Privacy Policy

Why we collect this

Security firms that hire operators through The Ops Con need to check that an operator is licensed, has the right to work, and is who they say they are. To help with this, once you have been hired for the first time we ask you to upload your vetting documents once, so you do not have to send them again to every firm.

We use this information to help the firms that hire you vet you for work, and for nothing else.

What we collect

When you are hired, we ask for:

• Documents: your SIA licence, photo ID (passport or driving licence), proof of address, right to work evidence, a photo of your DBS certificate, and your CV. You can also add a first aid or medical certificate, a driving licence, other certificates, and a DVLA check code with a screenshot of your licence summary.
• Security clearances, if you hold them: BS7858 screening, BPSS, Counter Terrorist Check, Security Check, Developed Vetting, NPPV, an airside ID pass, and proof of military service or emergency services history. For most of these we record only the details you enter (level, sponsoring organisation and dates), not a document.
• Details you type in: your SIA licence number, your DBS certificate number and issue date, your right to work share code, your DVLA check code, up to two referees, and a next of kin.
• Details read from your documents: the document type, its number, issue and expiry dates and the name on it. These are checked and confirmed by a person at the firm before they are relied on. The firm may also add its own notes.

DBS (criminal record) information

We keep DBS information to the minimum needed. A member of The Ops Con team looks at your DBS certificate photo and records only:

• whether it is clear or not clear,
• its level (basic, standard or enhanced),
• the certificate number and issue date you gave us,
• who checked it and when.

We then delete the certificate photo. If a certificate is not clear, we record only “not clear”. We do not record what is on the certificate. Firms that hire you never see the certificate photo.

Our reasons for using your information

We use this information because it is needed to provide the service you signed up for (helping you get cleared to work with the firms that hire you), and because it is in the legitimate interests of those firms and of The Ops Con to check that operators placed in security roles are properly licensed, allowed to work in the UK, and who they say they are. Sharing your documents with a particular firm is your choice (see below).

Who can see your documents

• You. You can see everything you have uploaded on your onboarding page.
• The Ops Con team. Our administrators can open your documents, for example to record your DBS result or to help with a problem.
• Firms that have hired you, only if you choose. When a firm hires you, we ask whether you want to share your onboarding information with that firm. Nothing is shared unless you agree. If you do, that firm can see your documents (but never your DBS certificate photo or your CV through this route), your DBS number, issue date and our DBS result, and your right to work share code and date of birth. You decide separately for each firm.
• No other firm. A firm that has not hired you, or that you have not shared with, cannot see your documents or even that they exist. One firm cannot see another firm’s checks, notes or decisions about you.

You can stop sharing with a firm at any time from your onboarding page. This takes effect straight away. It does not undo checks the firm has already made, and the firm keeps its own record that it checked your documents.

When a firm is told a new document is waiting, the email gives only your name and the type of document.

Firms can download a vetting report about the operators they work with. It includes the details they have checked, but never your document images, file names or links, and never your right to work share code or DVLA check code themselves, only that they were checked.

Reading your documents with AI

To save time, when you upload a document (other than your CV or DBS certificate photo), we send it to a trusted AI service provider, which uses an AI model to read the printed details: the document type, number, dates and name. These are only suggestions. A person at the firm checks them against the document and corrects them before confirming. Nothing is approved automatically.

This provider works for us under business terms. Those terms say it may not train its models on the content we send, and it deletes what we send, and what it sends back, within 30 days, except where it has to keep something longer for legal or safety reasons.

We keep the details that were read, not a second copy of the document. We do not record the document or the details in our system logs.

How we store your documents

Your documents and account information are stored in the UK. Some of the services we use, such as email, payments and AI document reading, are run by companies based outside the UK. Where they handle your information, it is protected by their contract terms.

Each file is saved under a long random name that does not include your name. The storage link is never shown on screen: every time a document is opened, it is opened through our website, after we have checked that the person is allowed to see it.

No system is completely secure, but we limit who can open your documents to the people listed above.

How long we keep your information

• While you have an account: we keep your documents and the details recorded from them, so the firms that hire you can vet you.
• DBS certificate photo: deleted once The Ops Con has recorded the result. We keep the result summary described above.
• Keep on file: for proof of address, photo ID that is not your right to work evidence, first aid, driving licence, other certificates and your DVLA screenshot, you choose. Tick “Keep on file for future partners” to keep it for the next firm. If you do not, we delete the file once a firm has checked it.
• Documents no firm has checked: deleted after 12 months.
• Documents sent back to you by a firm: deleted 12 months after they were sent back.
• Right to work evidence: kept for each firm that relied on it while you work for them and for 2 years after, because firms must be able to show they checked it. This applies even if you delete your account. After the 2 years it is deleted.
• Each firm’s own record: a firm keeps its own record of what it checked while it works with you.
• Financial records (payments, invoices and bookings): kept for 7 years, for tax and accounting.

Deleting your account

You can delete your account from your account page. Before you do, you can download a copy of your own information. When you delete your account, your documents, onboarding and vetting details and profile are permanently deleted. The only exceptions are right to work evidence a firm has relied on (kept for 2 years after you last worked with that firm, as above) and financial records (kept for 7 years).

References

When a firm hires you and you have agreed to share your information with it, that firm asks your referees for a short reference by email, using The Ops Con. Each firm that hires you sends its own request. We only accept work email addresses for referees.

We store the referee’s answers, the name, position and company they give, and the date they sent it.

By adding a referee, you agree that firms that hire you can contact them for a reference. Please only give a referee’s details if they have agreed to give you one.

Sharing your documents with a company outside The Ops Con

You can share documents from your Documents area with a company that is not on The Ops Con, by entering its work email address. Only you can do this. The Ops Con never shares your documents with anyone outside the platform without your action.

• The company gets a link that works for 7 days, or until you cancel it. To open it they must enter a one-time code sent to the same email address, and agree to the sharing terms. After entering the code they have 60 minutes to view and download.
• We record when the link is opened and each document is viewed or downloaded, including the device’s IP address and browser details, so you can see what happened. We keep these records for 12 months.
• Once the company has downloaded a document, it holds that copy under its own data protection policies, not The Ops Con’s. Cancelling the link stops further access but does not remove copies already downloaded.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us to:

• give you a copy of the information we hold about you,
• correct anything that is wrong,
• delete your information, except where we need to keep it (as set out above),
• stop using your information, or restrict how we use it, if you object.

You can stop sharing with a firm, and change your “Keep on file” choices, yourself at any time from your onboarding page.

To make a request, email info@theopscon.com. The Ops Con Ltd is registered with the Information Commissioner’s Office, registration number ZC166341. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to sort it out first.