How OpesQ collects, uses and protects your data
Last updated: 5 April 2026
OpesQ Ltd is a company registered in England and Wales. We provide a cloud-based platform that helps businesses manage employee HR data, training records, compliance documents and employment passports.
For the purposes of UK data protection law:
Our data protection contact is: hello@opesq.com
We distinguish between three categories of data on the platform. Each has different ownership and handling rules.
Passport holders own and control their own Passport data. Sharing a Passport with an employer or prospective employer is always consent-based. Passport holders can:
When a business views a shared Passport, they see only the sections the holder has consented to share. No data is transferred to the business account without explicit holder consent.
We rely on the following lawful bases under UK GDPR:
Where we rely on consent, you can withdraw it at any time by contacting us or using the relevant controls in your account settings.
We collect and process the following categories of data:
We use cookies and similar technologies on our website and platform. These fall into three categories:
You can manage your cookie preferences at any time through the cookie settings link in the website footer.
We retain data for the following periods:
We use a limited number of trusted third-party service providers to operate the platform, covering hosting, database infrastructure, email delivery, media storage and AI-powered features. Each sub-processor processes data on our behalf under appropriate contractual safeguards.
A full list of our current sub-processors is available on request by contacting us at hello@opesq.com. We will notify subscribing businesses of any material changes to our sub-processor list in advance.
Our primary database is hosted in a UK/EU data centre region. However, some of our sub-processors are based in the United States.
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. For US-based processors, we rely on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner, along with supplementary technical and organisational measures where necessary.
You can request a copy of the relevant transfer safeguards by contacting us at hello@opesq.com.
Under UK GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at hello@opesq.com. We will respond within one month. If your request is complex, we may extend this by a further two months and will notify you if so.
Note for employees whose data is managed by their employer: If your employer uses OpesQ to manage your HR records, please direct data access requests to your employer in the first instance. As a data processor, we act on the instructions of the subscribing business. We will assist your employer in fulfilling your request.
OpesQ is not designed for or directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.
If you are unhappy with how we have handled your personal data, please contact us first at hello@opesq.com so we can try to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform. The "Last updated" date at the top of this page shows when the policy was last revised.
If you have any questions about this Privacy Policy or how we handle your data, contact us at: