Book a demoTry Templace
Home / Policies / Your data

Our GDPR statement

How Templace meets the UK GDPR and the Data Protection Act 2018, as processor for agencies and as controller for its own business data.

The law we follow

We follow the UK GDPR and the Data Protection Act 2018, both as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The regulator is the Information Commission, still known as the ICO, which replaced the Information Commissioner on 30 September 2026. Our registration number with it is ZC285689.

This statement is written mainly for agencies and sets out what we do. The binding commitments are in our Data Processing Addendum, which forms part of our terms at /terms.

As your processor

Each agency is the controller of the personal data of its candidates, workers, clients and staff. We are its processor. Under Article 28 of the UK GDPR and our Data Processing Addendum, we:

  • use the agency's data only on its documented instructions, which include its use of the Service, and tell it if we think an instruction breaks the law;
  • make sure everyone who can reach the data is bound by confidentiality;
  • keep the data secure with the measures described below;
  • use only the sub-processors named in our terms, give 30 days' notice of any change, and hold each one to the same data protection duties;
  • help the agency answer rights requests, keep its data secure, deal with breaches and carry out data protection impact assessments;
  • tell the agency without undue delay about any personal data breach affecting its data;
  • keep its data for 90 days after the contract ends or the account is suspended so that it can export it, then delete it from the live Service;
  • give the agency the information it needs to show that these duties are met.

As a controller

We are the controller only for our own business data: agency customer contacts and users' sign-in details, website enquiries, billing records and our suppliers. Our Privacy notice says what we hold, why, on what lawful basis and for how long. We do not sell personal data or use it for advertising.

Security of processing

Article 32 of the UK GDPR requires security appropriate to the risk. Our measures include:

  • all traffic over HTTPS, with certificates issued automatically;
  • passwords stored only as salted PBKDF2-HMAC-SHA-256 hashes;
  • sign-in sessions held in a strictly necessary, HttpOnly cookie;
  • roles and permissions set per user, and an audit trail of every change that the agency can see;
  • each agency's data kept apart, so that no agency can see another's;
  • nightly backups, each checked by re-opening the database and running an integrity check, stored apart from the live database and readable only by the server's own user;
  • the newest 14 nightly backups and the first backup of each month for 12 months kept, with restore to the previous night on request;
  • every release passing the whole automated test suite (about 180 test suites) before it is installed, with the previous release kept so it can be rolled back.

Sub-processors and international transfers

Data is held on a server in the United Kingdom. Our sub-processors are the UK hosting provider, Anthropic PBC in the United States for the AI features only, and our own mail provider for Templace's own notices. The list in our terms names the hosting provider.

The transfer to Anthropic is covered by the UK Addendum to the EU standard contractual clauses. Identity documents, right-to-work evidence and criminal-record certificates (DBS, PVG and AccessNI) are never sent to an AI model, and an agency can switch the AI features off.

An agency's emails to its own people go through the agency's own mail server, not ours.

Data protection by design

Agencies see only their own data, and users only what their role allows. Our own staff can enter an agency's system only when the agency invites them, or on the limited grounds set out in Who can see what, and every entry is recorded in the agency's audit trail.

AI output is a draft for a person to check, never a decision. When the Service reads an uploaded certificate, licence or timesheet, it produces a proposal that a person must confirm, correct or discard before anything is saved.

Changes made by the Data (Use and Access) Act 2025

The 2025 Act changed several rules. This is how we apply them:

  • Rights requests: we make reasonable and proportionate searches (law since 19 June 2025), and pause the one-month time limit to ask for clarification only when we genuinely need to (possible since 5 February 2026).
  • Automated decisions: Articles 22A to 22D of the UK GDPR replaced Article 22 on 5 February 2026. The Service takes no significant decisions about people by solely automated means.
  • Complaints: since 19 June 2026 controllers must make it easy to complain, acknowledge a complaint within 30 days, look into it without undue delay and give the outcome. Our Complaints procedure does this, and we help agencies with complaints about their data.
  • Cookies: new exceptions to the consent rule took effect on 5 February 2026. Our website sets no cookies; the Service uses a strictly necessary sign-in cookie and local storage for preferences.

Accountability

The Director is responsible for data protection and answers questions about it at terry@hilliernet.co.uk. We keep a record of our processing activities, a log of personal data breaches, and records of rights requests and complaints. Our contractors are bound by confidentiality. We review our data protection policies at least once a year.

Our GDPR statement · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.