Who We Are
Thorncheck is an online reference checking platform operated by Thorncheck Limited, registered in England and Wales (company number 17137215), with a registered address at 124 City Road, London, EC1V 2NX.
For privacy-related enquiries, contact us at privacy@thorncheck.com.
About Our Service
Thorncheck connects three types of users:
- Employers sign up to request and manage employment references through our platform.
- Candidates receive an invitation from a prospective employer to provide referee contact details.
- Referees receive an invitation to provide a confidential reference for a candidate.
Candidates and referees access Thorncheck via secure, unique links — no account or password is needed.
What We Collect
From Employers
- Name, email, phone number
- Company name, team role (Owner, Admin, User, Viewer)
- Reference requests, question profiles, and communication settings
From Candidates
- Name, email, phone number (provided by the employer)
- Job title, employment company, and employment period
- Referee names, emails, phone numbers, and relationship to you
From Referees
- Name, email, phone number, company (provided by the candidate)
- Reference questionnaire responses (text, ratings, yes/no, multiple choice)
- Employment verification details (company, role, dates)
How We Use Your Data
We use your data to provide the Thorncheck service — this includes sending invitations to candidates and referees, collecting and compiling reference responses, generating reports, and managing your account. We send emails and SMS messages as part of this process, and use your billing information to manage payments and subscriptions. Where you have enabled it, we also use anonymised reference responses to generate AI-powered insights to assist employers in their hiring decisions. We may use data to improve the reliability and performance of the platform and to protect against fraud and misuse. In some cases we are required to process data to comply with legal obligations. The legal basis for most of this processing is the performance of our contract with you; where we rely on legitimate interests instead, these are improving the service, security, and AI insights.
AI Insights
Thorncheck uses artificial intelligence to generate summary insights from referee responses. These insights are advisory only and should not be the sole basis for any hiring decision — employers are responsible for exercising their own judgement when interpreting them. Only anonymised questionnaire responses are sent for analysis; no personally identifiable information, decline reasons, or candidate unavailability explanations are shared with our AI provider. Data sent to our AI provider is not used to train their models.
Cookies and Tracking
4.1 We may collect non-identifying data about your activity when you visit our marketing website. This may include the pages you view, the date and time of your visit, and general location information associated with your IP address. We use this information to understand how visitors find and use our site, and to improve it. You can opt out of analytics data collection by adjusting your browser settings or using a browser extension that blocks tracking scripts.
4.2 We use Stripe for payment processing and billing management. Stripe collects information about the devices that connect to its services and uses this to operate its platform, including for fraud detection and subscription management. You can learn more at stripe.com/privacy.
Third-Party Services
Your data is stored within the EU. To deliver our services, we work with a small number of trusted third-party providers — including for hosting, payments, email and SMS delivery, authentication, and AI-powered insights. We share data with these providers only to the extent necessary to provide the service, and we do not sell your personal data or share it for advertising purposes. Some of these providers may process data outside the UK or EU. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR and applicable data protection law.
International Data Transfers
Your data may be transferred to service providers outside the UK (e.g., Stripe, OpenAI in the US). Where this happens, we rely on the data protection commitments and contractual safeguards provided by those services.
Data Retention
For data we process on behalf of employers, we retain personal data in accordance with the employer's instructions and for as long as is necessary to provide our services. Where no specific instruction is given, reference request data — including questionnaire responses and employment verification details — is retained for up to 2 years from the date the request was completed, after which it is securely deleted or anonymised.
Basic contact details (such as name and email address) associated with candidates and referees may be retained for longer where there is a legitimate operational reason to do so, such as to support future reference requests or to comply with legal obligations.
You may request deletion of your personal data at any time by contacting privacy@thorncheck.com.
Data Security
We protect your personal data through a combination of technical and organisational measures. All data is encrypted in transit using HTTPS/TLS and encrypted at rest. Access to data within employer accounts is controlled through role-based permissions, ensuring that users can only access information relevant to their role. Candidates and referees access the platform via secure, unique links that are regenerated if contact details change. We regularly review our security practices to ensure your data remains protected.
Your Rights
Under UK GDPR, you have the right to access, correct, or delete your personal data, to restrict or object to how we process it, and to receive your data in a portable format. Where processing is based on consent, you may withdraw that consent at any time. To exercise any of these rights, contact us at privacy@thorncheck.com and we will respond within one month.
If you are a candidate or referee, please note that Thorncheck processes much of your data on behalf of the employer, who is the data controller — for certain requests we may need to refer you to them directly.
If you are unsatisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk.
Children's Privacy
Our service is not directed at individuals under 16. We do not knowingly collect data from children. If you believe a minor's data has been submitted, please contact us immediately.
Email and SMS Communications
Candidates and referees receive emails and SMS messages as part of the reference process. These communications are necessary to deliver the service.
To opt out of SMS messages, contact support@thorncheck.com.
If we introduce marketing communications in the future, we will obtain your consent first.
Changes to This Policy
We may update this policy from time to time. Material changes will be clearly indicated on our website. We encourage you to review this page periodically.
Contact Us
- Privacy enquiries: privacy@thorncheck.com
- General enquiries: support@thorncheck.com
- Address: Thorncheck Limited, 124 City Road, London, EC1V 2NX
- ICO: ico.org.uk