Privacy Notice

This notice explains how the Cross entity identified in the relevant account, order, or invoice handles personal data when providing the Cross sponsor-compliance platform. It applies to account holders, authorised users, legal advisors, staff, website visitors, and people whose information is entered into Cross by a customer.

Cross is normally the controller for account administration, product security, billing, service communications, support, and its own legal obligations. For employee, worker, company-officer, emergency-contact, and compliance information entered by a customer, the customer normally decides why the data is used and Cross acts as its processor. The applicable roles may differ where law requires a party to process data for its own purposes.

• Account and security data: name, work email, password hash, verification status, memberships, roles, login and session records, notification preferences, IP address, shortened browser information, and security events.
• Company and sponsor data: company identity, registered and operating addresses, sponsor-licence information, key contacts, authorised users, and company authority records.
• Workforce and employment data: name, date of birth, nationality, address, phone number, email address, emergency contacts, job, duties, salary, working hours, work location, employment dates, and employment status.
• Immigration and compliance data: passport, visa, permission to work, Certificate of Sponsorship, Right to Work check, document, review, deadline, attendance, leave, absence, travel, and change-report information.
• Advisor and support data: assignments, messages, attachments, review findings, private professional notes, actions, and submission records.
• Billing data: selected plan, billing contact and address, subscription, invoice, payment status, tax information, refund or payment-dispute status, and Stripe references. Cross does not receive or store full payment-card details.
• Usage and audit data: timestamps, policy acceptances, record changes, file access, feature events, and privacy-minimised onboarding statistics.

We receive data from account holders, their organisations and authorised advisors; from information an organisation enters about its workforce and professional contacts; from Companies House public records; from Stripe billing and payment events; and automatically when Cross is used. Customers must give affected people any workforce privacy information required by law before placing their data in Cross.

We use personal data to:

• create accounts, verify authority, authenticate users, and provide Cross;
• organise workforce and sponsor-compliance records on the customer’s instructions;
• enforce permissions, prevent misuse, investigate incidents, and preserve audits;
• administer subscriptions, calculate applicable tax, issue invoices, recover payment, and respond to refunds, suspected fraud, or payment disputes;
• send account, security, billing, reminder, and compliance communications;
• support advisor assignment, document review, and customer support; and
• meet legal duties and establish, exercise, or defend legal claims.

Where Cross acts as controller, the relevant UK GDPR basis will normally be performance of a contract, compliance with a legal obligation, or legitimate interests in operating, securing, supporting, and improving the service. We rely on consent only where the law requires it. Customers are responsible for identifying their own lawful basis when they control workforce data placed in Cross.

Attendance or absence information may reveal health information. Uploaded evidence or free-text fields may also contain sensitive information. Customers must only enter what is necessary, must not use Cross as a general medical-record system, and must identify any additional UK GDPR or Data Protection Act 2018 condition required for special category data.

Cross does not use workforce information to make solely automated decisions producing legal or similarly significant effects. Compliance statuses and reminders are organisational aids and must be reviewed by an authorised person.

Cross does not currently send Customer Personal Data to an artificial-intelligence or large-language-model provider. Compliance statuses, reminders, and suggested next steps are generated from predetermined dates, record states, and product rules. If this changes, we will assess the processing and update this notice and our subprocessor information before the feature is enabled for Customer Personal Data.

Personal data may be available to:

• authorised users within the relevant customer workspace;
• an assigned legal advisor while the customer has an eligible Managed subscription and the assignment remains active;
• Cross staff who need access for support, security, administration, or legal duties;
• Vercel Inc.: delivery of the public web application and related visitor request and security data through its distributed network. Under the current architecture, authenticated workspace data is sent by the browser directly to the Cross API rather than stored by a Next.js application backend;
• Railway Corporation: operation of the Cross API. The selected European runtime region is Amsterdam, Netherlands. Railway states that its primary processing operations are in the United States;
• Cloudflare, Inc.: private encrypted document and case-attachment storage using an immutable European Union jurisdiction restriction;
• Neon, LLC, a Databricks affiliate: managed PostgreSQL database service, with the production project selected for the London, United Kingdom region;
• Twilio Inc.:SendGrid transactional and compliance email using its EU data-residency service. Limited support or engineering access may occur outside the EU under Twilio's safeguards;
• Stripe: payments, subscriptions, invoices, tax calculation, refunds, fraud prevention, and payment disputes. The applicable Stripe entities may act as processors or independent controllers for different activities;
• Companies House when public company information is requested or checked; and
• professional advisers, auditors, courts, regulators, law enforcement, or public authorities where disclosure is necessary or legally required.

We do not sell personal data.

The main database project is selected for London and document storage is restricted to the European Union. Other processing is not UK-only: Vercel uses a distributed delivery network, Railway identifies United States primary processing operations, and provider support teams may access information from other countries. Where a restricted transfer is made, we use an available lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism recognised by UK law, together with proportionate technical and organisational safeguards.

Cross uses a secure, HttpOnly cookie to maintain a signed-in session. The interface also stores a sidebar preference, table-display preferences, and short-lived page state on the user’s device. These items support security and features requested by the user; they are not used for third-party advertising.

Cross does not currently use third-party behavioural advertising or marketing cookies. If optional analytics or advertising technology is introduced, this notice and the consent controls will be updated before that technology is enabled.

Retention depends on the record, the customer relationship, statutory sponsor and Right to Work requirements, tax and accounting duties, security needs, and any dispute or legal hold. Cancelling a subscription does not immediately delete compliance evidence that a customer or Cross must lawfully retain. The applicable periods and deletion process are explained in our Data Retention and Deletion Policy.

Cross uses tenant- and role-based access controls, protected authentication tokens, encryption in transit, encrypted private document storage, short-lived document links, access logging, backups, and audit records. Customers remain responsible for their users, devices, downloaded exports, and the accuracy of permissions they grant. No online service can guarantee absolute security.

Depending on the circumstances, an individual may have rights to access, correct, erase, restrict, or object to processing; receive portable data; and withdraw consent. Requests about workforce records should normally be made first to the employer or organisation that controls the relevant workspace. Cross will assist that organisation where required by our Customer Data Processing Agreement.

Privacy questions and requests may be submitted through the support contact shown in Cross or in the relevant account, order, or invoice. Individuals may also complain to the UK Information Commissioner’s Office. We encourage people to contact us or the relevant customer first so the concern can be investigated promptly.

We may update this notice when the service, providers, or law changes. The current version and effective date appear above. We may notify active customers of material changes. Updated legal documents may need to be acknowledged before Checkout, reactivation, or a plan change.