StudentCheck Privacy Policy

Effective date: 03 March 2026

This Privacy Policy explains how Redwood Collections Ltd ("we", "us") uses personal data when providing the StudentCheck service (the "Service").

1) Who we are

2) Important roles (education providers and verified individuals)

StudentCheck is used by education providers to verify individuals (for example, students and guarantors).

  • For verification data (the people a provider asks us to verify): the provider is the data controller and we act as a data processor on the provider's instructions.
  • For school staff account data (the people who log into StudentCheck): we are the data controller for creating and managing those user accounts.

3) What personal data we collect

A. School staff users (account data)

  • Name
  • Work email address
  • School name

B. Individuals verified by a provider (verification inputs + results)

  • First name
  • Last name
  • Date of birth
  • School internal reference (optional)
  • Verification results (scores/decisions generated from the checks)

We don't ask schools to provide special category data (such as health data) via the Service.

4) What we use data for

A. School staff account data (we are controller)

We use this to:

  • create and manage user accounts and access to the portal
  • provide support and respond to requests
  • maintain security and prevent misuse

B. Verification data (we are processor)

We use this to:

  • run single and batch verification checks
  • return results to the provider through the portal

5) Legal bases (where we are controller)

When we act as controller for school staff account data, we rely on:

  • Legitimate interests (operating a B2B verification portal, managing accounts, preventing fraud and abuse), and/or
  • Performance of a contract (providing the Service to the school)

When we process verification data, the provider determines the lawful basis. Providers commonly rely on legitimate interests and/or compliance-related obligations.

6) Who we share data with

We share personal data only with:

  • the provider using the Service (for verification results and administration)
  • service providers that help us deliver the Service, including:
    • TransUnion TruValidate (identity verification provider)
    • Render (hosting provider for the Service infrastructure)

We do not sell personal data.

7) Where data is processed

We host and run the Service using our hosting provider. Render allows customers to select the region where a service/datastore is created.

If any personal data is processed outside the UK, we use appropriate safeguards required under UK data protection law (for example, contractual protections).

8) How long we keep data

Verification data (inputs + results)

We retain verification inputs and results for 7 days, then hard delete them.

School staff account data

We retain account information while the school has an active relationship with us, and afterwards for as long as needed for legitimate business purposes (for example, security, audits, and handling disputes). A typical retention period is up to 6 years after the end of the customer relationship.

9) Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls and security monitoring.

10) Cookies and analytics

At present, the StudentCheck portal does not use analytics or advertising cookies. If this changes, we will update this policy.

11) Your rights

Rights differ depending on whether we are the controller:

  • If you are a verified individual: the provider is the controller, so you should contact the provider to exercise your rights (access, correction, deletion, objection, etc.). We will assist the provider where required.
  • If you are a school staff user (portal account): you can contact us at support@studentcheck.co.uk to exercise your rights in relation to your account data.

You also have the right to complain to the UK data protection regulator, the Information Commissioner's Office (ICO).

12) Changes to this policy

We may update this policy from time to time. We will post the latest version in the Service and update the effective date above.