Privacy Policy
SMS System — UK Sponsor Licence Compliance Platform
Draft for solicitor review — not for publication until reviewed. Last updated: 19 June 2026
1. Who we are
Agentbill Technologies Limited ("we", "us", "our") is the data controller for account-level information (your own login and billing details) and a data processor for information you input about your sponsored workers and employees, which you control as their employer. See Section 3 for how this distinction works in practice.
Registered in England and Wales, company number 16827332. ICO registration number: ZC178248. Data Protection contact: support@smssystem.co.uk.
2. What this policy covers
This policy explains how we collect, use, store, and protect personal data through SMS System (the "Service"), including:
- Your own account data, as a user of the Service
- Personal data about your sponsored workers and employees, which you (the sponsor licence holder) input or upload to the Service
3. Controller and processor roles
3.1 For your own account information (name, email, login details, billing information), we are the data controller.
3.2 For information about your sponsored workers and employees (names, passport details, salary, visa status, right-to-work evidence, and similar data you input or upload), you are the data controller and we are the data processor, acting only on your instructions to provide the Service. You are responsible for ensuring you have a lawful basis to process this data about your employees and for meeting your own transparency obligations to them (for example, via your employee privacy notice).
3.3 A separate Data Processing Agreement, available on request, governs our processing of this data on your behalf in more detail.
4. What personal data we process
4.1 Account-level data (you, the user)
- Name, email address, password (encrypted)
- Role within your organisation (owner, HR manager, employee)
- Login and activity timestamps, for security and audit purposes
4.2 Sponsored worker / employee data (input by you)
The Service is built to support UK sponsor compliance record-keeping, which by its nature involves sensitive personal data. This may include:
- Identity data: full name, date of birth, nationality, gender
- Immigration data: passport number and expiry, visa type and expiry, Certificate of Sponsorship reference and details, share codes, right-to-work check evidence
- National Insurance number (special category-adjacent — used for HMRC starter checklist / payroll record-keeping purposes)
- Employment data: job title, SOC code, salary, contract type, hours, work location, start / end dates
- Contact data: current and historical UK address (and overseas address where applicable), personal email, phone number, emergency contact details
- Bank account details (sort code, account number) — collected for payroll administration purposes only. Bank details are not accessible to the employee via the Service after submission, and are visible only to the employer's authorised HR / owner users.
- Pension scheme and contribution information
- Health-related data: where you choose to record whether a worker is registered disabled or has special requirements, this is special category data under UK GDPR and requires explicit consent or another applicable lawful basis, which you (as controller) are responsible for establishing.
- Timesheet, leave, and absence records
- Documents you upload: contracts, qualification certificates, P45 forms, HMRC starter checklists, and similar
4.3 Data we generate
- Compliance evaluation results (e.g. whether a salary meets a threshold, whether a document is approaching expiry)
- Audit trail / activity logs of actions taken within the Service
- AI-extracted data from uploaded documents (e.g. fields read from a Certificate of Sponsorship PDF)
5. Why we process this data
We process account-level data to provide and secure the Service, and to communicate with you about your account.
We process sponsored-worker data solely on your instructions, as your processor, for the purpose of helping you organise and track your sponsor compliance obligations. We do not use this data for our own marketing, profiling, or any purpose unrelated to providing the Service to you.
6. AI processing
6.1 The Service uses AI-assisted extraction to read structured data from documents you upload (such as Certificates of Sponsorship and payslips), and AI-assisted generation for certain content (such as draft job descriptions).
6.2 Documents and data submitted for AI processing are sent to [name the AI provider(s) actually used] for processing. The specific AI infrastructure provider(s) and their data handling terms must be confirmed and named here before publication.
6.3 AI-extracted data is always presented to you for review and confirmation before being saved to a worker's record — it is not automatically treated as final.
7. Where your data is stored and processed
7.1 The Service is built on [Lovable Cloud / Supabase — confirm exact infrastructure] hosting, with data stored in [confirm hosting region]. If any infrastructure provider stores or processes data outside the UK or EEA, an international transfer mechanism (such as the UK International Data Transfer Agreement) will be put in place and disclosed here.
7.2 We use the following categories of sub-processor:
- Cloud hosting and database infrastructure: [Supabase / Lovable Cloud — confirm]
- AI processing for document extraction: [confirm provider]
- Email delivery (for notifications, password resets, invites): [confirm provider]
A full list of sub-processors is available on request.
8. How long we keep data
8.1 Sponsored worker compliance records (CoS details, right-to-work evidence, salary history, reportable change logs) are retained for the duration of your subscription, plus a period afterward consistent with Home Office guidance, which generally recommends sponsors retain records for a period after sponsorship ends. The exact retention period (per Appendix D of the sponsor guidance) will be confirmed against the current version of the guidance prior to publication.
8.2 Account data is retained for the duration of your subscription. Following termination, you may export your data for 30 days, after which it will be deleted, subject to any overriding legal retention requirement (for example, HMRC starter checklist records, which must be retained for the current and previous 3 tax years under HMRC rules, regardless of whether you remain a customer).
8.3 Audit logs and activity records (who changed what, when) are retained for a period to be confirmed, to support your own compliance evidence needs.
9. Your rights and your employees' rights
9.1 As a user of the Service with your own account, you have the right to access, correct, or delete your account data, and to object to or restrict certain processing, in accordance with UK GDPR.
9.2 Where we process data about your employees as your processor, requests from those individuals about their own data should generally be directed to you, their employer, as the data controller. We will assist you in responding to such requests where required under our Data Processing Agreement.
9.3 To exercise your own rights, contact support@smssystem.co.uk. We will respond within the statutory timeframe (generally one month).
10. Security
10.1 We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access controls, and audit logging of changes to sensitive records.
10.2 Certain fields (such as bank account details) are restricted so that even the individual employee cannot view their own submitted values via the Service, reducing exposure if an account is compromised.
10.3 Once Cyber Essentials certification is obtained, it will be referenced here as a concrete, verifiable security commitment.
11. Children's data
The Service is not directed at or intended for use by children. We do not knowingly collect data about individuals under 18 in connection with employment, other than where a sponsored worker's date of birth indicates they are a minor, which is not expected in the ordinary use of this Service given the nature of sponsored employment routes.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or in-app notice.
13. Complaints
If you believe your data has been mishandled, you can contact us at support@smssystem.co.uk, or lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
14. Contact
Agentbill Technologies Limited
167-169 Great Portland Street, 5th Floor
London W1W 5PF, United Kingdom
support@smssystem.co.uk
ICO registration number: ZC178248