Skip to the document
Legal

Privacy Policy

How NoBound Hires handles personal data belonging to client staff and to the workers employed through the platform. The outline below is the structure counsel is drafting into.

Version
v0-placeholder
Status
Placeholder — not in force
Effective date
None — not in force
Outline last updated
5 September 2026

1. Who we are and what this covers

Awaiting counsel

What this section has to establish

This section must identify the entity responsible for the data and say which people this notice speaks to — client staff, employees, contractors and site visitors are four different audiences with different rights.

  • The entity's name, registered address and, where one is required, its representative.
  • The audiences covered, and any that have a separate notice.
  • The relationship between this notice and the data-processing terms in the Terms of Service.

2. The information we collect

Awaiting counsel

What this section has to establish

This section must list the categories actually held. An EOR holds identity documents, bank details and salary — the sensitive end — so the list has to be specific rather than gestural.

  • Account and contact data for client users.
  • Worker identity and right-to-work data, including identity documents and any national identifier.
  • Employment data: role, compensation, working time, leave, performance-related records.
  • Payroll and payment data: bank details, payout instructions, tax and contribution records.
  • Documents uploaded to the platform, and where each is stored.
  • Technical and usage data, including anything captured for security or fraud prevention.
  • Any special-category or otherwise sensitive data, named explicitly, with the extra basis relied on for it.

3. Where the information comes from

Awaiting counsel

What this section has to establish

This section must say what is collected from the person and what arrives about them from somewhere else, because the second is what people are not expecting.

  • Data given directly by the person.
  • Data provided by the client about its workers.
  • Data from verification, sanctions-screening or background-check providers.
  • Data from banks and payment partners.

4. Why we process it, and on what basis

Awaiting counsel

What this section has to establish

This section must pair each purpose with a lawful basis under each regime that applies, rather than listing purposes and bases in two disconnected lists.

  • Providing the services and performing the contract.
  • Meeting legal obligations: employment, tax, social insurance, anti-money-laundering, sanctions.
  • Legitimate interests, each one named, with the balancing that supports it.
  • Consent, where it is relied on, and how it can be withdrawn.
  • Whether any decision with a legal or similarly significant effect is made by automated means.

5. Controller and processor roles

Awaiting counsel

What this section has to establish

This section must state where NoBound decides and where it acts on the client's instructions, because in an EOR the answer differs between payroll data and the client's own management of a worker.

  • Where NoBound is controller, and for which processing.
  • Where NoBound is processor for a client, and where the two are joint controllers.
  • Who a person should approach for which kind of request, and what happens if they approach the wrong one.

6. Who we share it with

Awaiting counsel

What this section has to establish

This section must name the categories of recipient, and say what each receives. An EOR's sharing is unusually wide — local entities, banks, tax authorities — and a vague list here is the most common failure in a notice of this kind.

  • The client, and which of its people can see what.
  • In-country partner entities and local payroll providers.
  • Banks, payment providers and foreign-exchange counterparties.
  • Tax authorities, social insurance bodies and other regulators.
  • Infrastructure and service sub-processors, and where a current list is published.
  • Professional advisers, and any acquirer in a corporate transaction.

7. International transfers

Awaiting counsel

What this section has to establish

This section must say where data goes and what protects it there — the operative question for a platform whose workers, client and infrastructure are routinely in three different jurisdictions.

  • The countries and regions data is transferred to or accessed from.
  • The transfer mechanism relied on for each route.
  • How a person can obtain a copy of the safeguards.

8. How long we keep it

Awaiting counsel

What this section has to establish

This section must give retention by category, driven by the statutory minimums for payroll and employment records in each market served, not by a single number chosen for the whole platform.

  • The retention period, or the criteria that set it, for each category in section 2.
  • The statutory minimums that drive the payroll and employment record periods.
  • What happens at the end of a period: deletion, anonymisation or archive.
  • The effect of a legal hold.

9. How we protect it

Awaiting counsel

What this section has to establish

This section must describe the measures in place without either overstating them or publishing anything that helps an attacker.

  • Technical measures: encryption in transit and at rest, access control, private document storage, audit logging.
  • Organisational measures: role-based access, staff training, vendor assessment.
  • The breach-notification commitment made to affected people.

10. Your rights and how to exercise them

Awaiting counsel

What this section has to establish

This section must set out rights per regime and give one route to exercise them, since the people covered sit under several different regimes at once.

  • Access, rectification, erasure, restriction, portability and objection, and where each applies.
  • Withdrawing consent, and what it does and does not undo.
  • How to make a request, what identity check is applied, and the response time.
  • The right to complain to a supervisory authority, and how to reach the relevant one.
  • Any right that a legal retention obligation limits, and why.

11. Cookies and similar technologies

Awaiting counsel

What this section has to establish

This section must describe what the site and the application actually set, and must be checked against the running product rather than written from a template.

  • Strictly necessary cookies, including the session and authentication cookies.
  • Analytics or performance technologies, if any are in use.
  • How a preference is expressed and changed.

12. Changes to this notice

Awaiting counsel

What this section has to establish

This section must say how a new version is published and how people are told, matching the equivalent clause in the Terms of Service.

  • How and when notice of a material change is given.
  • That each version carries a version identifier and an effective date.
  • Where superseded versions can be read.

13. Contact

Awaiting counsel

What this section has to establish

This section must give a route to a person who can actually answer a data question, and name any statutory contact the applicable regimes require.

  • The address for privacy enquiries and rights requests.
  • The data protection officer or representative, where one is appointed.
  • The supervisory authority a person may complain to.

Nothing above is in force

This page exists so that the route, the version stamp and the consent record are real before the text is. It will be replaced in full by the document NoBound's legal counsel delivers, and that version will carry its own version identifier and an effective date.

Read the Terms of Service