Data Processing Terms

Last updated: 4 October 2026

Roles

You are the controller of the personal data you add to LicenceGuard. That One Studio Ltd, trading as LicenceGuard, is your processor.

LicenceGuard is a trading name and product of That One Studio Ltd, a private limited company registered in England and Wales (company number 17169958). Registered office: 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB.

Details of the processing

• Subject matter and purpose: providing the LicenceGuard application, including HR, sponsor licence compliance, payroll, reporting and related features.
• Duration: for the term of your subscription and the retention period afterwards described below.
• Data subjects: your employees, workers, engaged workers and contractors, candidates and applicants, and your users.
• Types of data: identity and contact details; employment and organisation details; right to work and immigration or sponsorship information; DBS information; documents you upload; attendance, leave, training and performance records; pay, tax, National Insurance, pension and bank details; and audit records.
• Special category and criminal offence data: may include health information (for example, evidence attached to leave) and DBS information, where you choose to record it.

Our obligations

We will:

• process the personal data only on your documented instructions, which include using the application as designed and these terms;
• ensure that people authorised to process the data are bound by confidentiality;
• maintain appropriate technical and organisational security measures, described on our security page;
• help you respond to requests from individuals exercising their rights, using the export, correction and erasure tools in the application and our reasonable assistance;
• notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide information you reasonably need;
• provide reasonable assistance with data protection impact assessments and consultations with the ICO, where relevant to our processing;
• make available information reasonably needed to demonstrate compliance with these terms.

Sub-processors

You authorise us to use the following sub-processors. We will give you notice before adding or replacing a sub-processor, and you may object on reasonable grounds.

Sub-processor	Purpose	Location
Amazon Web Services (AWS)	Application hosting, database, encrypted document storage and transactional email	United Kingdom (London region)
Cloudflare	Domain name services, network security and traffic protection	Global network
Zoho	Support email, where you send us data while asking for help	See Zoho’s data centre locations

Stripe processes billing information about your organisation as an independent payment provider, not your workforce data. If you connect your own email server to LicenceGuard, notification emails are sent through that server under your own arrangements.

International transfers

Your workforce data is hosted in the UK. Where a sub-processor or its support personnel access data from outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum.

Return and deletion

You can export your data while you have access. When your subscription ends, your organisation’s data is kept for six months and then anonymised by a scheduled process, unless the law requires us to keep it longer. If you need deletion sooner, contact [email protected].

Your obligations

You are responsible for having a lawful basis for the personal data you add, for any notices you give to your workforce, for deciding who in your organisation can access what, and for the accuracy of the data you enter.

Contact

Questions about data processing: [email protected].