Privacy Notice

This system is operated by WCN Care(“we”, “us”, “our”). WCN Care is the data controller for personal data processed within CoS Tracker.

CoS Tracker is an internal compliance tool used exclusively by authorised WCN Care staff to manage Certificate of Sponsorship (CoS) obligations and UKVI sponsor licence requirements. It is not accessible to the general public.

CoS Tracker holds the following categories of personal data about sponsored employees:

• Full name and job title
• Service / care home location
• Standard Occupational Classification (SOC) code
• Visa type and Certificate of Sponsorship reference
• Right to Work expiry date
• Passport expiry date and confirmation of copy on file
• eVisa / Biometric Residence Permit expiry date
• Contracted and actual working hours
• Hourly pay rate and salary calculations
• Quarterly pay evidence and period dates
• Residential address, telephone number, and email address
• DBS check status (on file confirmation only, not the certificate number)
• Planday staff ID (internal scheduling system reference)
• Date of last compliance audit

We also process the email addresses of CoS Tracker system users (WCN Care staff) for authentication and to record who made changes to compliance records.

We process sponsored employee data for the following purposes:

Some data held in this system may indirectly relate to nationality or immigration status, which can be considered special category data under UK GDPR Article 9. This is processed solely to fulfil our legal obligations as a licensed sponsor under the UK immigration rules (Art. 9(2)(b) — employment law obligations).

Access to CoS Tracker is restricted to authorised WCN Care staff only. Users sign in with their WCN Care email address. The system logs who makes changes to each record.

Data is stored in a secure cloud database (Supabase, hosted in the EU) and the application is hosted on Vercel (EU region). We do not sell, share, or disclose personal data to any third party except:

• UKVI / Home Office — when required to report changes via the Sponsor Management System
• Planday — employee scheduling data is imported from Planday into CoS Tracker (one-way sync only; no data is sent back to Planday)
• Our IT processors (Supabase, Vercel, Resend) — acting under data processing agreements, solely to provide the platform

Active employee records are retained for as long as the individual is sponsored by WCN Care and for a minimum of 7 years after the sponsorship ends, in line with UKVI record-keeping requirements.

Archived (leaver) records remain in the system to provide a complete audit trail. They can be permanently deleted on written request to the data controller, subject to any ongoing legal retention obligations.

System user (staff) email addresses are retained for as long as the user has an active account, plus a reasonable period for audit log purposes.

Individuals whose personal data is held in this system have the right to:

• Access — request a copy of the personal data held about them
• Rectification — request correction of inaccurate data
• Erasure — request deletion, subject to legal retention obligations
• Restriction — request that processing be restricted in certain circumstances
• Objection — object to processing based on legitimate interests
• Portability — receive a copy of their data in a structured, machine-readable format

To exercise any of these rights, contact WCN Care using the details in Section 8 below. We will respond within 30 days.

For any questions about this privacy notice or to exercise your data rights, please contact the WCN Care management team.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We may update this privacy notice from time to time. The “Last updated” date at the top of the page will always reflect the most recent version. Significant changes will be communicated to system users.