Privacy notice

Who we are

PreHire is the trading name of Island Stream Ltd, company number 15353850, registered at 124 City Road, London, England, EC1V 2NX. We are the controller for the data described in this notice.

What we collect, and from whom

From an employer

The name and work email of the person raising a check, the organisation name, and the candidate’s name, email address and the role they applied for. Where the employer supplies the referees from the application, we also receive from them each referee’s name, work email, the employer they worked at together, the referee’s job title, their relationship to the candidate and the type of reference asked for.

From a candidate

Their consent; the referees they nominate — name, work email, employer and relationship — or, where the employer supplied them from the application, the candidate’s confirmation or replacement of that list; and the job title and employment dates they claim at each employer. We do not collect a CV, date of birth, address, ID documents, or criminal or health data, and we do not run DBS or right-to-work checks.

From a referee

Their answers to the questionnaire, their own job title, the address they reply from, and the technical detail of that reply. A referee is told who nominated them and why they were contacted before they are asked anything.

From public sources

Companies House records, and mail and domain records for the referee’s email domain. These are the only two, they are open sources, and the report names the source behind every result.

Why we are allowed to do it

A candidate’s data is held with their explicit consent, given before any referee is contacted. Consent is withdrawable at any time until the check is finished, and withdrawing stops it. A referee has no account with PreHire and gives us no consent of their own. We hold a referee’s details because the candidate named them. We use them only to check that one reference for the employer, and only for the time shown in the table below. This is our legitimate interest, balanced against the limited, expected and time-boxed use this notice describes. An employer’s own contact details are held to run the account they hold with us.

How long we keep it

Kept only as long as it is needed for the reason it was collected, then deleted or anonymised on a fixed schedule:

Employer contact details (the person raising a check)

Kept for While your account is active, then 90 days

From account closure

Sign-in records (IP address, browser)

Kept for 90 days

From the sign-in

Contact form enquiries

Kept for 90 days

From the enquiry

Reports issued to an employer, including the referee answers they quote

Kept for 12 months

From the date the report was issued

Candidate and referee working data — contact details, the job and employment details given and confirmed, message addresses, subjects and headers, and referee answers outside an issued report

Kept for 3 months

From the check closing

A referee who declines to take part

Kept for 30 days

From the decline

Audit records of what happened on a check (no names or addresses, only reference numbers)

Kept for As long as the account exists

From the event

An account holder’s own name and email are kept for as long as the account exists. Write to privacy@prehire.ai to have them erased sooner.

Who else processes it

A small number of suppliers process data on our behalf to run the service — email delivery, payments, and error monitoring among them. Every one of them is named, with what they handle, on our sub-processor list.

Postmark and Sentry process data in the United States. Email privacy@prehire.ai and we will send you the current transfer safeguard documents.

Your rights and how to use them

You can withdraw your consent at any time until the check is finished. Your most recent email from PreHire always has a working link — use it to withdraw, or email privacy@prehire.ai.

You can ask us what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. A candidate can also ask for the report we hold about them. Email privacy@prehire.ai and a person will answer you. If you are not satisfied with our answer, you can complain to the Information Commissioner’s Office (ico.org.uk). Our ICO registration number is ZC249349.