Candidate Terms and Conditions & Mobile Application License Agreement

Effective Date: 1^st October 2024

Last Reviewed: 18^th Feb 2026

1. Introduction

This document outlines the terms and conditions (T&Cs) and license agreement applicable to Candidates using the "WpcRtwCandidate" mobile application and related services offered by WorkPermitCloud Limited ("WPC") for undergoing right-to-work verification requested by an Employer using WPC's service.

Definitions

"WPC": WorkPermitCloud Limited, registered in England and Wales, with Company Number 12909694 and registered office at The Gherkin Level 28, 30 St. Mary Axe, London, EC3A 8BF.

"Candidate": An individual using the WpcRtwCandidate mobile application to provide information for the purposes of verifying their right to work in the UK.

"Personal Data": Includes any information required from the Candidate for Right to Work checks, such as passport, birth certificate, Biometric Residence Permit (BRP), E-Visa, Share Code, Irish Passport, Irish Passport Card, Certificate of Sponsorship (COS), Asylum Registration Card (ARC), and any metadata collected during app usage.

"Right to Work Checks": Processes as per the UK Home Office's "Employer's Guide to Right to Work Checks" to ensure compliance with immigration laws.

"Employer": Any organisation using the WpcRtwEmployer mobile application to verify an individual's right to work within UK laws.

"Third Party Service Providers": Service providers who process Personal Data on behalf of WPC for verification purposes.

The Wpc RTW Candidate app allows Candidates to consent to the processing of their Personal Data for Right to Work checks, which will be shared with Employers via WpcRtwEmployer.

The two routes in the app

The app presents two routes:

Digital RTW : for British passports, Irish passports, and Irish passport cards. This route uses document capture + a face scan (Face ID/liveness) to support an identity check and produce an outcome for the Employer.

Manual RTW (Non-Certified): for other immigration categories (for example eVisa, ILR without eVisa, asylum seeker/refugee status, ongoing application). This route may still use digital steps (including online share code flows where applicable), but it also requires the Employer to complete an in-person/manual step, including checking original documents before work starts.

Important: The in-app labels "Certified" and "Non-Certified" describe the type of route and whether it is treated as within the scope of an independent certification claim for the digital identity step. The Employer remains responsible for meeting Home Office right to work requirements for the route used.

2. Licence and Use Grant

WPC grants Candidates a non-exclusive, non-transferable license to access and use the Services solely for undergoing right-to-work verification in compliance with UK immigration laws.

3. Information We Collect and Process

WPC collects and processes personal identifiers, including but not limited to your name, contact information, right-to-work documentation including passport, birth certificate, Biometric Residence Permit (BRP), Certificate of Sponsorship (COS), Asylum Registration Card (ARC), E-Visa, Share Code, Irish Passport, Irish Passport Card, and metadata.

4. Data Security and Privacy Compliance

WPC adheres to GDPR and the Data Protection Act 2018 to ensure data security and privacy for all users.

Security Measures

• Data Encryption: Personal data is encrypted both in transit and at rest.
• Access Control: Data access is restricted to authorised personnel only.
• Third-Party Services: We use trusted third-party providers (e.g., iProov, Microblink, Mindee) for secure verification.

5. Two-Factor Authentication (2FA)

Candidates may be required to use 2FA for secure access to the Services, involving secondary authentication methods like a code sent to their registered contact details.

6. eVisa Verification and Use of OTP

As part of the eVisa verification process, Candidates may be required to use a One-Time Password (OTP) sent by the UK government. This OTP is necessary to access and obtain the share code used for verifying the right-to-work status as mandated by UK immigration law. By using the Services, Candidates consent to:

• Use of Government-Sent OTP: The OTP sent to your mobile number will be used to facilitate the eVisa verification process.
• Verification Process: The OTP and the share code generated from its use are critical to verifying your right-to-work status.
• Data Handling: All data related to the OTP and share code will be securely processed and used solely for verification purposes in accordance with our Privacy Policy.

7. Statement of Fair Processing Notice

To protect against fraud, identity misuse, and financial crime, we may share and verify your personal data with trusted third-party fraud prevention and identity verification agencies.

These checks are carried out to confirm your identity and ensure the authenticity of the documents you submit during the Right to Work process.

The data shared may include your name, address, date of birth, contact details, identification numbers, device identifiers, and any relevant information collected as part of your verification.

We process this data under our legitimate interest in preventing fraud and ensuring compliance with UK laws. Fraud prevention agencies may retain data for up to six years if you are considered to pose a fraud or money-laundering risk.

If a fraud risk is identified, we or other fraud prevention agency members may refuse services, employment, or verification until the matter is resolved.

You have rights regarding how your data is used, including the right to access, correct, or object to processing.

You can find more information about how fraud prevention data is processed and your rights at http://www.cifas.org.uk/fpn

8. User Obligations and Consent

Candidates agree to:

• Provide accurate and complete information for the right-to-work verification process.
• Consent to data processing as outlined in this policy, including the use of OTPs and other verification methods.

9. Service Cost Statement

There is no fee or money charged to candidates for using the right-to-work check service. The cost of this service is borne by the employer initiating the verification process.

10. Indemnity and Limitation of Liability

WPC is not liable for any inaccuracies in data provided by the Candidate or delays in the right-to-work verification process caused by third-party services.

11. Termination and Governing Law

This agreement is governed by the laws of England and Wales. WPC may terminate service access for any breach of these terms.

12. Changes to Terms

WPC reserves the right to update these terms at any time to reflect changes in legal requirements or functionality. Continued use of the apps signifies acceptance of any revised terms.

13. Withdrawal of Consent & Account Deletion

You have the right to withdraw your consent at any time. Please note that withdrawing consent may impact your ability to complete the right-to-work verification process. To withdraw your consent, please contact us at rtwcheck@workpermitcloud.co.uk.

Candidates can delete their account and associated data directly through the app. Requests for data deletion can also be made by contacting rtwcheck@workpermitcloud.co.uk.

14. Contact Information

For inquiries, contact:

Email: rtwcheck@workpermitcloud.co.uk

Address: The Gherkin, Level 28, 30 St. Mary Axe, London, England, EC3A 8BF

Disclaimer

"This app is not affiliated with, endorsed by, or authorized by any government entity. All services provided within this app, including document verification and right-to-work checks, are based solely on publicly available information and general regulatory guidelines."