1. Who we are and what this covers
easyOnboard is run by [YOUR LEGAL NAME], of [YOUR ADDRESS], Isle of Man ("we", "us"). Contact us about privacy at privacy@easyonboard.uk.
We handle personal information in two different roles, and your rights depend on which applies to you:
- If you are a customer or a team member using easyOnboard to hire people, we decide how your account information is used. We are the controller, and sections 3 onwards apply to you.
- If you are a candidate or employee of a business that uses easyOnboard, that business decides how your information is used. It is the controller and we act on its instructions as its processor. Section 2 is for you.
2. If you applied for a job through easyOnboard
The employer you applied to is responsible for your information. They chose to use easyOnboard to store it and to send you letters and contracts. Their own privacy notice explains how they use it.
What we hold for the employer:
- your name, email address and phone number;
- your CV, cover letter and any other files you or the employer upload;
- your answers to any questions the employer adds to its application form;
- details the employer adds, such as interview dates, interview location or meeting link, pay and start date;
- the interview time you book, and any different time you suggest along with the reason you give;
- notes the employer writes about your application or interview;
- the letters and contracts sent to you, and whether you signed them;
- if you sign a document: the name you typed, the date and time, your IP address and a digital fingerprint of the document.
What we do with it. We store it securely, show it to the employer's authorised staff, and send you messages when the employer asks us to. We use it for our own purposes only where that is needed to keep the service secure or to meet a legal obligation, as described in section 6. We do not sell it, use it for advertising, or share it with other employers. Our support staff cannot see your details through our support tools; they see only how many candidates an employer has.
How long it is kept. The employer sets this. By default, information about candidates who are not hired is deleted 6 months after the decision.
Your rights. You can ask the employer for a copy of your information, including interview notes, and ask them to correct or delete it. Contact the employer directly. If you write to us instead, we will pass your request to them. If the employer does not deal with a deletion request within 30 days, or their account is closed or inactive, we may delete your information ourselves.
Automated decisions. easyOnboard does not score, rank or reject candidates automatically. Every decision is made by a person at the employer.
3. Information we collect about customers
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, business name, role in the team | You, or the person who invited you |
| Sign-in details | The email and account ID supplied by Google or Microsoft if you sign in with them, or the one-time codes we email you. We never receive your Google or Microsoft password | You and your sign-in provider |
| Billing details | Plan, billing address, payment history, the last four digits of your card. Full card numbers go to our payment provider and never reach us | You and our payment provider |
| Usage records | Pages and features used, actions taken such as sending or deleting, dates and times | Collected automatically |
| Security settings | Whether two-step sign-in is on, when you last signed in, and any sign-outs or two-step resets our staff made on your account | Collected automatically, and our staff |
| Technical details | IP address, browser and device type, error reports | Collected automatically |
| Messages | Emails and support requests you send us | You |
4. How we use customer information
Data protection law requires us to have a lawful reason for each use.
| What we do | Information used | Lawful reason |
|---|---|---|
| Create and run your account, and provide the service | Account, sign-in and usage details | Needed to perform our contract with you |
| Take payment and keep billing records | Billing details | Contract, and our legal obligations on tax and accounts |
| Send service messages, such as security alerts, deletion warnings and changes to terms | Account details | Contract and legitimate interests |
| Keep the service secure, and prevent fraud and abuse | Usage, technical and sign-in details | Legitimate interests in protecting customers and the service |
| Fix faults and improve the service | Usage and technical details | Legitimate interests in running a reliable product |
| Give support and manage accounts: look up an account, sign people out, reset two-step sign-in, give complimentary plans, close, reopen or erase accounts | Account, sign-in, security and billing details, and how many roles and candidates an account has | Contract, and legitimate interests in supporting customers and protecting accounts |
| Answer your questions | Messages and account details | Contract and legitimate interests |
| Meet legal obligations and respond to lawful requests | Whatever the law requires | Legal obligation |
| Send news about the product | Name and email | Your consent, which you can withdraw at any time |
We do not sell personal information. We do not use it for advertising. We do not use your content or your candidates' information to train artificial intelligence models.
5. Who we share information with
We use a small number of companies to run the service. Each one handles information only on our instructions and under a written contract.
| Company | What it does for us | Where it processes data |
|---|---|---|
| Supabase | Database, sign-in and file storage | United Kingdom (London) |
| Vercel | Hosts and runs the website | United Kingdom (London), with a worldwide delivery network |
| Resend | Sends email | European Union (Ireland), with some processing in the United States |
| Cloudflare | Domain name services and the bot check on forms | Worldwide |
| Our payment provider | Takes payments, once paid plans are available | European Union and United States |
| Google and Microsoft | Confirm who you are, only if you choose to sign in with them | Worldwide |
This page is where we publish the current list. We give customers at least 14 days' notice before adding or replacing a company. In an urgent security or service emergency we may change a supplier straight away and tell customers promptly afterwards.
We may also share information:
- with professional advisers such as lawyers, accountants and insurers, where needed;
- with a buyer or successor if the business or its assets are sold or merged. The new owner must keep to this policy;
- with authorities, as described in section 6;
- with anyone else, if you ask us to.
6. Sharing information with authorities
We may disclose personal information to a court, the police, a regulator or another public authority in these cases:
- Where the law requires it. This includes a court order, warrant or other legally binding demand.
- To protect people. Where we reasonably believe disclosure is needed to prevent death or serious harm.
- To deal with serious wrongdoing. Where it is needed to prevent, detect or investigate fraud, a security incident or other serious unlawful use of the service.
- To protect legal rights. Where it is needed to establish, exercise or defend legal claims.
When we receive a demand, we check that it appears valid and disclose only what it requires. We tell the affected customer first, unless the law or the demand forbids it or telling them would risk harm or prejudice an investigation.
Where a demand concerns a candidate's information, we refer the authority to the employer where we lawfully can, because the employer is the controller of that information.
Where the law requires us to preserve information, we may keep a copy until that requirement ends, even if it would otherwise have been deleted.
7. Sending information to other countries
Some of the companies in section 5 process information outside the Isle of Man, the United Kingdom and the European Economic Area.
When that happens, we make sure the information is protected by one of the safeguards the law recognises. These are a decision that the destination country gives adequate protection, or approved contract terms that bind the recipient to equivalent standards.
You can ask us at privacy@easyonboard.uk for details of the safeguard used for a particular company.
8. How long we keep information
| Information | Kept for |
|---|---|
| Account details | While the account is open, then 30 days |
| Customer content, including candidate information | Until the customer deletes it, the customer's retention period runs out, or 30 days after the account closes |
| Closed accounts | 30 days after closing, so the account can be reopened if needed, then deleted. Sooner if the customer asks us to erase it |
| Backups | Overwritten within 35 days of deletion from the live service |
| Billing records | 6 years, to meet tax and accounting rules |
| Security and access logs | 12 months |
| Records of what our staff did on an account (no customer content) | 2 years, to show who accessed or changed what. A record that an account was erased is kept without personal details |
| Support messages | 2 years after the request is closed |
When a period ends we delete the information or make it anonymous.
9. How we protect information
- Information is encrypted when it travels between you and us, and when it is stored.
- Each customer's data is separated in the database itself, so one customer cannot read another's.
- Uploaded files are private and can only be opened through links that expire quickly.
- Our staff use a separate admin site that needs two-step verification. It shows account details but never candidate information, and logs every account staff open and every change they make. Support staff can only ask for sensitive changes, such as complimentary plans and erasure; an administrator must approve them, and nobody approves their own request. We review who has staff access at least every 3 months.
- We keep a record of who viewed, sent or deleted information.
No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the regulator as the law requires. Where the breach affects candidate information, we tell the employer without undue delay so they can tell the people affected.
10. Your rights
If we are the controller of your information (section 1), you have the right to:
- ask for a copy of it;
- ask us to correct anything inaccurate;
- ask us to delete it;
- ask us to restrict how we use it;
- object to uses we base on legitimate interests;
- receive it in a format you can take to another service;
- withdraw consent where we rely on it.
Email privacy@easyonboard.uk to use any of these. We reply within one month. There is normally no charge.
Some rights have limits. For example, we may need to keep billing records even if you ask us to delete them.
A business account's owner can ask us to erase the whole account and everything in it straight away. We check the request comes from someone with authority over the account, and a second member of our staff approves it before anything is deleted. This cannot be undone.
If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the regulator, the Isle of Man Information Commissioner (inforights.im). If you are in the United Kingdom you can complain to the Information Commissioner's Office (ico.org.uk).
11. Cookies
We use only the cookies needed to make the service work:
- a cookie that keeps you signed in;
- a cookie that protects forms from misuse;
- a cookie that remembers whether you chose light or dark mode;
- the bot check on the public application form, which may set its own cookie.
We do not use advertising or tracking cookies. If we ever add analytics, we will update this section and ask for your consent first.
12. Children
The service is for businesses. The person who registers a business account must be at least 18. A business may invite team members aged 16 or over, and is responsible for authorising and supervising them. Nobody under 16 may use the service as a team member. Employers may use it to hire people under 18 where the law allows, and are responsible for doing so lawfully.
13. Changes to this policy
We will post any change here and update the effective date. If a change is significant, we will email customers at least 30 days before it applies.
14. Contact
Privacy questions and requests: privacy@easyonboard.uk
Post: [YOUR LEGAL NAME], [YOUR ADDRESS], Isle of Man