account.

13. Where We Obtain Personal Information

We may obtain information:

• directly from individuals;
• from the organisation they work for;
• from a CompCheck.IO customer;
• from an Account administrator;
• from consultants or Super Admin users;
• from payment providers;
• through use of our website and applications;
• from correspondence with us;
• from service providers acting on our behalf;
• from integrations authorised by a customer; and
• from publicly available sources where lawful and appropriate.

14. Who We Share Information With

Where necessary and lawful, personal information may be shared with:

• hosting and infrastructure providers;
• database/storage providers;
• payment providers;
• email and communications providers;
• IT and technical service providers;
• developers and authorised technical personnel;
• security and monitoring providers;
• professional advisers;
• accountants and auditors;
• insurers;
• regulators and public authorities;
• law-enforcement bodies where legally required;
• courts and tribunals;
• prospective purchasers or investors in connection with a legitimate corporate transaction; and
• other service providers necessary to operate CompCheck.IO.

We do not permit service providers processing information on our behalf to use that information for unrelated purposes merely because they provide services to us.

15. Hosting

CompCheck.IO's hosting infrastructure and Customer Data are hosted using services supplied to Waris International Consulting Ltd by Hetzner Online GmbH.

Our current understanding is that the relevant servers are located in Germany, subject to final technical confirmation.

Customer and application data is backed up daily.

Further details concerning backup retention, storage and technical security arrangements will be incorporated into our data-processing documentation following technical verification.

16. Freelance Developer Access

CompCheck.IO is maintained with the assistance of an authorised freelance software developer.

Highest-level Super Administrator access is currently restricted to:

• an authorised representative of Waris International Consulting Ltd; and
• the authorised freelance developer responsible for technical development and maintenance.

No other persons currently have Super Administrator access.

Administrative access is intended to be used only where reasonably required for legitimate administration, development, maintenance, security and support purposes.

17. International Transfers

Some organisations providing services to WICL may process information outside the United Kingdom.

Our principal hosting arrangement currently involves processing in Germany, subject to final technical confirmation.

Where personal information is transferred outside the UK, we will ensure that an appropriate mechanism recognised by UK data-protection law applies where required.

Depending upon the recipient and destination, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another lawful transfer mechanism.

Additional international transfers, if any, will be documented following completion of our technical provider review.

18. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it is processed, taking account of:

• the duration of the customer relationship;
• contractual requirements;
• legal and regulatory requirements;
• accounting and tax requirements;
• security requirements;
• limitation periods;
• dispute and claims requirements;
• the nature and sensitivity of the information; and
• applicable backup and deletion cycles.

Different categories of information may therefore have different retention periods.

Where WICL processes Customer Personal Data as Processor, retention will also be governed by the customer's instructions and the CompCheck.IO Data Processing Agreement.

Following termination, Customer Personal Data may remain temporarily within backup systems before being overwritten or deleted through the applicable backup cycle.

19. Security

We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction, alteration and unauthorised disclosure.

Measures applicable to CompCheck.IO include restricted administrative access and daily backups.

Additional technical measures concerning encryption, authentication, logging, monitoring, recovery and infrastructure security are currently being technically verified and will be documented appropriately.

No internet-connected service can guarantee absolute security.

20. Passwords and Account Security

Users are responsible for keeping their Account credentials confidential and must not knowingly permit unauthorised persons to access their Account.

Customers are responsible for appropriately allocating user permissions, removing access when it is no longer required, protecting devices used to access CompCheck.IO and notifying us promptly of suspected unauthorised Account access.

21. Cookies and Similar Technologies

Our website and applications may use cookies and similar technologies for purposes including essential functionality, security, authentication, remembering preferences, analytics and understanding use of our Services.

Non-essential cookies and similar technologies will be handled in accordance with applicable requirements.

Further information is provided in our Cookie and Similar Technologies Policy.

22. Automated Decision-Making

WICL does not currently intend to make decisions about individuals based solely on automated processing which produce legal or similarly significant effects merely by providing the CompCheck.IO platform.

Customers may use information generated or maintained through CompCheck.IO when making their own HR, employment, compliance or business decisions.

Those decisions remain the responsibility of the relevant customer.

If CompCheck.IO introduces functionality involving solely automated decision-making or profiling falling within applicable statutory requirements, we will update the relevant privacy information and safeguards accordingly.

23. Individual Rights

Depending upon the circumstances and lawful basis involved, individuals may have rights including:

• access to their personal information;
• rectification of inaccurate information;
• erasure;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent where processing is based upon consent; and
• rights relating to certain automated decisions.

These rights are not absolute in every circumstance.

24. Exercising Rights Where WICL is Controller

Where WICL is Controller, requests concerning personal information can be sent to:

compcheck@warisconsulting.co.uk

We may need to verify an individual's identity before fulfilling certain requests.

We will respond in accordance with applicable data-protection law.

25. Requests Concerning a Customer's Data

If an individual's information has been entered into CompCheck.IO by their employer, consultant, training provider or another CompCheck.IO customer, that organisation may be the Controller rather than WICL.

For example, an employee seeking access to an HR record maintained by their employer should normally contact their employer first.

Where WICL receives a request concerning information for which a customer is Controller, we may refer the request to or notify the relevant customer, subject to applicable law.

26. Complaints

If you have concerns about how WICL has handled your personal information, please contact us first at:

compcheck@warisconsulting.co.uk

You also have the right to complain to the UK's data-protection supervisory authority, the Information Commissioner's Office (ICO).

27. Children

CompCheck.IO is primarily designed for use by organisations and professional users.

The Services are not intended to enable children independently to establish ordinary business Accounts unless expressly provided otherwise.

However, customers may process information relating to younger individuals in appropriate circumstances, for example through training, employment or other lawful organisational activities.

Where a customer determines that purpose, the customer is responsible for ensuring the processing is lawful and for implementing any additional safeguards required by law.

28. Links and Third-Party Services

CompCheck.IO may contain links to or integrations with third-party websites, applications or services.

Independent third parties may process personal information under their own privacy policies.

WICL is not responsible for an independent third party's privacy practices merely because CompCheck.IO provides a link or authorised integration with that service.

29. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to CompCheck.IO;
• new functionality;
• changes to our suppliers or infrastructure;
• changes in our processing activities;
• changes in law or regulatory guidance; or
• improvements to our privacy practices.

The latest version will be published on the CompCheck.IO website with an updated effective date.

Where appropriate, we may notify Account holders of material changes through email or the Platform.

30. Contact Us

For privacy enquiries or requests concerning personal information for which WICL is Controller: