Privacy notice

PassRidge runs a QA-only talent, outsourcing and flexible-work service. Two companies do this work. Each is the controller (UK/EU GDPR) or the business (CCPA/CPRA) for the personal data it collects from the people in its region.

We decide which company is responsible for you from the country we see on your device or the country you choose in the region picker. The two companies share personal data under an intra-group data transfer agreement and apply the same rules. If you are unsure which company holds your data, ask us. Either company will answer for both.

EU and UK representatives

PassRidge Ltd is established in the United Kingdom. For people in the EU/EEA, our representative under Article 27 GDPR is PassRidge EU Representative Services B.V., Herengracht 450, 1017 CA Amsterdam. Write to [email protected] with the subject line "EU representative" and we pass your message on the same working day. For UK matters PassRidge LLC relies on PassRidge Ltd as its UK contact.

Data protection lead

We have not appointed a statutory Data Protection Officer because the conditions in Article 37 GDPR do not apply to us. Our data protection lead reviews every privacy request, assessment and incident. Reach them at [email protected].

We collect only what we need to match QA professionals with work and to run the service. The table groups the data by where it comes from.

We do not ask for special-category data (health, ethnicity, religion, sexual orientation, trade-union membership, biometrics). Equal-opportunity self-identification, where offered, is optional and kept apart from your profile (see our equal opportunity statement). If you tell us about a disability so that we can adjust an interview, we use that only for the adjustment.

UK and EU law requires a lawful basis for each use. This table lists them. Where the basis is consent you can withdraw it at any time without affecting what we did before.

Where we rely on legitimate interests we have weighed them against your rights. Ask us for the assessment at [email protected]. You can object at any time (see your rights).

• Clients, only with your consent for each introduction. Before that, clients see anonymous role matches, never your name or contact details.
• Service providers who process data for us under contract (the next section lists them).
• Group companies: PassRidge Ltd and PassRidge LLC, to serve you from the right entity.
• Authorities and advisers where the law requires it, or to protect rights, safety and property. We tell you first unless the law forbids it.
• A buyer, if we merge or sell the business. The notice you are reading would bind them or we would ask you again.

These are the categories of providers we use and the names of typical processors in each. We list them so that clients and candidates can see where data goes. We add a notice to this page before we change a provider that handles your CV or payment details. Optional services run only after consent.

A current list with contract dates is available on request: [email protected]. Clients can ask for our data processing addendum at the same address.

We work across borders, so your data may be processed outside your country. When it leaves the UK or the EEA we use one of these safeguards:

• an adequacy decision or data bridge (for example the UK-US data bridge and the EU-US Data Privacy Framework for certified recipients);
• the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, plus a transfer risk assessment;
• your explicit consent, for a single transfer you ask for, such as sending your CV to a client in another country.

Flex contractors work from many countries, so their task data may be viewed by PassRidge staff and the client wherever they are based. Ask us for a copy of the safeguards at [email protected].

If a legal claim or investigation is open we keep the relevant records until it ends.

If you are in the UK or the EEA you have the right to:

• be informed about how we use your data (this notice);
• access a copy of your data and information about how we use it;
• rectify data that is wrong or incomplete;
• erase your data where we no longer need it or you withdraw consent;
• restrict our use while you contest accuracy or object;
• port data you gave us in a common machine-readable format (JSON or CSV);
• object to use based on legitimate interests and to direct marketing, which we stop at once;
• withdraw consent at any time, as easily as you gave it;
• not be subject to a decision based solely on automated processing with legal or similarly significant effect. We do not take such decisions (see our AI statement).

You can complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU you can contact the authority in the country where you live or work. We would like the chance to fix the problem first, but you do not have to wait.

This section applies to California residents and is provided by PassRidge LLC and, for California residents it serves, PassRidge Ltd. Other US states with privacy laws (such as Colorado, Connecticut, Virginia and Texas) give similar rights. We extend them to all US residents.

Categories we collected in the last 12 months

Sale, sharing and sensitive data

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We do not knowingly sell or share the data of anyone under 16. We use sensitive personal information only to provide the service you asked for, so there is nothing to limit. We honour Global Privacy Control signals. Details and a switch are on Do not sell or share.

Your California rights

• know the categories and specific pieces of personal information we hold, and the sources, purposes and recipients;
• delete personal information, with the exceptions the law allows (for example tax records);
• correct inaccurate personal information;
• opt out of sale and sharing, and limit use of sensitive personal information;
• receive your data in a portable format;
• not be treated worse for using these rights. We will not deny service, change prices or lower quality.

You can use an authorised agent. We will ask for written permission signed by you, or a power of attorney, and may verify your identity directly. We respond within 45 days (extendable once by 45 days) and confirm receipt within 10 business days. California's "Shine the Light" law lets you ask which third parties received data for their own direct marketing. The answer is none. Our notice at collection lists what we collect at each point.

Canada: we follow PIPEDA and provincial law. You can ask for access, correction and withdrawal of consent, and complain to the Office of the Privacy Commissioner of Canada. Brazil (LGPD) and India (DPDP Act): we apply the same access, correction, deletion and objection rights described above. Use the same request channels. Switzerland: we treat the Swiss FADP like the UK/EU GDPR.

1. Use the privacy request form, or email [email protected]. You can also write to either registered address above.
2. We check it is you. We match your request to the email address on your account and send a confirmation link. If that is not enough we ask for two or three details we already hold. We do not ask for a government ID unless there is no other way, and we delete any copy once checked.
3. We reply within one month in the UK and EU (up to three if the request is complex, and we tell you why). In the US we reply within 45 days. Requests are free. If a request is clearly unfounded or excessive we may charge a reasonable fee or refuse, and we will explain.
4. If we say no, we tell you the reason and how to appeal. In the US, if we refuse you may appeal by replying to our decision. We answer appeals within 45 days.

To stop marketing email use the unsubscribe link in any message, or opt out in the form.

We encrypt data in transit (TLS 1.2 or higher) and at rest. Access to CVs is limited to staff who need it and logged. We use multi-factor authentication for staff, separate production data from test data, and test our backups. We review providers before use. If a breach puts your rights at risk we tell you and the regulator within the legal time limits (72 hours to the regulator in the UK and EU).

No system is perfectly secure. Use a unique password and report anything suspicious to [email protected].

PassRidge is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, write to [email protected] and we will delete it.

We use rule-based matching and scoring to suggest roles to candidates and candidates to recruiters. A recruiter reviews every shortlist, and nobody is rejected by software alone. Read the full statement, including NYC Local Law 144 and EU AI Act notes, on Equal opportunity and AI.

We use essential browser storage to run the site, and with your consent GA4, Clarity and Tawk.to. Nothing optional loads before you choose. The cookie policy lists every item and has a button to change your choice.

We update this notice when our practices change. The date and version are at the top. For material changes we add a notice to the site and email people with an account at least 14 days before the change takes effect. Earlier versions are available on request.