The Safeguarding Alliance Limited

Privacy Policy

This Privacy Policy explains how The Safeguarding Alliance Limited collects and uses personal data across the Safer Recruitment Suite (SafeRecord, SafeApply, and SafeVerify).

Who we are

The Safeguarding Alliance Limited ("we", "us") provides The Safeguarding Alliance Limited's Safer Recruitment Suite, including SafeRecord (staff management), SafeApply (recruitment and applicant management), and SafeVerify (vetting and verification). Applicants can also interact and have accounts with SafeApply and some of the vetting tools in SafeVerify. All contracts for the service are between The Safeguarding Alliance Limited and the customer or user.

Legal entity: The Safeguarding Alliance Limited
Company number: 11691733
Registered office: 124 Finchley Road, London, England, NW3 5JS
Registered jurisdiction: England and Wales
Contact: wg@thesafeguardingalliance.org.uk
Data Protection Officer: We have appointed a Data Protection Officer. You can contact our DPO about anything in this notice, to exercise your rights, or to raise a complaint, at dpo@thesafeguardingalliance.org.uk.

Controller and Processor roles

This Privacy Policy explains how we collect and process personal data across The Safeguarding Alliance Limited's Safer Recruitment Suite.

Users & Organisation Profile: We (The Safeguarding Alliance Limited) act as Controller for organisation staff user accounts and organisation profile details.
Applicant SafeApply account & profile: We (The Safeguarding Alliance Limited) act as Controller for your SafeApply account (e.g. login credentials) and the profile data you save (e.g. employment and education details for autofill). You create this account on SafeApply and we use it to provide you the service.
Your applications to specific roles: For data you submit when applying to a role (application form, documents, and the record of that application in "My Applications"), the organisation that advertised the role is the Controller; we act as Processor on the organisation's instructions.
Referees & Staff (SafeRecord): Your organisation is the Controller; we act as Processor on the organisation's instructions.

Roles

For organisation staff user accounts and an organisation's profile details (e.g., organisation address and contacts), we are the Controller.

What we collect

Account data (name, work email, role, organisation)
Security and usage logs (timestamps, IP, device/browser metadata)
Support communications and product preferences

Where your information comes from

Most of your account information does not come from you. It comes from your own organisation, and we set it out here because you are entitled to know.

From your organisation. Your account is created for you by an administrator at your organisation, who provides your name, work email address, role and permission level. We receive those details from them, not from you.
From you. Anything you send us directly — support messages, and any preferences you set yourself.
Generated by the service. Security and usage logs are created automatically when you use the platform: timestamps, IP address, and device and browser metadata.

Your organisation is responsible under our Master Services Agreement for the accuracy of the account details it gives us and for telling you it has created an account for you.

How we use data

Provide and administer the service, authenticate users, and maintain security
Operate, maintain, and improve The Safeguarding Alliance Limited's Safer Recruitment Suite
Send product/service updates (legitimate interests)
Send marketing communications with your consent

Legal bases

Contract (providing the service to your organisation)
Legitimate interests (security, service operation, improvement)
Legal obligation (records and security requirements)
Consent (marketing you can opt in/out — not currently relied on; see Communications)

Data location & transfers

Application data is stored in the United Kingdom (AWS London, eu-west-2). We do not ordinarily transfer application data outside the UK/EEA. If access occurs outside the UK/EEA (e.g., for technical support), we use appropriate safeguards including International Data Transfer Agreement (IDTA) where required. You can request a copy of the safeguards we rely on by contacting our DPO at dpo@thesafeguardingalliance.org.uk. Payments are handled by Paddle, which acts both as our processor and, as merchant of record, as an independent controller; see "Payments" below.

Payments

Subscription payments are processed by Paddle.com Market Ltd. Card and bank details are entered directly into a Paddle checkout and are never received or stored by us.

Paddle acts in two distinct roles, and it is important to understand the difference:

As our processor. Where you choose to be invoiced, we send Paddle the billing details needed to raise the invoice — billing contact name and email address, billing address, and any VAT or tax registration number you provide — and we retrieve those billing records back when you manage your subscription. We store the Paddle customer reference against your account. This processing is carried out on our instructions under Paddle’s Data Processing Addendum.
As an independent controller. Paddle is the merchant of record for the sale. For that part of the transaction — taking payment, calculating and remitting sales tax, fraud screening, and meeting its own financial and regulatory obligations — Paddle decides how and why the data is used, and is a controller in its own right rather than acting for us. That processing is governed by Paddle’s own Data Sharing Addendum and its privacy policy, not by this notice.

Paddle.com Market Ltd is established in the United Kingdom. Where Paddle transfers data outside the UK/EEA under either role, it does so under its own safeguards, being the EU Standard Contractual Clauses together with the UK Approved Addendum issued by the Information Commissioner’s Office. For how Paddle uses personal data as a controller, see Paddle’s privacy information at checkout.

AI assistance (no automated decisions)

Optional assistive features summarize documents or highlight potential discrepancies using models hosted within AWS Bedrock. These features do not make automated decisions about people, and no customer data is used to train model providers. Inferences occur in an isolated environment and are not retained by the model vendor.

Sub-processors & changes

We use select vendors to help deliver the service, including Amazon Web Services (AWS) (hosting, authentication, document analysis, and AI inference), Google (Gmail API for email delivery), Paddle (billing and payments — our processor for invoicing, and an independent controller as merchant of record), Waxley Graham LLC (software development and platform operation), and IONOS Cloud Limited (email hosting for our mailboxes). A current list of all sub-processors, including their services, data locations, and purposes, is available at Sub-Processors. All sub-processors are bound by written contracts with GDPR-compliant clauses and, where applicable, Data Processing Agreements. International transfer safeguards are in place where required.

We will provide advance written notice of material changes to these vendors to Customer administrators via email or in-app notification. If you object to a new sub-processor, please contact us; our Data Processing Addendum (DPA) sets out the process for objections.

Website technical providers

The service may load scripts, fonts, or styles from public content delivery networks (CDNs), such as jsDelivr, Cloudflare/cdnjs, Google Fonts, or similar providers. Your browser may send technical data (such as IP address and request metadata) to those providers when loading the application. These providers are not sub-processors; they do not receive recruitment or safeguarding content from us.

Security & breach

We implement encryption in transit (TLS 1.2+), encryption at rest (AES‑256), VPC/network isolation, least‑privilege access controls, audit logging/monitoring, vulnerability management, and backups. As Controller, if a personal data breach occurs that is likely to result in a risk to individuals' rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in such a risk. Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will also notify affected individuals without undue delay.

Your rights

Under UK GDPR, you have the following rights:

Right of access – request a copy of your personal data
Right to rectification – request correction of inaccurate data
Right to erasure – request deletion in certain circumstances
Right to restriction – request limitation of processing in certain circumstances
Right to object – object to processing based on legitimate interests
Right to data portability – receive your data in a structured format
Right to withdraw consent – where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it
Right to complain – raise a complaint with us, and to lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise these rights, or to raise a complaint, contact our Data Protection Officer at dpo@thesafeguardingalliance.org.uk.

Keeping your information accurate

Organisation staff accounts are created and maintained by your organisation's administrators, so details such as your name, work email and role are corrected through them rather than by you directly. If your details are wrong, ask an administrator at your organisation to update them.

Your organisation is responsible under our Master Services Agreement for keeping the accounts it creates, and the records it holds in the service, accurate and up to date. You can also exercise your right to rectification with us using the contact details above.

Cookies

We do not set cookies or use browser-based trackers in the service. If this changes, we will update this notice and request consent where required.

Roles – two different cases

Applicant data is split into two types, with different Controllers:

Your SafeApply account and profile: When you create an account on SafeApply and save profile data (e.g. employment and education details for autofill), we (The Safeguarding Alliance Limited) are the Controller. We store and use this to provide your account and to let you apply to roles.
Your applications to specific roles: When you submit an application to a role, or upload documents for that application, or when that application appears in "My Applications", the organisation that advertised the role is the Controller and we act as Processor on their instructions under our Data Processing Addendum.

Storage of applicant data

Account and profile (we are Controller): We store your SafeApply account credentials and the profile data you save (employment, education, etc.) so you can use them to complete applications. We use this data to provide and secure your account.

Applications to roles (organisation is Controller): We store your application submissions, documents uploaded for each application, and the record of your applications (e.g. in "My Applications") on behalf of each organisation you apply to. We process this as Processor on the organisation's instructions.

What we collect as Controller (account & profile)

Account credentials (e.g. email, password)
Profile data you choose to save (e.g. name, contact details, employment and education history for autofill)
Security and usage logs relating to your account

Legal bases (account & profile)

Where we are Controller for your SafeApply account and profile, we rely on: Contract (providing your account and the profile/autofill service); Legitimate interests (security, service operation and improvement); and Legal obligation (records and security requirements) where applicable.

What organisations may collect via the service (applications)

Identity and contact details, employment/education history (as submitted in each application)
References and related communications
Special category or criminal offence data where configured by the organisation (see below)

Where your information comes from

From you. Your SafeApply account, the profile you save, the applications you submit and the documents you upload.
From an organisation, without you using SafeApply. An organisation can create a record about you itself — for example by uploading a CV or application it received by email or post, or by keeping you as a saved candidate from an earlier application and inviting you to apply again. In those cases your details reached us from that organisation rather than from you. The organisation is the Controller for that record and is responsible for telling you it holds your data, what it holds, and where it got it.
From your referees. The responses your referees give about you, and the record of when a reference was requested and returned.
From the organisation's own checks. Criminal record check metadata (reference number, date, status or outcome, and issuer — never the certificate itself), interview records and notes, vetting records and safeguarding flags recorded by its staff.
Generated by the service. Text extracted from documents you upload, and assistive summaries, discrepancy flags and missing-information prompts produced to help organisation staff review your application. These are assistive only and do not make decisions about you.

Criminal records, medical checks & special category data

Criminal record checks: We do not permit the upload or storage of criminal record certificates (e.g., DBS/CRB documents). Organisations must record criminal record checks as metadata only (e.g., reference number, date, status/outcome, issuer). This approach aligns with UK GDPR and the Data Protection Act 2018 safeguards for criminal offence data.

Medical vetting: Health-related documents (such as medical or occupational health reports) may be uploaded only through the dedicated medical vetting workflow in SafeVerify or SafeRecord. Uploading such documents elsewhere in the service is not permitted.

Other special category data: Application forms, reference forms, and vetting workflows are configurable by each organisation. Free-text safeguarding responses, suitability questions, and document uploads may incidentally collect special category data where the organisation has configured the service to do so. The organisation is the Controller for application data and is responsible for determining a lawful basis under UK GDPR Article 6 and, where applicable, an Article 9 condition and/or a condition under Schedule 1 of the DPA 2018, and for providing appropriate privacy notices to applicants and referees.

Access to sensitive vetting data is restricted to authorised organisation staff, and enhanced audit logging tracks access to safeguarding-related data.

Lawful basis for special category and criminal offence data

Special category data — such as health information — and criminal offence data need more than an ordinary lawful basis. As well as a basis under Article 6 of the UK GDPR, they need a condition under Article 9 (for special category data) or under Article 10 and Schedule 1 of the Data Protection Act 2018 (for criminal offence data). Who is responsible for identifying that condition depends on who is the Controller.

Vetting and safeguarding data — the organisation decides. Criminal record check metadata, health data submitted through the medical vetting workflow, and any other special category data an organisation configures the service to collect are controlled by that organisation. It is responsible for identifying the Article 6 basis, the Article 9 condition and, where applicable, the Schedule 1 condition, and for telling you about them in its own privacy notice. We act only on its instructions and do not decide the lawfulness of what it configures.
Your SafeApply account and profile — we are Controller, and we do not seek this data. Our account and profile fields are not designed to hold special category or criminal offence data, and our Terms & Conditions ask you not to put it there. Vetting checks are held in the organisation's own environment, not in your SafeApply profile, and the record we keep of an application is a reference to it rather than a copy of its contents.
If such data does reach us as Controller — for example in a document you save to your profile, or in something you tell our support team — we do not rely on it, use it for any other purpose, disclose it, or make any decision about you on the basis of it. We remove it once identified, unless we need to keep it to answer your request or to establish, exercise or defend a legal claim, in which case we rely on Article 9(2)(f).

We do not store criminal record certificates of any kind. Only check metadata — a reference number, date, status or outcome, and issuer — may be recorded, and that is held by the organisation as Controller.

Safeguarding statement

Organisations may upload a safeguarding statement (PDF) during signup for display to applicants on job listings and application pages. That document is provided by the organisation, not by TSA. It is separate from this Privacy Policy and from any privacy notice the organisation must provide to applicants about how their application data is processed.

AI assistance (no automated decisions)

Assistive summaries/discrepancy flags may be shown to organisation staff. These are not automated decisions about you and do not replace human review.

Data location & transfers

Your SafeApply account and profile data (where we are Controller), and your application data (where the organisation is Controller), are stored in the UK (AWS London, eu-west-2). We do not ordinarily transfer applicant data outside the UK/EEA. If access occurs outside the UK/EEA (e.g., for technical support), we use appropriate safeguards including International Data Transfer Agreement (IDTA) where required. You can request a copy of those safeguards from our DPO at dpo@thesafeguardingalliance.org.uk. Payments to Paddle are separate and made by organisations.

Security & breach

Account and profile (we are Controller): We apply the security measures described in the "Users" section above. If a breach affects your SafeApply account or profile data, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, where the breach is likely to result in a risk to your rights and freedoms. We will notify you without undue delay where the breach is likely to result in a high risk to your rights.

Applications (organisation is Controller): When acting as Processor, if we become aware of a personal data breach affecting your application data, we will notify the organisation (Controller) without undue delay and support their assessment and notifications. The organisation is responsible for ICO and individual notifications where required.

Your rights

Under UK GDPR, you have rights including access, rectification, erasure, restriction, objection and data portability. Where we rely on your consent you can withdraw it at any time, without affecting the lawfulness of anything done before you withdrew it. You can also raise a complaint with us, and you have the right to complain to the ICO.

For your SafeApply account and profile (where we are Controller): contact our Data Protection Officer at dpo@thesafeguardingalliance.org.uk. We will respond to your request.
For your applications to specific roles (where the organisation is Controller): contact the organisation you applied to. We will assist the organisation as required to fulfil your requests.

Keeping your information accurate

You can correct most of your own data without making a request. While your SafeApply account is active you can edit your profile details, employment and education history, saved documents and profile picture at any time, and we ask that you keep them up to date.

An application you have already submitted cannot be edited — it is a record of what you provided at the time. The organisation that advertised the role is the Controller for that application and decides whether to amend it, so contact that organisation directly, or send us a rectification request and we will pass it on.

Your responsibilities for accuracy are set out in our Terms & Conditions.

Roles

For referee data, the organisation is the Controller and we are the Processor.

Where your information comes from

You did not give us your details, and you may never have heard of us before receiving a reference request. Here is how we came to hold them.

Your name and contact details were given to us by the applicant who listed you as a referee, or by the organisation requesting the reference. They reached us before you were contacted.
Your relationship to the applicant comes from the same source.
Your reference responses come from you, when you complete the reference form.
Generated by the service. A record of when the request was sent, whether it was resent, and when the reference was returned; and, where the organisation uses them, assistive summaries or flags drawn from your responses to help its staff review the reference. These are assistive only and do not make decisions about anyone.

The organisation that requested the reference decides how this information is used and is the Controller for it. We also set this out in the reference request email you receive.

Storage of referee data

We store referee data on behalf of the organisation requesting the reference. This includes your identity and contact details, your relationship to the applicant, and your reference responses. All of this is processed on the organisation's instructions as Processor.

What organisations may collect

Referee identity and contact details
Relationship to applicant and reference responses

AI assistance (no automated decisions)

Assistive summaries may be presented to staff; there is no automated decision-making.

Data location, security & breach

Data is stored in the UK (AWS London, eu-west-2). We do not ordinarily transfer referee data outside the UK/EEA. If access occurs outside the UK/EEA, we use appropriate safeguards including International Data Transfer Agreement (IDTA) where required. You can request a copy of those safeguards from our DPO at dpo@thesafeguardingalliance.org.uk. We apply the security measures described above. As Processor, if we become aware of a personal data breach affecting referee data, we notify the Controller (organisation) without undue delay and support their assessment and notifications. The Controller is responsible for ICO notifications where required.

Your rights

Under UK GDPR, you have rights including access, rectification, erasure, restriction, objection and data portability. Where consent is relied on you can withdraw it at any time, without affecting the lawfulness of anything done before you withdrew it. Contact the organisation (the Controller) to exercise these rights; we will assist the organisation as required to fulfil your requests. You can also raise a complaint with us about how we have handled your data, and you have the right to complain to the ICO.

Keeping your information accurate

Please make sure the information you give in a reference is accurate at the point you submit it. A reference cannot be amended through the service once it has been submitted. If you need to correct something afterwards, contact the organisation that requested the reference — it is the Controller for that record and decides whether to amend it.

Your responsibilities for accuracy are set out in our Terms & Conditions.

How long we keep data

Applicant SafeApply account and profile (we are Controller): We keep your account and profile data while your SafeApply account is active and for 30 days afterwards to meet legal and security obligations, after which it is deleted or anonymized.

Your applications to roles, referees, and staff (SafeRecord): The organisation (as Controller) determines retention periods for application and referee data. At the end of a customer contract, that data is deleted or anonymized in accordance with the organisation's instructions and our Data Processing Addendum, unless legal obligations require retention.

Organisation user accounts and organisation profiles: We (as Controller) keep data while your account is active and for 90 days afterwards to meet legal and security obligations, after which it is deleted or anonymized.

International users

The Safer Recruitment Suite is used by organisations and individuals in multiple countries. Application data is hosted in the United Kingdom (AWS London). If you access the service from outside the UK, your personal data may be processed in the UK and, in limited circumstances (such as technical support or email delivery), accessed from other countries under appropriate safeguards as described above. Depending on where you live, you may have additional rights under local data protection law. Nothing in this Privacy Policy limits rights that cannot be limited under mandatory local law.

Communications

We send product and service updates about the service you already use, based on our legitimate interests. You can object to these at any time. We do not currently send marketing communications. If we introduce them, they will be sent only with your consent, your preference will be held in your account settings, and you can withdraw it at any time — for example through those settings, an unsubscribe link, or by emailing wg@thesafeguardingalliance.org.uk.

Do you have to provide your data?

Some of the information we ask for is necessary; the rest is optional, and we say so where it is.

Organisation staff accounts. Your name, work email and role are needed so that your organisation can give you an account and so we can authenticate you and keep the service secure. Without them an account cannot be provided. This is a contractual requirement of the service your organisation has taken.
Applicant accounts. An email address and password are needed to create a SafeApply account. Profile information such as employment and education history is optional — it exists to save you re-typing when you apply — and you can leave it blank, complete it later, or remove it.
Applications to a role. The organisation advertising the role decides what it asks for and what is mandatory. If you do not provide the information it has marked as required, you may not be able to submit the application, and the organisation may not be able to consider you.
References. Referees are asked for information by the organisation requesting the reference. Providing a reference is voluntary, but an incomplete reference may mean the organisation cannot rely on it.
Marketing. Always optional. Declining it has no effect on your account or your application.

There is no statutory obligation on you to provide any of this information to us.

Children

The service is not intended for individuals under 16 and we do not knowingly collect personal data from children under 16.

Concerns & complaints

If you think we have handled your personal data in a way that breaches data protection law, you have the right to complain to us, and we would rather hear from you first so we can put it right.

How to complain. Email our Data Protection Officer at dpo@thesafeguardingalliance.org.uk, or write to the Data Protection Officer, The Safeguarding Alliance Limited, 124 Finchley Road, London, England, NW3 5JS. You do not need to use any particular form of words, and you do not need to be a customer to complain.

What we will do.

We will acknowledge your complaint within 30 days of receiving it, and tell you what will happen next.
We will take appropriate steps to look into it without undue delay, including making reasonable enquiries.
We will keep you informed of progress, and tell you the outcome and our reasons in plain language.
We keep a record of complaints and how they were resolved.

Where the complaint concerns data an organisation controls — for example an application you submitted, a reference, or a staff record — that organisation is the Controller and is responsible for responding. We will pass your complaint to it and support it in responding, and we will tell you that we have done so.

Complaining to the regulator. You can complain to the UK Information Commissioner's Office at any time, and you do not have to complain to us first. The ICO can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are outside the UK, you may also complain to your local supervisory authority.

Changes to this policy

We may update this notice from time to time. For material changes, we will notify administrators in-app or by email.

Contact

Email: wg@thesafeguardingalliance.org.uk