Privacy
Privacy Policy
What we collect, why, who sees it, how long we keep it and your rights.
Last updated: 10 October 2026
This policy covers personal information we collect through this website and while providing our AccessNI application service. The AccessNI application itself is completed on nidirect and is covered by AccessNI's own privacy notice (opens in a new tab).
Who we are
Access Compliance Group is the controller for the information described in this policy. Company number 554746. Our address is Office 21831, 182-184 High Street North, East Ham, London E6 2JA. For anything about your information, email info@accesscg.co.uk.
If an employer or organisation arranges your check through us, they are also responsible for the information they hold about you, and their own privacy notice applies to that.
What we collect
When you make an enquiry, start a check or set up your organisation we collect:
- your name, email address and phone number
- your organisation's name, sector, size and postcode, or the name and email address of the organisation you will work for, if you give them
- what you tell us about the role, including whether the work involves children or adults receiving care, and whether it is paid, voluntary or self-employed
- the check you asked for and its progress
- that you accepted our terms, and when
When an organisation places an order for its staff we also collect:
- the name, work email address and phone number of the person placing the order
- the staff list described under “If your employer has booked your check” below
- the invoice number, and when the order was invoiced and paid
When you pay we also hold:
- the amount, the date and GoCardless's reference for the payment
- a record of the receipt email we sent you
We do not receive your bank details. You approve the payment with your own bank through GoCardless.
We don't ask for identity documents, dates of birth or criminal record information through this website. Please don't send them to us by email or through our forms.
The “find the right check” questions run in your browser. Your answers are not sent to us or stored.
If your employer has booked your check
Organisations can book checks for their staff and volunteers through us. If yours has, it has given us:
- your name and work email address
- your job role, and whether the role is voluntary
We did not collect these from you directly. We use them to confirm which check your role needs, to email you your application link, our PIN and identity document instructions, to remind you if you have not applied, and to record how far your application has got.
Your employer can see that progress: invited, applied, countersigned, certificate issued. It cannot see your application, your identity documents or what your certificate says through us. You complete the application yourself in your own nidirect account, and we never ask for your nidirect log-in.
Your employer is responsible for telling you it has shared your details and why. If you think it should not have, speak to it first; you can also contact us.
Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry | Our legitimate interest in responding to people who contact us |
| Providing the check you asked for: assessing the role, taking payment, sending your receipt, PIN and instructions, and countersigning | Contract with you, or steps you ask us to take before one |
| Meeting our duties as an AccessNI registered body, and keeping tax and accounting records | Legal obligation |
| Arranging a check your employer has booked for you: inviting you, reminding you and recording progress | Our legitimate interest, and your employer's, in carrying out a check the role requires; and our contract with your employer |
| Preventing fraud, misuse of our PIN and abuse of this website | Our legitimate interest in keeping the service secure |
We do not use your information for marketing unless you ask us to, and we never sell it. We do not make decisions about you by automated means: a signatory reviews every application.
If you don't give us the information we ask for, we may not be able to provide the check.
AccessNI applications and criminal record information
Your application, identity documents and certificate are held by AccessNI in the nidirect system, not on this website. As a registered body our signatories see your application and uploaded documents in that system in order to verify and countersign it.
- AccessNI issues the certificate to you only. We don't receive or keep a copy.
- We don't see what your certificate says unless you choose to show us.
- We handle anything we do see under the AccessNI Code of Practice (opens in a new tab) and our secure handling policy.
Who we share it with
We share your information only with:
- AccessNI, when we countersign and submit your application
- the organisation you will work for, where they are our client or you have asked us to contact them, and only about the progress of your check. An organisation that booked your check follows that progress on a private tracking page
- the service providers below, who process it on our behalf and under contract
- regulators, the police or the courts, where the law requires it
| Provider | What for |
|---|---|
| Supabase | Database holding enquiries and check requests, stored in London |
| Vercel | Hosting this website |
| GoCardless | Taking bank payments. GoCardless has its own privacy notice |
| Microsoft 365 | Our email, including the receipt we send you |
Transfers outside the UK
Our database is in the UK. Some of our providers are based in, or use support staff in, other countries, including the United States. Where information is transferred outside the UK we rely on UK adequacy regulations or the contractual safeguards approved under UK data protection law.
How long we keep it
| Information | Kept for |
|---|---|
| Enquiries and requests that don't lead to a paid check | 12 months |
| Paid check requests, payment records and receipts | Six years after the end of the financial year, as tax law requires |
| Company orders, including the staff named on them and their progress | Six years after the end of the financial year, with the invoice records |
| Disclosure information, if an applicant shows it to us | Not kept after the purpose is met, and never more than six months |
| Identity documents | Not held by us. AccessNI destroys them 90 days after the certificate is issued |
How we keep it secure
This website is served only over an encrypted connection. Our database can be reached only by our own systems and authorised staff. Payment pages are provided by GoCardless. No system is perfectly secure; if a breach affected your rights we would tell you and the Information Commissioner's Office as the law requires.
Cookies
This website doesn't use advertising or analytics cookies. While you are paying, your browser remembers that a payment is in progress so the page can pick up where you left off; that is cleared when you close the tab. GoCardless's payment pages use their own cookies. A sign-in cookie is set only for our own staff when they use our internal system.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct it if it is wrong
- delete it, or restrict how we use it, where the law allows
- stop using it where we rely on our legitimate interests
- send it to you or another organisation in a portable form
There is no charge. We reply within one month and may ask you to confirm who you are first. Once an application has been submitted to AccessNI we cannot change it; corrections to the application itself go through AccessNI. Email info@accesscg.co.uk.
Complaints
Please tell us first so we can put it right; see our complaints procedure. You can also complain to the ICO (opens in a new tab).
Changes to this policy
We update this policy when what we do changes. The date at the top shows the latest version.