Privacy Policy

1. Introduction

1.1 About This Privacy Policy

NORESUME LTD ("we," "us," "our," or "Noresume") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our employment infrastructure platform, which connects talent and businesses through blind matching, combining gig work and permanent recruitment.

1.2 Who This Policy Applies To

This Privacy Policy applies to:

• Talent: Self-employed individuals, sole traders, partnerships, and limited companies offering professional services or seeking gig work on our platform
• Companies: Businesses and organisations sourcing talent or making permanent hires through our platform
• Visitors: Anyone browsing our website or platform

1.3 Legal Basis

We process your personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)

Our legal bases for processing:

• Contract: To provide our Services to you
• Legal Obligation: To comply with tax, VAT, HMRC, and other legal requirements
• Legitimate Interests: To operate, improve, and secure our platform
• Consent: Where we have specifically asked for your permission

2. Information We Collect

2.1 Information You Provide Directly

For All Users:

• Name and contact information (email, phone number)
• Account credentials (username, password)
• Profile information and biography
• Communication preferences

For Talent:

• Professional background and experience
• Skills and qualifications
• Work availability and schedules
• Pay rates
• Bank account details (for Stripe payouts)
• Business name and trading name
• Business address
• VAT registration number (if VAT-registered)
• Company registration number (if limited company)

For Companies:

• Company name and details
• Business address and work locations
• Staffing requirements and job descriptions
• Billing information
• Payment method details

2.2 Information We Collect Automatically

Usage Data:

• IP address and device information
• Browser type and version
• Pages visited and time spent
• Referring website
• Click patterns and interactions

Search Session Data:

We log search activity performed within the app, including search terms, filters applied, results viewed, and time of search. This data is linked to your user account and used to improve the platform's matching and search functionality, and to develop our market intelligence features.

Technical Data:

• Cookies and similar technologies (see Section 8)
• Log files and error reports
• Performance and analytics data via Firebase Analytics

2.3 Device Permissions

Our mobile application may request access to the following device features:

• Camera: Used for video interviews, uploading profile photos, and scanning documents. Video and images captured are processed and stored securely on our platform and by our video provider (Daily.co).
• Microphone: Used for audio during video interviews. Audio may be recorded and stored as part of the interview process.
• Photo Library: Used to upload profile photos and documents from your device.
• Notifications: Used to send you alerts about messages, interview invitations, job offers, payment confirmations, and platform updates.

Video Interview Recording: Video interviews conducted through the NoResume platform may be recorded. By using video interviews, you agree to recording, and that NoResume and third parties can store, access, and analyse recordings. If you do not consent to recording, you must exit the interview.

You can manage these permissions through your device settings at any time. Disabling certain permissions may affect the functionality of the app.

2.4 Referral Programme Data

When you participate in the NoResume referral programme, we collect:

• Your referral code or link identifier — a randomly generated username (such as “pigfish888”) which you may customise to any name of your choosing
• Records of who referred whom, including both the referrer's and the referred user's account identifiers, in order to operate the reward system
• Referral earnings and reward milestones associated with your account
• Badges and achievement data earned through referral activity

Your public referral page displays only your chosen referral code or username alongside any badges you have earned. Your real name, contact details, and financial information are never displayed publicly through the referral system.

2.5 Information from Third Parties

VAT Verification:

• We verify VAT registration details with HMRC's VAT registration database
• Information returned: VAT number validity, registered business name, registered address

Payment Processing:

• Payment confirmation from Stripe
• Bank account verification data
• Transaction records

Authentication:

• Basic profile information from Firebase Authentication

3. How We Use Your Information

3.1 To Provide Our Services

We use your information to:

• Create and manage your account
• Match talent with suitable opportunities through our blind matching system
• Enable companies to source and engage talent
• Facilitate messaging and communication between users
• Process payments, manage escrow, and release funds
• Provide customer support
• Send service-related notifications
• Operate the referral and rewards programme

3.2 For Business Verification and Compliance

VAT Registration Verification:

• Verify VAT registration status with HMRC
• Confirm business name matches VAT registration
• Validate registered business address
• Perform periodic re-verification to maintain accurate records
• Generate compliant self-billing invoices and payment records

Why We Verify VAT Registration:

• Ensure tax compliance
• Prevent fraud and misrepresentation
• Meet our legal obligations as a payment facilitator
• Provide accurate invoicing for both parties

IR35 and Employment Status:

NoResume provides the infrastructure for talent and companies to engage. We collect information relevant to employment status and working arrangements but do not make IR35 determinations on behalf of either party. It is the responsibility of the relevant parties to assess their own employment status in accordance with HMRC guidance.

Other Compliance Uses:

• Comply with tax reporting obligations
• Respond to legal requests and court orders
• Prevent fraud, money laundering, and illegal activity
• Enforce our Terms and Conditions

3.3 To Improve Our Platform

We use aggregated and anonymized data to:

• Improve our matching algorithms
• Analyze platform performance
• Understand user behaviour and preferences
• Develop new features and services
• Conduct market research and provide market intelligence

3.4 For Marketing (With Your Consent)

With your explicit consent, we may:

• Send promotional emails about our Services
• Provide updates about new features
• Share relevant content and resources

You can opt-out at any time by clicking “unsubscribe” in any marketing email, adjusting preferences in your account settings, or contacting us at [email protected].

4. How We Share Your Information

4.1 With Other Platform Users

Blind Matching: NoResume operates a blind matching model. Companies approach talent rather than talent applying directly. Your profile information is surfaced to companies through our matching system without your full identity being disclosed until both parties have engaged.

Talent: Your skills, experience, availability, and rates are visible to companies through the matching process.

Companies: Your company name, location, and job requirements are visible to talent when an engagement is initiated.

Control Your Visibility: You can adjust privacy settings to control what information is displayed on your profile.

4.2 With Service Providers and Partners

We share your information with trusted third parties who help us operate our platform:

Payment Processing:

• Stripe: Processes payments, manages escrow, and handles bank account information via Stripe Connect

Infrastructure and Hosting:

• AWS (Amazon Web Services): Cloud hosting in West Europe (London)
• Supabase: Database and backend services in West Europe (London)

Authentication:

• Firebase Authentication: Manages account security and device identifiers

Video Interviews:

• Daily.co: Provides video calling infrastructure. Interview recordings may be stored and processed by Daily.co on our behalf.

Email Communications:

• Resend: Delivers transactional and notification emails on our behalf

VAT Verification:

• HMRC VAT API: Verifies VAT registration status

4.3 For Legal Reasons

We may disclose your information when required to comply with legal obligations, court orders, or government requests; enforce our Terms and Conditions; protect our rights, property, or safety; investigate fraud or security incidents; or respond to tax or VAT enquiries from HMRC.

4.4 Business Transfers

If Noresume is acquired, merged, or sells assets, your information may be transferred to the new owner. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information with other parties when you give us explicit permission to do so.

5. Data Retention

5.1 How Long We Keep Your Data

Active Accounts: We retain your information for as long as your account is active. You can delete your account at any time from within the app.

Closed Accounts: After account closure, we retain certain information for legal and compliance purposes:

• Financial records: 6 years (UK tax law requirement)
• VAT records: 6 years (HMRC requirement)
• Transaction records: 6 years (accounting regulations)
• Communications: Up to 2 years for dispute resolution

Aggregated Data: Anonymized and aggregated data may be retained indefinitely for analytics and platform improvement.

5.2 Deletion Requests

You can initiate deletion of your account and personal data from within the app via Settings → Account → Delete Account. If you no longer have access to your account, you can submit a request via our account deletion page. You may also contact us at [email protected]. Some data must be retained for legal compliance. Deletion may not be immediate due to backup systems. We will confirm deletion within 30 days where legally permissible.

6. Your Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request a copy of your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time
• Right to Complain: Lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or call 0303 123 1113

To Exercise Your Rights: Contact us at [email protected]. We will respond within 30 days.

7. Data Security

7.1 How We Protect Your Data

Technical Measures:

• Encryption of data in transit (TLS/SSL)
• Encryption of sensitive data at rest
• Secure password hashing
• Regular security testing and updates
• Access controls and authentication
• Firewall protection

Organizational Measures:

• Limited access to personal data (need-to-know basis)
• Staff training on data protection
• Regular security audits
• Incident response procedures

Data Storage Location: Primary servers in West Europe (London), United Kingdom. Backup servers within EU/UK regions. No data transfers outside UK/EU without appropriate safeguards.

7.2 Your Responsibility

You are responsible for keeping your password secure and confidential, not sharing your account credentials, and notifying us immediately of any unauthorized access. We will never ask for your password via email or phone.

8. Cookies and Tracking

8.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. Similar technologies, such as browser local storage, work in the same way and are covered by this section. We use them to keep you signed in, keep the site secure, remember your preferences, and understand how the site is used.

8.2 Cookies We Set Without Asking

These are strictly necessary for the site to work, so we do not need your consent for them.

• Authentication and security: keep you signed in and protect your account and our infrastructure. Set by us, by Firebase (Google) and by Cloudflare.
• Your cookie choice: we store your answer to the consent banner in your browser's local storage under nr_analytics_consent, so we do not ask you again on every page.

8.3 Cookies We Set Only If You Agree

None of the following run until you select Accept on our cookie banner. If you select Decline, they are never loaded and no analytics or marketing cookies are placed on your device.

• PostHog (product analytics, hosted in the EU). Records page views, clicks and error reports so we can see which parts of the site work and which do not. Stored in your browser's local storage rather than as cookies, and retained for up to 12 months.
• HubSpot (analytics and customer relationship management, hosted in the EU). Recognises returning visitors and links website activity to your record if you later contact us or complete a HubSpot form. Sets __hstc and hubspotutk (expire after 6 months), __hssc (expires after 30 minutes of inactivity) and __hssrc (expires when you close your browser).
• Firebase Analytics (Google). Usage analytics within the NoResume mobile apps and signed-in areas. Data is aggregated and, where possible, anonymised.

We do not use cookies to serve advertising, and we do not sell the data these cookies collect.

8.4 Changing Your Mind

You can withdraw your consent at any time, and it is as easy as giving it. Reopen your cookie choices and select Decline. Any analytics already running in that page will stop and clear its cookies, and nothing will load on your next visit.

8.5 Managing Cookies In Your Browser

You can also control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Blocking essential cookies may stop parts of the platform working.

9. International Data Transfers

9.1 Data Storage

Our primary servers are located in West Europe (London), United Kingdom. Your data is stored within the UK/EU region.

9.2 Third-Party Services

Some third-party services we use may process data outside the UK/EU:

• Stripe: May process payment data in multiple regions with appropriate safeguards
• AWS: Data stored in EU region but AWS is a US company
• Firebase: Google service, data may be processed in the US with appropriate safeguards
• Daily.co: Video interview data may be processed in the US with appropriate safeguards
• Resend: Email delivery service, data may be processed in the US with appropriate safeguards
• HubSpot: Website analytics and customer relationship management. Your data is held in the EU region, but HubSpot is a US company
• PostHog: Website and product analytics. Your data is held in the EU region, but PostHog is a US company

Safeguards in Place: Standard Contractual Clauses (SCCs), EU-US Data Privacy Framework participation (where applicable), and UK GDPR-compliant data processing agreements.

10. Children's Privacy

Our Services are intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that a minor has provided us with personal data, we will delete it immediately. If you believe a minor has provided us with personal information, please contact us at [email protected].

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in laws or regulations, changes to our Services, or changes in our data practices. If we make material changes, we will notify you by email to your registered address, by prominent notice on our platform, and by updating the “Last Updated” date at the top of this policy.

Your continued use of our Services after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

12.1 Privacy Questions

12.2 Data Protection Authority

If you are not satisfied with our response, you can contact: