Privacy Policy
1. Who We Are
Aegis Care Shield Ltd (“we”, “us”, “our”) is a company registered in England and Wales. We operate SafeRecruit, a compliance and workforce management platform for care sector organisations.
For the purposes of this policy:
- We act as data controller in respect of account holders, billing contacts, and visitors to our website.
- We act as data processor in respect of staff and worker records that our customers upload or manage through the SafeRecruit platform. In those cases, the customer organisation is the data controller.
We are registered with the UK Information Commissioner’s Office (ICO). Our registration reference is ZC186677.
Contact: support@aegiscareshield.com
Aegis Care Shield Ltd, Office 5678, 58 Peregrine Road, Hainault, Essex, IG6 3SZ
2. What Personal Data We Collect
2.1 Account holders and administrators
When you sign up for SafeRecruit or manage a subscription, we collect:
- Full name and work email address
- Organisation name
- Billing information (processed by Stripe — we do not store card details)
- Login activity and session data
- Communications you send us
Lawful basis: Contract (Article 6(1)(b) UK GDPR) for account and billing data; legitimate interests (Article 6(1)(f)) for security and fraud prevention.
2.2 Staff and worker records (processed on behalf of customers)
Where your organisation uses SafeRecruit to manage staff compliance, the platform may hold: staff names and contact details, employment information, right to work and identity documents, DBS certificate references and update service check results, professional registrations and qualifications, expiry dates for compliance documents, e-signatures on onboarding forms, and reference passport records.
We process this data solely on the instructions of the customer organisation (the data controller). If you are a staff member with questions about your data, please contact your employer directly.
2.3 Website visitors
We collect standard server log data (IP address, browser type, pages visited) for security and operational purposes. We do not use analytics cookies or tracking scripts.
3. How We Use Your Data
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing and operating SafeRecruit | Account and billing data | Contract |
| Processing payments | Billing data via Stripe | Contract |
| Sending service emails | Email address | Contract / Legitimate interests |
| Responding to support requests | Name, email, account details | Legitimate interests |
| Detecting and preventing fraud | Login logs, IP addresses | Legitimate interests |
| Complying with legal obligations | Billing records | Legal obligation |
| Processing staff compliance records | Staff data (as processor) | Customer’s instructions |
We do not sell personal data. We do not use personal data for marketing to third parties.
4. Third-Party Processors
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Ionos | Server hosting and data storage | EU (Germany) | EU adequacy |
| Stripe | Payment processing | USA | UK IDTA / SCCs |
| Brevo | Transactional email delivery | EU (France) | EU adequacy |
| Twilio | SMS notifications (where enabled) | USA | UK IDTA / SCCs |
| Sentry | Error monitoring and diagnostics | EU (Germany) | EU adequacy |
5. Data Retention
| Data type | Retention period |
|---|---|
| Account and admin data | Duration of subscription + 90 days |
| Staff and worker records | Duration of subscription + 90 days, then permanently deleted |
| Billing and financial records | 7 years (HMRC requirement) |
| Security and access logs | 12 months |
| Support communications | 3 years |
6. Data Security
We implement appropriate technical and organisational measures including encrypted connections (TLS/HTTPS), access controls, dedicated database isolation, automated backups, and error monitoring. In the event of a personal data breach, we will notify the ICO within 72 hours and affected individuals without undue delay.
7. Your Rights
Under UK GDPR you have the right to: access, rectification, erasure, restriction, portability, objection, and to withdraw consent where we rely on it. To exercise your rights as an account holder, contact us at support@aegiscareshield.com. We will respond within one calendar month.
If you are a staff member whose data is managed by a care organisation using SafeRecruit, please direct your request to your employer.
8. Data Processing Agreement
Customers using SafeRecruit to manage staff data enter into a Data Processing Agreement with Aegis Care Shield Ltd as part of their subscription, governing how we process personal data on their behalf under UK GDPR Article 28.
9. Cookies
SafeRecruit uses a single session cookie (SAFESESSID) to maintain your login session. This is strictly necessary and does not track you across other websites. We do not use advertising, analytics, or tracking cookies.
10. Children
SafeRecruit is intended solely for use by adults (18 and over). We do not knowingly collect personal data from anyone under the age of 18.
11. Changes to This Policy
We may update this policy from time to time. We will notify active account holders of material changes by email at least 14 days before they take effect.
12. Contact and Complaints
Aegis Care Shield Ltd, Office 5678, 58 Peregrine Road, Hainault, Essex, IG6 3SZ
Email: support@aegiscareshield.com
You have the right to lodge a complaint with the Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — Tel: 0303 123 1113 — ico.org.uk