Privacy Notice & UK GDPR Policy

1. Introduction & Overview

Crewdo Technologies Ltd (“Crewdo”, “we”, “us”, or “our”) operates a cloud-based multi-tenant Software-as-a-Service (SaaS) platform for specialist recruitment agencies, healthcare staffing providers, and temporary workforce businesses. We are committed to safeguarding personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller vs. Data Processor Roles

Under UK data protection legislation, the distinction between our role and that of our subscribing recruitment agencies is clearly defined:

Subscribing Agencies as Data Controllers: The recruitment agency subscribing to Crewdo determines the purposes and lawful bases for processing candidate, worker, client, and contact personal data stored within their tenant instance.
Crewdo as Data Processor: Crewdo processes candidate and customer data strictly on the documented instructions of the subscribing agency under a binding Data Processing Addendum (DPA).

3. Categories of Data Processed

Our platform handles data required for the operation of recruitment and contingent workforce dispatch:

Candidate & Locum Profiles: Name, contact details, physical address, professional registration numbers (e.g. GPhC, PSNI, GMC, NMC), curriculum vitae, employment history.
Right to Work & Identity Documentation: Passport copies, biometric share codes, visa verification details, and proof of address.
Professional Certifications & Indemnity: Insurance schedules, clinical accreditations, training records, and DBS/AccessNI disclosure dates.
Operational Shift & Billing Data: Rotas, scheduled and actual working hours, meal breaks, agreed pay rates, client charge rates, timesheets, and VAT invoices.

4. Technical & Organizational Security Measures (TOMs)

We enforce multi-layered technical security to prevent unauthorized access, alteration, or disclosure:

Tenant Logical Isolation: Data partitioning enforced via relational database scoping, preventing cross-tenant data access.
Encryption: TLS 1.3 encryption in transit for all web traffic; AES-256 encryption at rest for database tables and object storage.
Private Signed URLs: Identity and compliance files are accessible strictly via time-limited, cryptographically signed URLs.
Audit Logging: System activities, booking confirmations, and document verification actions are logged in tamper-evident audit trails.

5. Data Retention & Erasure

Under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, recruitment agencies are required to retain records relating to work-seekers and hirers for at least one year from the date of introduction or assignment. Financial and invoice records are retained for six years in compliance with HMRC statutory requirements.

6. Data Subject Rights & Contact

Candidates and workers have the right to access, rectify, or request erasure of their personal data, as well as the right to lodge a complaint with the UK Information Commissioner's Office (ICO). To exercise your rights, contact your staffing agency or our Data Protection Officer at:

Data Protection Officer: dpo@crewdo.co.uk
Crewdo Technologies Ltd, Belfast, United Kingdom.