Legal
Privacy notice
This notice explains what PreHire collects from an employer, a candidate and a referee, why we are allowed to hold it, how long we keep it, and how to ask for it.
No cookies, no tracking pixels, no consent banner. This site sets no cookies and loads no third-party tracking scripts, so there is nothing to ask you to accept. The signed-in application uses only strictly necessary cookies — one to keep you signed in and, during two-step sign-in, one that lasts ten minutes. Neither is a tracking cookie and neither needs consent.
Who we are
PreHire is the trading name of Island Stream Ltd, company number 15353850, registered at 124 City Road, London, England, EC1V 2NX. We are the controller for the data described in this notice.
What we collect, and from whom
- From an employer
- The name and work email of the person raising a check, the organisation name, and the candidate’s name, email address and the role they applied for.
- From a candidate
- Their consent, the referees they nominate — name, work email, employer and relationship — and the job title and employment dates they claim at each employer. We do not collect a CV, date of birth, address, ID documents, or criminal or health data, and we do not run DBS or right-to-work checks.
- From a referee
- Their answers to the questionnaire, their own job title, the address they reply from, and the technical detail of that reply. A referee is told who nominated them and why they were contacted before they are asked anything.
- From public sources
- Companies House records, and mail and domain records for the referee’s email domain. These are the only two, they are open sources, and the report names the source behind every result.
Why we are allowed to do it
A candidate’s data is held with their explicit consent, given before any referee is contacted and withdrawable at any time. A referee has no account with PreHire and gives us no consent of their own — their data is held under our legitimate interest in verifying the reference they were named for, on behalf of the employer running the check, balanced against the limited, expected and time-boxed use this notice describes. An employer’s own contact details are held to run the account they hold with us.
How long we keep it
Kept only as long as it is needed for the reason it was collected, then deleted or anonymised on a fixed schedule:
| What | Kept for | Counted from |
|---|---|---|
| Employer contact details (the person raising a check) | 90 days | From the check closing |
| Reports issued to an employer | 12 months | From the date the report was issued |
| Candidate and referee working data — contact details, referee answers, message headers | 3 months | From the check closing |
| A referee who declines to take part | 30 days | From the decline |
| Audit records of what happened on a check (no names or addresses) | 12 months | From the event |
Who else processes it
A small number of suppliers process data on our behalf to run the service — email delivery, payments, and error monitoring among them. Every one of them is named, with what they handle, on our sub-processor list.
Your rights and how to use them
You can ask us what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. A candidate can also ask for the report we hold about them. Email privacy@prehire.ai and a person will answer you. If you are not satisfied with our answer, you can complain to the Information Commissioner’s Office (ico.org.uk). Our ICO registration number is pending.