1. Who we are
Yezda Solutions Group Ltd ("Yezda", "we", "us") is a company registered in England and Wales (company no. 17092752), with registered office at 12B George Street, Bath, England, BA1 2EH. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC147640.
Our screening operations are carried out in accordance with BS7858:2019 (Screening of individuals working in a secure environment — Code of practice), the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Our Data Protection Officer, Zach Hewlett-Walker, can be contacted at info@yezda.co.uk.
2. Scope of this policy
This policy applies to four groups of people:
- Candidates — individuals being screened, who interact with us through the Yezda mobile app and screening journey.
- Customer users — staff at organisations that use the Yezda platform to screen people, who access the organisation portal.
- Referees and previous employers — third parties whose details are provided to us as part of a candidate's history.
- Public site visitors — anyone using yezda.co.uk, including the public certificate verification page.
Controller / processor split. When we screen candidates on behalf of an organisation, the organisation is the controller and Yezda is the processor. We act as controller for our own marketing site, customer-account data, payment records, and where a candidate uses the public app independently of any sponsoring organisation.
3. Personal data we collect
From candidates (BS7858 screening)
- Identity: full name, date of birth, current and previous addresses (5-year minimum, per BS7858 §6.3), nationality, right-to-work status, photograph (selfie), passport / driving licence / national identity card images.
- History: 5-year work history including periods of unemployment, education, self-employment, voluntary work, travel and caring; gap explanations; reasons for leaving previous roles.
- References: contact details and responses from employers, educators and character referees; corroboration of dates, role, conduct and reason for leaving.
- Financial: credit history check via licensed credit reference agency (where required by your sponsoring organisation), CCJs, IVAs, bankruptcies, sanctions and PEP screening.
- Criminal record (where contracted): declared unspent convictions; basic DBS check results where the customer has a lawful basis to receive them.
- Biometric & device: liveness check data and ID document forensics processed by our identity verification partner.
- Communications: messages exchanged with your sponsoring organisation's screening team, push notification tokens, support tickets.
From customer users
- Name, work email, role, organisation, login credentials, IP address, user-agent, audit log of actions.
- How you use the portal: pages visited, features used and key account events (sign-up, free trial, plan and payment changes, screenings started and completed). Recorded with PostHog against your user ID and your organisation, without cookies or anything else stored on your device, and with on-screen text and candidate details removed before it leaves your browser.
From site visitors
- Pages viewed, approximate location (country / region from IP), device type, referring URL, cookie data (see our Cookies Policy).
- Only if you allow advertising cookies: the campaign or advert that brought you to us (UTM tags and ad click identifiers) and the identifiers the ad platforms' own tags set in your browser — each only for the platforms you allowed.
- A record of your cookie choices: a random consent ID, what you allowed, the banner version you saw, your browser type and the time.
4. Why we use your data
| Purpose | Categories | Lawful basis |
|---|
| Carry out BS7858 screening | Identity, history, references, financial, criminal | Contract (with sponsoring org); legal obligation; legitimate interests of the customer in workforce vetting |
| Verify identity & detect document fraud | Biometric, ID document, liveness | Substantial public interest (preventing crime); explicit consent for biometrics |
| Issue and host screening certificates | Outcome, validity dates, candidate name | Contract; legitimate interests |
| Provide the customer portal & mobile app | Account data, communications | Contract |
| Service emails (status updates, certificate ready) | Email, status | Contract; legitimate interests |
| Marketing to organisations (B2B) | Work email, role, organisation | Legitimate interests (with opt-out) |
| Measure our website and our own advertising: which pages are used, and which adverts led to a visit, sign-up, free trial or first payment | Pages viewed, campaign and ad click identifiers; for customers who sign up, a hashed (SHA-256) work email and name, IP address and browser type | Consent (cookie banner), which you can withdraw at any time |
| Understand how customers use the portal, to improve it and to support and sell to customer organisations | Portal pages visited and features used, user ID, role, organisation and account events; never candidate or screening details | Legitimate interests |
| Comply with legal & regulatory obligations | All categories as required | Legal obligation |
| Defend legal claims & disputes | Audit logs, screening file | Legitimate interests |
5. Providing your data — is it statutory or contractual?
The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations. We need personal data in order to:
- enter into and perform our contract with your sponsoring organisation (or with you directly);
- carry out the BS7858 screening, manage accounts, and deliver our services;
- verify identity and prevent fraud; and
- comply with applicable legal, regulatory, accounting and tax obligations.
What are the consequences of not providing it? If you choose not to provide the personal data we request, we may be unable to:
- enter into or perform a contract with you;
- complete your screening or issue a certificate;
- conduct the necessary identity, compliance or fraud-prevention checks;
and, as a result, the screening — and any role that depends on it — may be delayed, restricted or declined.
Where we ask for personal data for optional purposes, such as marketing communications, providing it is not mandatory and you may withdraw your consent at any time without affecting the services you receive from us.
6. Lawful bases & special category data
Some data we process during screening is "special category" data under Article 9 UK GDPR (e.g. biometric data, data relating to criminal convictions under Article 10). For each special category, we rely on a specific Article 9 / Schedule 1 DPA 2018 condition:
- Biometric (liveness): Article 9(2)(a) — explicit consent, given separately in-app and revocable.
- Criminal disclosure: Article 10 + Schedule 1 Part 2 §11 DPA 2018 — preventing or detecting unlawful acts; combined with the customer's substantial-public-interest condition.
- Health / disability data (only where volunteered to explain a history gap): Article 9(2)(h) where reasonable adjustment is needed; otherwise we discard.
7. Where we get data from
- From you directly (mobile app, web portal, calls, email).
- From your sponsoring organisation (your name, role applied for, contracted check level).
- From third-party processors Yezda integrates into the platform: Our nominated IDV provider (identity & document verification), Creditsafe and its data partner TransUnion (credit, AML, PEP, sanctions — see section 8), GBG (address verification), HMRC tax-year-overview validation.
- From referees and previous employers you nominate.
- From public registers (Companies House, electoral roll, insolvency register).
8. Credit reference and affordability checks
To help assess applications, prevent fraud, and meet legal and regulatory obligations, we and your sponsoring organisation may obtain information about you from credit reference agencies (CRAs). We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.
- Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority — FCA Firm Reference Number 742313.
- TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority — FCA Firm Reference Number 737740.
The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.
Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices: Creditsafe Transparency Notice and TransUnion Bureau Privacy Notice.
9. Who we share data with
- Your sponsoring organisation — the screening outcome, certificate, and the structured report. We do not share your raw documents (e.g. passport scan) unless you have explicitly consented.
- Our sub-processors — see the list maintained at our DPA. All sub-processors are bound by contractual data-protection terms equivalent to ours.
- Advertising and analytics platforms — Google, LinkedIn, Meta, Microsoft, Reddit, TikTok and X, each only if you allowed that platform in our cookie banner, and only the measurement data described in section 4. They act as independent controllers of that data under their own privacy policies. Candidate and screening data is never shared with them.
- Product analytics — PostHog, hosted in the EU (Frankfurt), processes portal usage on our behalf, and website usage if you allowed analytics cookies. Candidate and screening data is never sent to it.
- Regulators, law enforcement, courts — where compelled by valid legal process, or where disclosure is necessary to prevent or detect crime.
- Professional advisers — auditors, lawyers, insurers under duties of confidentiality.
- A successor in the event of a corporate restructure, merger or sale, subject to equivalent protections.
We do not sell personal data, and we never use candidate or screening data for advertising.
10. International transfers
Yezda's primary infrastructure is hosted in the UK (London region). Limited transfers may occur to the EEA (data resilience), and to the US for support tooling. Where data leaves the UK, we rely on:
- UK adequacy decisions (EEA, and the UK extension to the EU–US Data Privacy Framework where the recipient is certified); or
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, plus a transfer risk assessment.
11. How long we keep data
| Data | Retention | Reason |
|---|
| Active screening file | Duration of screening | Operational |
| Completed screening file (with passed certificate) | 7 years from certificate date | BS7858 §10.1 audit; defence of claims |
| Failed / withdrawn screening | 12 months from outcome | Dispute window; statistical reporting |
| Biometric (liveness) raw data | 30 days from match decision | Data minimisation |
| Criminal disclosure source documents | 6 months from outcome (then destroyed) | DBS code of practice |
| Customer account & billing records | 7 years after contract ends | Companies Act / HMRC |
| Advertising attribution for a customer sign-up | 26 months from sign-up | Measuring campaign performance |
| Record of your cookie choices | 28 months from the choice | Demonstrating consent (UK GDPR Art. 7(1)) |
| Marketing prospect data | Until opt-out + 30 days | PECR / suppression |
12. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Rectify inaccurate data.
- Erase data, subject to our legal retention obligations.
- Restrict or object to processing.
- Data portability — receive a structured copy of data you provided to us.
- Withdraw consent at any time where we rely on consent.
- Not be subject to solely-automated decisions with legal or similarly significant effects. The Yezda platform compiles the results of the checks your sponsoring organisation has contracted; the final assessment and any hiring decision are taken by a person at that organisation, not by an automated process alone. You can request human intervention, express your point of view, and contest a decision by contacting your sponsoring organisation or info@yezda.co.uk.
- Complain to the ICO at ico.org.uk or 0303 123 1113.
Email info@yezda.co.uk to exercise any right. We will respond within one calendar month.
13. Security
Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Document storage uses object-level access tokens with short expiry. Access is role-based and audit-logged; multi-factor authentication is mandatory for all Yezda staff and customer admins. Penetration testing is carried out annually by an independent CREST-accredited tester.
14. Children's data
Yezda's services are not directed at children. BS7858 screening is only carried out for individuals aged 16+; in practice, the population we screen is overwhelmingly adult. We do not knowingly collect data from anyone under 16 via our marketing site.
15. Changes to this policy
We will notify customers of material changes by email at least 30 days before they take effect. Candidates are notified in-app on next sign-in. The version date at the top of this page reflects the most recent revision.
Yezda Solutions Group Ltd · Zach Hewlett-Walker, Data Protection Officer · 12B George Street, Bath, England, BA1 2EH · info@yezda.co.uk