P1. What this schedule is
This is a schedule to Friam Limited’s Data Processing Agreement, Version 1.5, effective 13 October 2026 (the “DPA”). It covers one processing activity: the personal data a prospective worker (a “candidate”) provides through their own upload link, before a Certificate of Sponsorship has been assigned to them. It does not cover documents a law firm or employer uploads itself for a candidate or a sponsored worker, which the SponsorFlow Appendix D evidence-pack schedule covers. It does not amend the body of the DPA, which continues to apply. Where this schedule and the DPA describe the same thing, the DPA governs everything this schedule does not expressly add.
Parties and roles. Friam Limited, a company registered in England and Wales under company number 14219476, with its registered office at 164–170 High Street, Crowthorne, England, RG45 7AT, is the processor. The Subscriber that sends the candidate the link is the controller of what the candidate provides through it, and gives Friam its instructions. That Subscriber is either the employer considering the candidate for a sponsored role, or a law firm acting for that employer. A law firm that sends a link confirms that it acts for the employer named in the link. This schedule is accepted by each Subscriber with the DPA, by the tick at sign-up, under Section 1 of the DPA; no separate signature is needed.
P2. Subject matter, nature, purpose and duration
Subject matter: documents and facts a candidate chooses to give through a link sent to their own mobile number and email address by a firm or employer using SponsorFlow.
Nature: the link is sent by text message and email, with reminders 3 and 7 days after it is sent while anything is still missing. It works for 30 days. The link opens on the candidate’s phone without a code: whoever holds the link can open it. The page shows the name of the employer, the name of the firm that asked (where a firm asked), the candidate’s first name, the list of what is asked for, and whether each item has arrived; never a finding, a verdict or anyone else’s document. The candidate can upload one or more files for each item (for example both sides of a card). Nothing already sent can be read, downloaded or replaced through the link. Uploaded files are stored and read in the same way the Appendix D evidence-pack schedule describes (text extraction from scanned documents and images; AI classification and field extraction), and made available to the firm or employer that asked.
Purpose: solely to let the firm or employer that asked see what the candidate would need for the sponsored role and the visa application, through the SponsorFlow candidate check, and to ask the candidate for what is missing. Because a visa is being sponsored, a candidate can be asked for more than in an ordinary job application; the list in P4 limits it to what the role and the visa route need. Never for advertising, profiling or Friam’s own marketing. The Service does not give immigration advice, and it does not decide whether a candidate is offered a job or sponsored.
Duration: while the firm or employer’s Subscription includes this feature, and then for the retention period in P6.
P3. Categories of data subjects
- Candidates: people a firm or employer is considering for a sponsored role, who are sent an upload link.
- People named in a candidate’s documents, such as a referee or a previous employer.
- People acting for the firm or employer, as users of the product (covered by the DPA and the Appendix D evidence-pack schedule).
P4. Categories of personal data: the closed list
A candidate can be asked only for the items below, and only where the condition in the second column applies to the role or to that candidate. A firm or employer may not use the link to ask for anything else.
| Item | When it may be asked for |
|---|---|
| Identity: passport photo page, or another travel document | Always |
| eVisa share code page (or a biometric residence permit) | Only where the candidate is already in the UK |
| Qualification certificates or transcripts, an Ecctis statement, and professional registration | Only where the role needs the qualification or the registration |
| English language evidence: a test certificate, a degree taught in English, or other evidence of the English language route relied on | Where the visa route has an English language requirement that the candidate does not already meet by nationality or a previous grant |
| TB test certificate | Only where the candidate needs one: under the Immigration Rules, “A person must provide a valid TB certificate with their application if paragraph TB2 applies” and they are applying for entry clearance |
| Criminal record certificate | Only where one is required for the occupation |
| Maintenance funds: bank statements | Only where the sponsor will not certify maintenance for the candidate |
| Salary and employment history: payslips, references and a record of previous jobs | Only where relevant to the role or the visa route, for example to show previous employment or earnings that the route relies on |
Facts a candidate can be asked to type in: their current immigration status and permission; other nationalities; the countries they have lived in and when (for the TB test); the English language route they rely on and its test or qualification details; and the details of a qualification or a TB certificate they have uploaded.
Contact and link data: name, mobile number, email address, the times the link was sent, opened and used, and the files uploaded.
A candidate may decline. A candidate can choose not to send any item. SponsorFlow then shows the item as not received; it does not mark the candidate down. What the firm or employer does next is its own decision.
Special category and criminal-offence data. A TB certificate can disclose information about health (special category data, Article 9 UK GDPR), and a criminal record certificate is criminal-offence data (Article 10 UK GDPR). Each may be asked for only where the table above allows it. The controller is responsible for its own lawful basis and condition, and for any appropriate policy document that condition requires. As in the Appendix D evidence-pack schedule, the condition the controller is expected to rely on is the employment condition in paragraph 1 of Part 1 of Schedule 1 to the Data Protection Act 2018, which is met if “the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection” and the controller has an appropriate policy document in place.
P5. Sub-processors for this processing
No sub-processor is added by this schedule. These are the sub-processors already named in Section 7 of the DPA, for the purposes shown here.
| Sub-processor | Purpose here | Region |
|---|---|---|
| Amazon Web Services | Storage of uploaded files and records (S3, server-side encrypted, and the database); text extraction from scanned documents and images (Textract) | UK (eu-west-2) |
| Anthropic | Classifying documents and extracting fields from them | US, as Section 7.1 of the DPA states. Transfers are covered by the EU Standard Contractual Clauses (Modules Two and Three) with the UK International Data Transfer Addendum, as incorporated in Anthropic’s Data Processing Addendum (effective 24 February 2025). Under that addendum Anthropic processes the data only to provide or maintain its services, deletes it within 30 days of the end of the agreement (subject to legal, dispute and abuse-prevention exceptions), gives notice of any new sub-processor with 15 days to object, and is audited annually (SOC 2 reports at trust.anthropic.com). Anthropic’s Commercial Terms (effective 17 June 2025, section B) state that it “may not train models on Customer Content from Services”. Friam’s agreement with Anthropic is available to the controller on request under Section 6.8 of the DPA. |
| Twilio | Texting the link and its reminders to the candidate’s mobile | UK / EU (ie1 region) |
| Resend | Emailing the link and its reminders to the candidate | EU |
As Section 7.1 of the DPA states, for the EU Friam relies on the UK’s adequacy finding, and for the US it relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
P6. Retention
- The link stops working 30 days after it is sent.
- A candidate who is not hired: what the candidate provided is deleted 6 months after the last activity on that candidate (an upload, a check, or a change by the controller), unless the controller instructs deletion sooner.
- A candidate who goes on to a Certificate of Sponsorship: what they provided becomes part of their sponsored-worker case, and the retention in the Appendix D evidence-pack schedule (its section S6) applies from then on.
- A candidate’s request to delete: Friam passes it to the controller without undue delay and acts on the controller’s instruction.
- How deletion works: as in the Appendix D evidence-pack schedule. Automatic deletion is built but not yet switched on. Until it is, Friam carries out these deletions itself.
P7. The candidate notice
The candidate sees a link to this notice on the link page before anything is sent, and the full notice opens on the page. The words in square brackets are filled in for each link.
How your documents are used
[Name of the firm or employer that sent this link] has asked you for documents so it can check what you would need to be sponsored for a job, and for the visa. It is responsible for your information (it is the “controller”) and it will see what you send. It does this because it has a legitimate interest in checking whether you can be sponsored. SponsorFlow, run by Friam Ltd, stores and reads your documents on its behalf.
Because this job needs a visa, you may be asked for more than in an ordinary job application. You can send only what is on the list, and you can choose not to send something.
Your documents are kept securely and are read partly by software, including AI, to pick out the details. Your nationalities show whether you need to prove your English. Where you have lived shows whether you need a TB test. References from past employers are stored with your record; the software does not pick details out of them. If you are not hired, they are deleted 6 months after the last activity on your record. If you are hired, they become part of your employment records. Our service providers (cloud storage in the UK, text and email messaging, and an AI provider) handle them only to run the service. Our AI provider, Anthropic, is based in the United States, and your information is protected there by the UK International Data Transfer Addendum.
To see, correct or delete what you sent, or to object to how it is used, contact [name of the firm or employer]. You can also email Friam at legal@everyguard.uk, and we will pass your request on. If you are unhappy, you can complain to the Information Commissioner’s Office (ico.org.uk). This is not immigration advice, and nobody at SponsorFlow decides whether you are offered a job or sponsored.
P8. What this schedule does not cover
- Documents a firm or employer uploads itself, which the Appendix D evidence-pack schedule covers.
- The controller’s own use of what a candidate sends, including its decision whether to offer a job or to sponsor, which is the controller’s own processing.