Privacy Policy

Last updated: February 2026

1. Introduction

Immersive Core Ltd ("we", "us", "our") operates the ImmersiveCore Network, which includes the People portal, Right to Work Checker, and Training & Compliance portal. This policy explains what personal data we collect, why we collect it, how we store it, and your rights.

2. Data We Collect

Right to Work Checker

Full name, date of birth, nationality
Document type and reference number (e.g. passport number, BRP number)
Document expiry date
Uploaded document images (photo page, visa page, etc.)
Share code (where applicable)
Check outcome, date of check, name of checker

This data is collected and retained to comply with the Immigration, Asylum and Nationality Act 2006 and Home Office Right to Work guidance.

People Portal

Full name, email address
Emergency contact name and phone number
Dietary requirements, medical/accessibility notes
DBS certificate number and issue date (where applicable)
Uniform and equipment sizes

This data is collected for the purpose of onboarding staff, managing day-to-day welfare, and meeting our duty of care obligations.

Training & Compliance Portal

Full name, email address
Training session attendance records (module, date, trainer, status)
Assessment results (score, pass/fail, assessor notes)

This data is collected to ensure staff are trained and assessed before operating attractions or carrying out safety-critical tasks.

3. How Data Is Stored

All data is stored in a Supabase-hosted PostgreSQL database. Uploaded document images are stored in Supabase Storage. Both are hosted in the EU (AWS eu-west-2, London). Access is restricted to authenticated users with the appropriate role (manager).

4. Data Retention

Right to Work records: Retained for 2 years after employment ends, as required by Home Office guidance.
People & Training records: Retained for the duration of employment plus a reasonable period (typically 6 months) for administrative purposes, unless a longer retention period is required by law.

When records are deleted, associated document images are also removed from storage.

5. Your Rights

Under the UK General Data Protection Regulation (UK GDPR), you have the right to:

Request a copy of the personal data we hold about you (Subject Access Request)
Request correction of inaccurate data
Request deletion of your data (subject to our legal retention obligations)
Object to processing or request restriction of processing

To exercise any of these rights, please contact your line manager or email dpo@immersivecore.network.

6. Contact

If you have any questions about this policy or how your data is handled, please contact:

Data Protection Contact
Immersive Core Ltd
Email: dpo@immersivecore.network