Last updated 10 October 2026 · Version 2026-10a
Who handles personal data for us
When we vet a candidate for an agency, the agency is the controller of the candidate's file and we are its processor. These services handle that data for us, each only on our instructions and under a contract that requires it to keep it safe.
| Who | What for | What passes through them | Where |
|---|---|---|---|
| Supabase | Our database, sign-in and file storage. Everything the service holds is kept here. | Everything described in this notice, including the documents candidates send. | London, United Kingdom. Supabase's support staff can reach it from elsewhere to keep it running. |
| Vercel | Hosts this website and the Staffroom24 app, and runs the code behind every page. | What passes through a page as it is used, and short-lived technical records of each request. | Our server code runs in London. Pages are delivered through its network worldwide, and it is a United States company. |
| Stripe | Takes card payments: an agency's card, and a candidate paying for their own criminal record check. | Card details, which go straight to Stripe and never through us, the name and email address on the payment, and what was paid for. | The United Kingdom, the European Economic Area and the United States. |
| Resend | Sends and receives our email: sign-in codes, invitations, reminders, and the replies people send us. | Email addresses, the messages themselves and anything attached to them. | The United States, with incoming email received in Ireland. |
| Daily | Runs the video calls for screening interviews, through its servers in London. | The call as it happens, the names of the people on it, and a recording where the candidate agrees to one when the call begins. A recording is moved to our own storage in London and then deleted from Daily. | London for the calls. Daily is a United States company, and holds a recording there only for the minutes it takes to move it to our storage in London. |
| Anthropic | Reads the documents and curricula vitae candidates send, so our staff are not retyping a passport or a job history, and helps Alex, your Staffroom24 assistant, word its answers from your own records. A member of our staff checks every reading before anything goes on a file, and anything that would leave the building waits for a person to approve it. | The document being read and the candidate's name to check it against; or the question asked and the parts of the records needed to answer it, which for our staff can include the messages and emails a candidate, an agency or a referee has sent us. | The United States. |
| OpenAI | Helps Alex, the Staffroom24 assistant, word its answers to questions from an agency or from our own staff, from the records the person asking can already see. Anything that would leave the building waits for a person to approve it. | The question asked, and the parts of the records needed to answer it, which for our staff can include the messages and emails a candidate, an agency or a referee has sent us. | The United States. |
| Quicker DBS | The umbrella body we apply through for Enhanced DBS with children's barred list checks. We give them your name and email address, and you fill the application in and confirm your identity on their site. | Your name and email address from us, the application and identity documents you give them, and the result. | The United Kingdom. |
| Suggesting addresses as you type, on the pages that ask for your address. | What is typed into the address box, and the address picked from the suggestions. | The United States. | |
| PostHog | Counts which pages of the website and the app are used, and records a masked replay of the visit and the errors pages hit, so we can improve them and fix faults. Only in a browser whose user chose Allow when asked, and nothing is sent from any other. Our own servers also send it their error reports, which store nothing on anybody's device. | The pages visited, with names, references and the codes in our links taken out of their addresses, the browser and device, and a random number for the browser. A replay of where people click and scroll, with every word, picture, document and signature on the screen hidden and nothing typed. Error messages and where in our code they happened, with names, email addresses and references taken out. For agency and staff users who are signed in, the reference of their account, their role and their agency. Never a name, an email address or anything from a file. | The European Union, on PostHog's cloud in Frankfurt. PostHog is a United States company. |
| QuickerSkills | Provides the safeguarding training courses a candidate can take, and tells us when they have passed. | The candidate's name and email address, and their course results. | The United Kingdom. |
The Disclosure and Barring Service, the Teaching Regulation Agency and the Home Office receive what each check needs. They act under their own legal powers, not on our instructions, so they are not on this list.
Data outside the United Kingdom
Where a service handles data outside the United Kingdom, we rely on the UK's adequacy regulations, including the UK–US data bridge for a company certified to it, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, with a transfer risk assessment for each. The two services that read documents and help word answers do not receive criminal record certificates or health information as we have set them up. You can ask for a copy of the safeguard that applies at hello@staffroom24.com.
When this list changes
We tell every agency in writing, by email to its owners and on this page, at least 30 days before we add or replace a sub-processor. An agency may object in that time by writing to hello@staffroom24.com. We will answer the objection, and if we cannot meet it, the agency may end its agreement with us before the change takes effect, with nothing further to pay for the time after it ends.
Candidates are told who handles their file in the candidate privacy notice and on their own privacy page.