Each agency's data is separate
Each agency has its own separate book of records in the Service. No agency can see another agency's candidates, workers, clients, staff or documents. A person registered with two agencies has a separate record with each, and neither agency can see the other's.
Candidates, workers and clients see the agency's name and brand, not ours.
Inside an agency: roles and permissions
The agency decides who in its business can use the Service. Each user has a role, and each role has permissions that set what the user can see and do. The agency can change a user's role or remove a user at any time.
We recommend that agencies give each user only the access their job needs, review their users regularly, and remove leavers on their last day.
The audit trail
Every change in an agency's system is recorded in an audit trail that the agency can see: what changed, when, and who made the change. This includes anything done by Templace staff.
When Templace can enter an agency's system
Templace staff do not enter an agency's system as a matter of course. We enter only:
- when the agency invites us, for a period the agency chooses; it can withdraw the invitation at any time;
- when sums are overdue after we have given a non-payment notice;
- when the agency is locked out and asks us for help;
- to deal with a security incident;
- where the law requires it; or
- to set the system up before the agency has any users of its own.
How our access is recorded
Every entry is recorded in the agency's audit trail against the named Templace person. Except during set-up, we also email the agency to tell it we have entered. While inside, we look only at what the reason for entry requires.
Templace is a small company led by its Director. The contractors who work with us are bound by confidentiality, and they reach agency data only under these same rules.
Our sub-processors
A few other companies handle data as our sub-processors, and each sees only what its role needs. The full list is in our terms, and we give 30 days' notice before we change it.
- Our UK hosting provider runs the server on which the Service and its data are held.
- Anthropic PBC (United States) receives only the content sent to the AI features, and never identity documents, right-to-work evidence or criminal-record certificates. An agency can switch these features off.
- Our own mail provider carries Templace's own notices, such as invoices and account emails. An agency's emails to its people go through the agency's own mail server.
Backups
Nightly backups are stored separately from the live database and can be read only by the server's own user. They are used only to restore the Service, for example when an agency asks for its system to be put back to the previous night.
Requests from others
If the police, a court, a regulator or anyone else asks us for an agency's data, we ask them to go to the agency, unless the law requires us to answer ourselves. If we must disclose, we give only what the law requires, and we tell the agency unless the law forbids it.
If you want to know who has seen your data in an agency's system, ask the agency, which can check its audit trail. Agencies can ask us about our own access at terry@hilliernet.co.uk.
Who can see what: data access and visibility · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.