QualsWallet is a digital wallet for storing, tracking, and sharing professional qualifications, work history, and related documents, alongside a jobs board connecting workers and employers. QualsWallet is operated by Site Skills Passport Ltd, which also operates Site Skills Passport™ (siteskillspassport.co.uk) for the construction industry. This policy applies specifically to QualsWallet (qualswallet.co.uk).

Data Controller:
Site Skills Passport Ltd
Registered in England and Wales, company number 17023365
Registered office: 11 Kingsley Road, Worsley, Manchester, M28 3TJ
Email: support@qualswallet.co.uk
Website: qualswallet.co.uk

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our registration number is ZC168090.

Identity & Contact Information

• Full name, email address
• System-generated user ID
• Account type (worker or employer)

Profile & Professional Details

• Profession, avatar/profile photo
• Availability status and who can see it (everyone, employers only, or nobody)
• About me / personal statement, hobbies

Qualifications

• Qualification titles, issuing bodies, reference numbers
• Issue and expiry dates
• Uploaded certificate documents and images
• Notes you add to a qualification
• Professional registration numbers you choose to add (for example, an NMC pin)

DBS Certificate Details

Where you choose to add DBS certificate information (for example, certificate type or reference number), this is treated under UK data protection law as criminal offence data — see Section 4 below for how this is handled.

Work History & Experience

• Employer names, job titles, locations, dates and description of duties
• Employment verification records — see next section

Employment Verification

If you ask a past employer to confirm a work history entry, we send a one-time secure link to the employer contact details you provide. The employer does not need a QualsWallet account to respond. We store their response (confirmed / not accurate), any note they leave, and the date of response.

Education

• Institution name, qualification, field of study, and dates

References

• Referee name, job title, company, and email address

Jobs Board

• If you're a worker: which jobs you apply to, and your application status
• If you're an employer: job listings you post (title, profession, location, salary, description), and access to relevant profile data of workers who apply to your jobs
• Blocked employers you choose to prevent from seeing your profile

Public Profile Sharing

If you enable your public profile link, the qualifications, work history, and "about me" information on your profile becomes visible to anyone with that link, without requiring them to log in.

Subscriptions & Payments

• Subscription plan and status, billing period dates
• Payment is processed by Stripe — we do not store your card details

Uploaded Files & Media

Certificate images and documents, profile photos, and any other files you upload are stored in secure, access-controlled cloud storage.

Device & Technical Data

• IP address, browser type, and device information
• Cookies and local storage used for authentication and basic security (see our Cookie Policy)

We use your personal data to:

• Provide and maintain the QualsWallet service
• Store and display your qualifications, work history, and documents
• Facilitate employment verification requests you initiate
• Operate the jobs board, including matching applications to listings
• Process subscription payments and manage your account access
• Send transactional emails (account activity, billing, expiry reminders)
• Display your public profile, if you choose to enable it
• Improve the service and prevent fraud or misuse
• Comply with legal obligations

Where you add DBS certificate details to your qualifications wallet, this is processed as "criminal offence data" under Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018 — a distinct, heightened category, separate from ordinary personal data, even where a certificate shows no convictions.

We do not independently verify DBS certificate numbers against any official register. Storing this information in QualsWallet does not constitute official verification.

Our AI Scanner feature uses automated image analysis to read certificate documents you upload and suggest field values — such as the qualification title, issuing body, and dates — to pre-fill the entry form for you. It is a convenience feature only: it makes no decisions about you, and nothing is saved until you review and confirm the suggested values yourself.

We process your data under the following lawful bases:

• Contract: to provide the service you've signed up for
• Consent: for optional features such as employer visibility and your public profile link
• Legitimate interest: to improve the service, prevent fraud, and ensure platform security
• Legal obligation: to comply with applicable laws, including tax and accounting requirements

We share your data with:

• Employers you apply to, or who verify your work history at your request
• Anyone with your public profile link, if you choose to enable it
• Payment processor (Stripe) — to process subscriptions securely
• Cloud infrastructure (Supabase) — to host and store your data securely
• Hosting/CDN provider (Cloudflare) — for security and content delivery

We do not sell your personal data to third parties. We do not share your data for advertising purposes.

We implement technical and organisational measures to protect your data, including:

• Encryption in transit (TLS)
• Row-level database security, so other users cannot access your private data
• Secure password hashing
• Access-controlled storage for uploaded documents

We retain your data for as long as your account is active. If you delete your account, your personal data will be removed within 30 days, except where we're required to retain certain records for longer (for example, payment records for tax purposes).

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at support@qualswallet.co.uk. We will respond within 30 days.

You can also manage and delete much of your own data directly within the app without needing to contact us.

Our service is intended for users aged 16 and over. We do not knowingly collect data from users under this age. During sign-up, users must confirm they meet this requirement before creating an account.

Your data is hosted within the European Union (AWS eu-west-1, Ireland) by our cloud database provider. The app is delivered globally via Cloudflare's content delivery and security network.

A limited set of third-party service providers may process data outside the UK/EU:

• Stripe — processes subscription and payment data. We contract with Stripe Payments UK, Limited (company no. 08480771), but Stripe's underlying infrastructure processes data in the United States. We do not store card details ourselves.

Where data is transferred outside the UK, we rely on the UK Information Commissioner's Office International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses (SCCs), as approved under UK data protection law.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification at least 14 days before they take effect.

For full details on how we use cookies and similar technologies, please see our Cookie Policy.

Email: support@qualswallet.co.uk
Website: qualswallet.co.uk

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.