Privacy notice
In short. 321GoCheck runs background checks for UK employers, landlords and letting agents. When a client orders a check on you, the client decides what is checked and why, and we carry out the check for them. We collect only what the checks need, store it in the UK, never let AI make a decision about you on its own, and delete it when it is no longer needed.
1. Who we are
321GoCheck is a trading name of 3-2-1-GOCHECK LIMITED, registered in England and Wales, company number 13616585, registered office 110 Carlton Avenue East, Wembley, Middlesex HA9 8LY (“321GoCheck”, “we”, “us”).
Contact our privacy team at privacy@321gocheck.com, or write to us at the address above.
2. Our role: controller or processor
When a client orders a check on you, the client (your prospective employer, landlord or letting agent) is the controller of your personal data: they decide which checks are carried out and why. We act as their processor and use your data only on their instructions and under our contract with them. For questions about why a check is needed, contact the client; we will also help you and pass your request on.
We are the controller for our own website, for client accounts and billing, for keeping our platform secure and preventing fraud, and for improving our services as described in section 6.
3. Whose data this notice covers
- Candidates: job applicants, employees, tenants and guarantors whose background is checked;
- referees who confirm a candidate's history;
- clients and their users who order checks;
- visitors to our website.
4. What we collect and where it comes from
What we collect depends on the checks the client has ordered. You will see each item you are asked for before you submit it.
| Type of data | Examples | Source |
|---|---|---|
| Identity and contact details | Name, previous names, date of birth, address and address history, email address, mobile number | You, or the client who ordered the check |
| Identity documents | Images of passports, driving licences and other documents, and the details read from them | You |
| Selfie, liveness video and voice recording | Used to confirm you are the person in your identity document. This is biometric data (special category data), collected only after you give your explicit consent in the app | You |
| Right to work and right to rent | Share codes, eVisa and immigration status details, and the result of the Home Office check | You and the Home Office online service |
| Criminal record information | Basic DBS check details and results, overseas criminal record certificates, police validation (criminal offence data) | You, the Disclosure and Barring Service (DBS) and overseas authorities |
| Employment, education and references | Employment and education history, referee contact details and what referees tell us | You and your referees |
| Financial standing | Credit history, county court judgments, bankruptcy and insolvency records, and income confirmed through open banking if you choose to connect your bank | You, credit reference agencies, public registers and our open banking provider (TrueLayer) |
| Public register and media results | Whether you appear on the UK Sanctions List, are a politically exposed person (from UK Parliament data), on the FCA register or a disqualified director at Companies House, and relevant adverse or social media | Public registers and publicly available sources |
| Client account details | Name, work email, phone number, company details, orders, invoices and payment status (card numbers are handled by Stripe, not stored by us) | The client and Stripe |
| Technical data | IP address, device and browser details, sign-in records and activity logs | Your device |
5. Why we use it and our lawful basis
Background checks ordered by a client
We use your data to carry out the checks the client ordered and produce their report. The client relies on its own lawful basis, usually a legal obligation (for example right to work checks under immigration law, or right to rent checks) or its legitimate interest in making a safe hiring or letting decision.
- Biometric data (face and voice used to confirm your identity) is special category data. We ask for your explicit consent (UK GDPR Article 9(2)(a)) in the app before the camera or microphone starts, and record when you gave it. You can withdraw it at any time by emailing us. If you do not want your face or voice to be used, ask the client about another way to prove your identity.
- Criminal record data is used only where the law allows it, under UK GDPR Article 10 and a condition in Schedule 1 of the Data Protection Act 2018, such as the client's obligations in connection with employment.
Our own purposes
- To provide and bill for our service to clients: performance of our contract.
- To keep the platform secure, detect and prevent fraud, and keep records of what happened: legitimate interests.
- To improve our checks and our assistants, using pseudonymised or aggregated data where possible: legitimate interests.
- To meet our legal and regulatory obligations, and to establish or defend legal claims: legal obligation and legitimate interests.
- To send clients news about our service: consent or legitimate interests, and you can opt out at any time.
6. How we use AI
AI assistants help candidates fill in their details (for example by reading values from a document for the candidate to confirm) and help our checkers prepare each check, for example by comparing documents, references and register results and suggesting an answer.
- We use Anthropic's Claude models through Microsoft Foundry on Microsoft Azure. Under their terms, the data we send is not used to train their models.
- A trained checker reviews every AI suggestion and makes every decision. No decision with legal or similarly significant effects is made about you by automated means alone.
- We keep a record of what the assistants suggested and what was confirmed. The working detail of the candidate assistant is trimmed after 180 days.
7. Who we share it with
We do not sell personal data. We share it only as follows, and our service providers act on our instructions under written contracts.
| Recipient | What and why |
|---|---|
| The client who ordered your check | The results and report for the checks they ordered. They do not see more than the checks need. |
| Your referees | Only the details needed for them to confirm your claims, such as your name, dates and job title. |
| The Disclosure and Barring Service and other public bodies | The details needed to run a check you have applied for, for example a Basic DBS check. |
| Google Cloud | Hosts our platform and stores data in the London region (europe-west2). |
| Microsoft (Azure and Microsoft Foundry) | Runs the AI models we use, including Anthropic's Claude, under Microsoft's data protection terms. |
| Twilio | Sends text messages, for example sign-in codes. |
| Stripe | Takes card payments from clients. |
| TrueLayer | Open banking, only if you choose to connect your bank for income verification. |
| Credit reference agencies and data providers | Credit, county court judgment and register searches for the checks ordered. |
| Email provider | Sends our emails, such as invitations, reminders and reports. |
| Professional advisers and authorities | Where the law requires it, or to establish or defend legal claims. |
Clients can ask us for the current list of our service providers.
8. Transfers outside the UK
We store your data in the UK. Where a service provider processes personal data outside the UK, we make sure it is protected by UK adequacy regulations or by the International Data Transfer Agreement or Addendum approved under UK law. Contact us for a copy of the safeguards.
9. How long we keep it
We keep check data for as long as the client's contract with us and the law require, and then delete or anonymise it. Clients can ask us to delete a candidate's data sooner. Accounts that are no longer used are deleted after two years. Records needed for accounting or legal claims are kept for as long as those obligations last.
10. How we protect it
Data is encrypted in transit, staff and administrators use multi-factor authentication, access is limited to the people who need it, and our staff are background checked and trained in data protection. If a breach affects your data and is likely to put you at risk, we will tell the client and, where required, you and the ICO. Read more on our data security page.
11. Your rights
Under UK data protection law you have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have your data deleted, or its use restricted, in some circumstances;
- object to processing based on legitimate interests;
- receive your data in a portable format, where processing is based on consent or contract;
- withdraw consent at any time, without affecting what was done before;
- not be subject to a decision based solely on automated processing that significantly affects you.
Email privacy@321gocheck.com to use your rights. Where a client ordered your check, we will pass your request to them and help them answer it. We reply within one month.
12. Cookies and analytics
Our website uses cookies that are needed for it to work. Google Analytics cookies, which help us understand how visitors use the site, are set only if you accept them in the cookie banner; you can change your choice at any time with “Cookie settings” at the bottom of every page. Our apps use cookies and local storage only to keep you signed in.
13. Complaints
Please contact us first at privacy@321gocheck.com so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint (opens in a new tab), telephone 0303 123 1113.
14. Changes to this notice
We update this notice when our services or the law change. The date at the top shows the latest version. Our approach to privacy is also described in our data security page and our client terms and conditions.
