EU Permit Prospects

Privacy notice

This is a template, not a finished legal document. The controller identity, establishment, supervisory authority, sub-processor list and DPIA reference below are placeholders. Have a data protection lawyer complete and review this before the service takes a real applicant. What is accurate here is the technical description of what the software actually does.

Who is responsible

The controller's registered legal name, address and supervisory authority are being finalized before this service takes a real applicant, and will be published here - see the notice above. Nothing below depends on that detail: it describes what the software actually does and why, which is accurate today.

What we collect, and why

  • Identity and contact data - name, date of birth, nationality, country of residence, email, phone. To identify you and to run the screening you asked for.
  • Education and employment data - your CV, qualifications, employer, salary, admission and funding details. To assess your prospects against the permit requirements.
  • Documents you upload - including a passport page. To verify what you told us.
  • An image of your face together with your open passport, captured live in your browser and compared against the passport page you upload separately. This is biometric data used for unique identification and is special-category data under Article 9 GDPR. We process it only on your explicit consent, and only for that single comparison, which is carried out once and reviewed by a person. We do not run face search, we do not match you against any other person, and we do not keep a biometric template.
  • Video and audio of five interview answers, and the transcripts made from them. To assess your spoken English.
  • Screening results from the sources listed below.
  • Technical and audit data - IP address, browser, and a log of every action taken on your file, including every time a reviewer opens one of your documents.

Our legal bases

  • Contract (Art. 6(1)(b)) - for delivering the assessment you paid for: reading your documents, checking consistency, assessing your English, writing the report.
  • Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) - for the biometric comparison and for the background screening from published sources. You can withdraw either at any time; withdrawing means we cannot complete the assessment, and we will refund you.
  • Legal obligation - for keeping payment records.

Exactly which sources we consult

The software consults these and nothing else. Every source actually consulted for your file, and every source that was unavailable, is printed in your report.

  • Sanctions, PEP and watchlist screening - OSINT_PROCESSING - screening against official published lists
  • Interpol public notices - OSINT_PROCESSING - official public register
  • Document and declaration consistency - Contract performance - verifying the applicant's own submission
  • Identity binding (photo against passport) - BIOMETRIC_LIVENESS - explicit consent, Art. 9(2)(a)
  • Institution and employer existence - Contract performance - sanity-checking declared organisations
  • Profiles the applicant gave us - OSINT_PROCESSING - identity, CV corroboration and consistency of stated intent, on URLs the applicant supplied. Never political or religious content.
  • Adverse media screening - OSINT_PROCESSING - consented screening of published reporting

If you give us links to your own profiles - professional or social - we look at them for three things only: that the profile is yours, that it agrees with your CV, and that nothing you have published contradicts the plan you described to us. We do not assess your political opinions, religious beliefs, or any other special-category characteristic, and our screening is instructed never to report on them. Giving us no links does not count against you.

We do not search for accounts you did not give us. We do not contact your employer, your university, your family or your references. We do not buy data about you from brokers. We do not share your file with employers, agents or recruiters.

Automated decision-making

Your assessment is prepared with software, including a large language model, but the result is decided and signed off by a named human reviewer before it reaches you. There is no path in the system that emails you a verdict without a person having reviewed the file. You can ask for the reasoning behind your result, contest it, and have a different reviewer look at your file again.

Who processes your data on our behalf

The specific sub-processor list - hosting, object storage, database, email delivery, payment processing, the speech-to-text provider, and the language model provider - each with its role, location and the transfer mechanism where the processing happens outside the EEA, is being finalized before this service takes a real applicant. Each one needs a data processing agreement in place, and any transfer outside the EEA needs a documented Article 46 mechanism.

How long we keep it

Your documents, interview recordings, transcripts and screening evidence are hard-deleted 90 days after your report is sent. What remains after that is an audit record with no personal data: that an assessment existed, when, and how it was decided. Payment records are kept as long as tax law requires.

You can have everything deleted sooner, at any time, from your data page. Deletion happens immediately, not on a queue.

Your rights

You have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent, receive your data in a portable form, and complain to a supervisory authority.

Access and deletion do not require a request. Both are buttons on your data page: one downloads your entire file as a ZIP, the other deletes it immediately. You do not have to tell us why, and we do not review either decision. For anything else - a correction, an objection - reply to the most recent email we sent you, with your reference number, and we answer within one month.

Where your data is held

Application data and uploaded files are stored in the European Union. Some processors may operate outside the EEA; those are listed in the sub-processor section along with the transfer mechanism.