Privacy Policy

HyreDocs Ltd ("HyreDocs", "we", "our") is a UK-based software platform that helps recruitment agencies collect, sign and store onboarding paperwork. This Privacy Policy explains what personal data we process, why, and what rights you have under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1. Who is the "controller" of your data?

HyreDocs operates a multi-tenant SaaS. Most of the time we act as a data processor on behalf of the recruitment agency that invited you to upload or sign a document. That agency is the controller and decides what data to collect, why, and for how long.

We act as a controller only for:

• Account holders at recruitment agencies (their work email, name and login activity);
• Visitors to the HyreDocs marketing website (cookie and form-submission data);
• Anyone who contacts our sales or support teams.

2. What personal data we process

The categories of personal data we typically process are:

• Account data — name, work email, password hash, role.
• Candidate identification data — name, email, phone, address, date of birth, National Insurance number (only where the agency's template requires it).
• Candidate document content — anything the candidate types into forms or PDF templates (right-to-work, DBS, IR35, P45, references, signed contracts).
• Uploaded files — copies of identity documents, credentials, certifications.
• Signature evidence — IP address, user agent, timestamp and SHA-256 hash of the signed document, captured on every signature event.
• Bullhorn integration data — internal Bullhorn record IDs and a securely-encrypted OAuth refresh token where the agency has connected Bullhorn.
• Technical data — IP address, browser type, pages visited, error logs.

We do not knowingly process special-category data (e.g. health, biometric, criminal-record data) unless the agency's template specifically asks the candidate to upload it (for example, a DBS certificate). Where that happens we treat the data with elevated controls.

3. Why we process your data (lawful basis)

4. Who we share data with

We share personal data only with the sub-processors strictly necessary to run the service. The complete and current list is published at /legal/subprocessors. We sign written contracts with each sub-processor requiring them to meet the same data-protection standards we owe you.

We do not sell personal data. We do not share it for cross-context behavioural advertising.

5. International transfers

Some of our sub-processors are based outside the UK / EEA (for example, MongoDB Atlas, Amazon Web Services). Where personal data is transferred outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, plus, where appropriate, supplementary measures such as encryption-in-transit and encryption-at-rest.

6. How long we keep your data

We keep personal data only as long as necessary to provide the service or as required by law. Retention periods are set by the recruitment agency that controls the record. As of the date of this policy, our default retention schedule is:

• Draft documents — automatically deleted after 60 days of inactivity.
• Abandoned form submissions — automatically deleted after 90 days.
• Signed documents and their audit certificates — kept for the agency's nominated retention period, typically 6 years to align with UK employment-record statutes.
• System audit logs — kept for 7 years.
• Account data — kept while the agency subscription is active, deleted within 90 days of cancellation.

7. Your rights

You have the following rights under UK GDPR. To exercise any of them, contact privacy@hyredocs.com — we respond within one calendar month.

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (subject to the agency's legal-hold obligations).
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, where the lawful basis is consent.
• Complain — to the UK Information Commissioner's Office at ico.org.uk.

If you are a candidate and the recruitment agency is the controller of your data, please contact the agency in the first instance. We will forward your request to the right agency within 5 working days.

8. Security

We protect personal data with measures including:

• TLS 1.2+ encryption in transit on every connection;
• Encryption at rest on the managed database tier;
• Application-level encryption for the most sensitive credentials (e.g. Bullhorn OAuth tokens) using AES-128 in GCM mode via Fernet;
• Password hashing with bcrypt and per-password salts;
• HTTP-only, secure cookies for session tokens;
• Strict tenant isolation — every record carries a tenant_id enforced at the API layer;
• Comprehensive audit logging of administrative actions;
• Regular dependency scanning and least-privilege access controls.

9. Cookies

We use a small number of strictly necessary cookies and, with your consent, optional analytics cookies. Full details are in our Cookie Policy.

10. Changes to this policy

We'll post material changes here and notify account holders by email. Continued use of HyreDocs after a change means you accept the updated policy.

11. Contact us

Data Protection contact: privacy@hyredocs.com
Postal address: HyreDocs Ltd, United Kingdom (full registered address provided on request)
UK ICO registration: in progress