S1. What this schedule is
This is a schedule to Friam Limited’s Data Processing Agreement, Version 1.5, effective 13 October 2026 (the “DPA”). It describes one further processing activity: the SponsorFlow Appendix D evidence-pack engine. It adds the subject matter, the categories of data subjects and personal data, the sub-processors used and the retention that apply to that activity. It does not amend, replace or restate the body of the DPA, which continues to apply as written. Where this schedule and the DPA describe the same thing, the DPA governs everything this schedule does not expressly add.
Parties and roles. Friam Limited, a company registered in England and Wales under company number 14219476, with its registered office at 164–170 High Street, Crowthorne, England, RG45 7AT, is the processor. The Subscriber that puts a document into SponsorFlow, or asks for it through SponsorFlow, is the controller of that document and of what is built from it, and gives Friam its instructions. That Subscriber is either the sponsor (the UK Home Office licensed sponsor whose worker records a pack concerns) or a law firm acting for that sponsor (the “partner firm”). Where a partner firm and its client sponsor share a case, each is a controller of the personal data it puts into the case, and each instructs Friam for its own uploads and its own actions. A partner firm’s own legal advice to its client is its own processing as a controller and is outside this schedule. This schedule is accepted by each Subscriber with the DPA, by the tick at sign-up, under Section 1 of the DPA; no separate signature is needed.
S2. Subject matter, nature, purpose and duration
Subject matter: documents the sponsor, or a partner firm acting for it, uploads for a sponsored-worker case or for a candidate at stages 1 to 5 of a SponsorFlow file (role check, candidate check, certificate, visa and start, Appendix D file), and the evidence pack built from them. Friam (a) extracts structured fields from those documents, (b) runs a deterministic, versioned rules catalogue against the extracted fields and produces findings, (c) holds the case record, the partner firm’s resolutions and sign-off, and the resulting Appendix D evidence pack, and (d) only where the sponsor separately instructs it, writes confirmed facts into the sponsor’s SponsorFlow worker register. Documents a candidate uploads through their own upload link are covered by the separate SponsorFlow pre-hire candidate upload schedule, not by this schedule.
Nature: document text and field extraction (AWS Textract for scanned documents and images, including identity documents; Anthropic for classifying documents and extracting fields); a mechanical check that each extracted value appears in the document’s own text; rules run over the checked fields; a human decision on every finding that is not a pass; and a frozen, hashed, signed evidence pack. Where the Subscriber asks a sponsored worker or the sponsor for a document through SponsorFlow, the request is sent by text message and email, and the upload lands in the case.
Purpose: solely to help the sponsor assemble and evidence the records it is required to keep under Appendix D of the sponsor guidance, to check a role and a candidate before a Certificate of Sponsorship is assigned, and to prepare a copy-ready Certificate of Sponsorship data sheet that the sponsor’s own authorised user enters into the Home Office Sponsorship Management System. Never for advertising, profiling or Friam’s own marketing. The engine produces evidence and workflow; it does not give immigration advice.
Duration: for as long as the Subscription includes the Appendix D pack feature, and then for the retention period in S6.
S3. Categories of data subjects
- Sponsored workers whose Appendix D case is built.
- Candidates for a sponsored role whose documents the sponsor or partner firm uploads at stages 1 to 5.
- Other employees whose right-to-work records the sponsor keeps. Appendix D requires evidence of right-to-work checks on “any worker you employ, or are considered to employ for the purposes of the statutory Right to Work Scheme, even if you are not their sponsor”.
- People acting for the sponsor or the partner firm (for example Level 1 users, key personnel and solicitors), as users of the product.
S4. Categories of personal data
| Category | What it covers |
|---|---|
| Identity documents | Passport machine-readable and printed fields (name, date of birth, nationality, document number, expiry), eVisa and right-to-work check results, and images of the source documents |
| Right to work | Right-to-work check method and date, permission type and expiry, work restrictions |
| Immigration history | For a candidate: current immigration status and permission, other nationalities, the countries lived in and when (for the TB test), English language route and test details, and TB certificate details |
| Certificate of Sponsorship and employment | CoS data (SOC code, job title and description, salary, hours, PAYE reference, work address) and employment contract terms |
| Payroll | Payslips (National Insurance number, tax code, pay figures, deductions) and bank statements or transfer records identifying the worker |
| Contact | UK residential address, phone number, email address, and the date each was recorded |
| Absence | Absence entries by date and type |
| Criminal record | DBS certificate number, issue date and check level, where a role requires one; a criminal record certificate where the occupation requires one |
| Skills and recruitment | Job description, qualifications, professional registration, references, advert and recruitment records |
Special category and criminal-offence data. Sickness absence entries and a TB certificate can disclose information about health (special category data, Article 9 UK GDPR), and a DBS certificate or other criminal record certificate is criminal-offence data (Article 10 UK GDPR). The controller is responsible for its own lawful basis and condition for this processing, and for any appropriate policy document that condition requires. The condition this schedule expects the controller to rely on, for both, is the employment condition in paragraph 1 of Part 1 of Schedule 1 to the Data Protection Act 2018, which is met if “the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection” and, “when the processing is carried out, the controller has an appropriate policy document in place”. For criminal-offence data, section 10(5) of that Act allows Article 10 to be met by “a condition in Part 1, 2 or 3 of Schedule 1”.
S5. Sub-processors for this processing
These sub-processors are used by the Appendix D pack engine. Each is already listed in Section 7 of the DPA; this table adds the purpose each serves here. No sub-processor is added by this schedule.
| Sub-processor | Purpose | Data category | Region |
|---|---|---|---|
| Amazon Web Services | Object storage of uploaded documents and packs (S3, server-side encrypted), database, and text extraction from scanned documents and images, including identity documents (Textract) | Document images, extracted text and fields, case records, hashes | UK (eu-west-2) |
| Anthropic | Classifying uploaded documents, and extracting fields from them | Document text and images sent for classification and extraction, and the structured response | US, as Section 7.1 of the DPA states. Transfers are covered by the EU Standard Contractual Clauses (Modules Two and Three) with the UK International Data Transfer Addendum, as incorporated in Anthropic’s Data Processing Addendum (effective 24 February 2025). Under that addendum Anthropic processes the data only to provide or maintain its services, deletes it within 30 days of the end of the agreement (subject to legal, dispute and abuse-prevention exceptions), gives notice of any new sub-processor with 15 days to object, and is audited annually (SOC 2 reports at trust.anthropic.com). Anthropic’s Commercial Terms (effective 17 June 2025, section B) state that it “may not train models on Customer Content from Services”. Friam’s agreement with Anthropic is available to the controller on request under Section 6.8 of the DPA. |
| Twilio | Texting a document request link, its reminders and its access code to the person asked | Name and mobile number of the person asked, and the request message | UK / EU (ie1 region) |
| Resend | Emailing a document request link and its reminders to the person asked | Name and email address of the person asked, and the request message | EU |
International transfers. As Section 7.1 of the DPA states, for the EU Friam relies on the UK’s adequacy finding, and for the US it relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
S6. Retention
The engine keeps each case for at least the period the sponsor guidance requires, which is a minimum, not a target:
- Appendix D (version 10/26): “all documents relating to a worker you sponsor must be kept throughout the period that you sponsor them and until whichever is the earlier of either” “one year after the date on which your sponsorship of the worker ended” or “the date on which a compliance officer has examined and approved them, if this is less than one year after your sponsorship of the worker ended”.
- Appendix D (version 10/26), licence-application documents: “you must also keep the documents you provided as part of your application to become a licensed sponsor. You must keep this information for as long as you hold a sponsor licence”.
- Right-to-work copies, under the Employer’s guide to right to work checks of 1 October 2026: employers must “ensure all copies of documents are kept securely for the duration of the worker’s employment and for two years afterwards”.
The controller may need to keep records for longer for other legal reasons. Appendix D itself says: “You may need to retain some documents specified in this Appendix for other purposes (for example, to comply with legislation on preventing illegal working) and for longer periods of time.”
Retention policy.
- While the Subscription runs: Friam keeps each case until the controller instructs deletion. Friam does not delete a case on its own initiative while the Subscription runs.
- A candidate who is not hired: documents uploaded for a candidate at stages 1 or 2 who does not go on to a Certificate of Sponsorship are deleted 6 months after the last activity on that candidate (an upload, a check, or a change by the controller), unless the controller instructs deletion sooner.
- After the Subscription ends: the controller can export its evidence packs and original documents for 12 months. After those 12 months Friam deletes the remaining cases, unless the controller has instructed it in writing to keep them for longer for a stated legal reason.
- How deletion works: a deletion keeps the case’s event log and hashes as a record that the case existed, and removes the documents, their text and the extracted values. Automatic deletion is built but not yet switched on. Until it is, Friam carries out these deletions itself, and it will tell the controller before automatic deletion is switched on.
Keeping its records for the periods Appendix D and the right-to-work rules require remains the controller’s duty. If the controller needs a case kept beyond the periods above, it exports it or instructs Friam to keep it.
S7. Limits the controller should know about
- Uploaded documents are typed by their content, and macro-enabled, password-protected and active-content files are refused, but virus and malware scanning of uploaded documents is not yet in place.
- There is no dedicated data-subject-rights export yet. Friam assists with a subject-access request under Section 6.5 of the DPA by assembling the response from the case by hand.