Privacy Policy

1.Who we are

Onboardly ("we", "us", "our") operates the Onboardly compliance automation platform. For the personal data of candidates and referees processed through the platform, our customers (the recruitment agencies and employers who use Onboardly) are the data controllers and Onboardly acts as their data processor. For account and billing data relating to our customers themselves, Onboardly is the controller.

Onboardly is operated by Onboardly Ltd, a company registered in England and Wales, company number 17024772.

Our registered office address is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

If you have any questions about this policy or how your data is handled, contact us using the details at the end of this page.

2.Information we collect

Depending on how Onboardly is used, we may process the following categories of personal data:

• Account data — recruiter name, work email, phone number (if you add one), job title, the organisation you work for and its declared size, and authentication details.
• Candidate data — name, contact details (including WhatsApp number), and the compliance documents you collect, such as passports, Right to Work evidence, DBS certificates, professional registrations, and training certificates.
• Application form answers — a candidate's date of birth, address, nationality, Right to Work status and visa details, their Right to Work share code and its expiry date if they give one, whether there are limits on the hours or type of work they can do and what those limits are, whether they have a DBS certificate, whether it is on the DBS Update Service and, if it is, its certificate number, and the full name they type to sign the form, with the date they signed it.
• Profile quiz answers — if a recruitment agency invites you to a profile quiz, your first name, mobile number and email address, your LinkedIn address if you give one, your answers about your experience, qualifications, where you want to work and the pay you are aiming for, and whether you ticked the box to be contacted about roles. The recruitment agency may also ask some additional questions of its own, and we keep your answers to those too.
• Outreach contact details — if a recruitment agency asks us to message you on WhatsApp about work, we hold your name, mobile number and, if the agency gave one, your email address, a note of how and when you agreed to be contacted, and the WhatsApp messages between you and the agency. We do this on the agency's instruction. Reply STOP at any time and the messages end.
• Check-in data — answers to a recruiter's check-in questions asked of a candidate or placed worker after a job starts, and the reading made from each answer.
• Qualification checks — when a recruitment system connected to Onboardly tells us a candidate holds a qualification or a professional registration, we ask the candidate for evidence of it. A member of the recruiting team checks that evidence, including against official professional registers such as the NMC, HCPC, GMC or the teacher record. We keep the outcome, the dates and the expiry, and the connected recruitment system can read the outcome.
• Reference data — referee names, job titles, email addresses, phone numbers, organisations, how they know the candidate and when the candidate worked with them, and the content of their responses.
• Communications — WhatsApp messages, emails, and uploads exchanged through the platform.
• Website enquiry data — if you use the contact form on our website, your name, email address, company (optional) and message, which we email to our support mailbox. If you join the waitlist, your email address and, if you give them, your name and company, and the page you signed up from, which we store on our waitlist.
• Support requests — the topic and message you send from the Help page are stored against your account so our support team can track them, emailed to our support mailbox, and deleted with your account.
• Email images — if a recruiter uploads an image for use in an email template, such as a logo or a staff photo, we store a re-encoded copy of it (the original file is not kept and its hidden photo details, such as location, are removed) together with a record of which account uploaded it. The image's web address is public by design, so that a recipient's email app can load it without signing in: anyone who has the exact address can open the image. It is deleted when the account is deleted.
• Usage data — log data, and device and browser information.

3.Where we get your information

Most of what we hold about you comes from you directly. Some of it comes from someone else:

• A candidate's name and WhatsApp number come from the recruiter or employer placing them.
• A referee's name and contact details come from the candidate who names them, on WhatsApp or on the application form, or from the recruiter. We use them to email the referee to ask for a reference.
• A placed worker's name and contact details may come from the recruitment agency's own roster, when the agency adds them for check-ins rather than the worker signing up themselves.

4.How we use your information

We use personal data to provide and operate the compliance workflow, specifically to:

• Collect, request, and track compliance documents from candidates via WhatsApp.
• If an employer or recruiter asks us to, contact a candidate on WhatsApp after they submit an application form, once they have agreed to it on the form.
• Validate documents using AI and OCR and flag items for manual review.
• Request, validate, and chase employment references.
• Check in with candidates and placed workers after a job starts, on a schedule the recruiter controls, and flag answers that suggest a problem to a person at the agency.
• Generate compliance packs and maintain an audit trail of actions taken.
• Email a recruiter a summary of new activity on their candidates, such as documents received or flagged, for the kinds of activity they have switched on in their notification settings. The summary uses candidates' names.
• Reply to a message sent through the contact form on our website, and keep a list of people who asked to be told when Onboardly is available to them.
• Provide support, secure the service, and improve our product.
• Let Onboardly support staff search for a candidate by phone number or id, and look at that candidate's messages and activity history, when we need to investigate a problem a customer has reported. Each time we open a candidate's history, we add a line to that customer's activity log.

5.Legal bases for processing

Where UK/EU data protection law applies, we and our customers rely on one or more of the following legal bases: performance of a contract; legitimate interests (operating and improving the service and meeting compliance obligations); consent (for example, a candidate consenting before any documents are collected, and separate explicit consent for DBS checks); and compliance with a legal obligation. Special category and criminal-records data (such as DBS information) is processed under the additional conditions required by law.

6.WhatsApp and third-party processors

Onboardly relies on trusted sub-processors to deliver the service. Each is bound by data protection obligations and processes data only on documented instructions:

• Twilio — WhatsApp messaging delivery.
• Supabase — application database and authentication.
• Amazon Web Services (S3) — encrypted document storage, hosted in the UK (eu-west-2).
• OpenAI — AI and OCR document validation, and reading check-in replies.
• Resend — transactional and reference emails.
• Vercel — application hosting.
• Sentry (Functional Software, Inc.) — error diagnostics, hosted in the EU region (we send nothing to it unless it is set up on an EU ingest host). We send technical error data (the error, where in the code it happened, the browser or server type). Before it leaves our systems we remove request contents, cookies, headers, IP addresses and user details, and mask email addresses, phone numbers and identifiers in error text.
• Stripe — subscription billing and payment processing for recruiter accounts. Candidate compliance documents and messages are not shared with Stripe.

7.Sharing and disclosure

We do not sell personal data. We share it with the sub-processors listed above, with the customer who controls the relevant candidate or referee data, and where required to comply with the law, enforce our terms, or protect the rights and safety of users. Where a customer connects their own integrations (for example via Zapier), personal data is also shared with those tools at the customer's direction and subject to those providers' own terms.

8.International transfers

Some of our sub-processors may process data outside the UK. Where this happens, we rely on appropriate safeguards, such as adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

9.Data retention

DBS certificate documents carry extra sensitivity and a shorter retention period: they are deleted 7 days after they are stored.

Other compliance documents and candidate data are kept while the recruiter's account collecting them stays active. If a recruiter asks to delete their account, it is scheduled for deletion after a 30-day grace period, during which the request can be cancelled. Customers can also request deletion of candidate data they control at any time, subject to any overriding legal retention requirement.

If a candidate sends a photo or PDF while we are collecting documents and it does not match a document we asked for, we may keep it so the recruiter can review it through their systems. If we cannot tell what the file is, it is deleted 7 days after it is stored, like a DBS certificate; other files follow our usual retention rules.

Check-in answers and the reading made from each one are kept while the recruiter's account collecting them stays active, and are deleted along with the rest of that person's data if the recruiter's account is deleted or they ask us to erase it. If that recruiter works for a company, the answers stay with the company when the recruiter leaves or deletes their own account.

Profile quiz answers are kept for up to 24 months after you last updated them, and can be deleted straight away: ask the recruitment agency that invited you to take the quiz.

Outreach contact details and their messages are deleted 6 months after they were last updated. If you go on to become a candidate with the agency, they are deleted 30 days after that, because your details are then held on your candidate record. You can ask the agency to delete them sooner. A record that you opted out is kept, so that we do not message you again.

To help us work out what went wrong when a chat does not behave as expected, the assistant keeps a short record of what it decided for each message it handles, including the reply it sent and why, and of the result of actions a recruiter takes on the chat, such as a reminder that could not be sent. It does not keep the text of the candidate's messages. These records are deleted 30 days after they are made.

10.Automated checks

Documents you or your recruiter upload are read by AI and OCR document-validation software. A confident, clear read may be automatically accepted or rejected — for example, a document the software is confident is a different type from the one requested can be rejected. A read the software is not confident about is not rejected automatically: on WhatsApp we ask you for a clearer copy, and after a few attempts a person at the recruitment agency looks at it; a document uploaded through an application form goes to a person at the agency for review. You can ask your recruiter to have a person review any automated outcome. If a document is rejected on WhatsApp, you can reply HUMAN to have a person check it. The software also checks the name on a document against the first and last name you gave us: if both appear, the document can be accepted; if neither appears, it can be rejected on WhatsApp and you can reply HUMAN; if only one of them appears, or the software cannot read or compare the name, a person checks it instead. A first-name initial counts, for example “M Tadili”, and so does a first name of three or more letters that is the start of the first given name on the document, for example “Chris” for “Christopher” (but not “Christopher” for “Chris”, and not a middle name). When a match rests only on that, and both the document and your record show a date of birth, the two dates must be the same, or a person checks it instead. Your recruiter can instead choose to pause the chat when the name on a document you send on WhatsApp does not match, for a document we are still waiting for. This does not apply to a replacement for a document we already have, to a document uploaded through an application form, or to a name the software could not read; those are handled as described above. While the chat is paused, a person at the agency checks the document. The chat carries on only after they have accepted it, asked you for one in your own name, or handed the chat back to us, in which case we ask you for that document again. For some documents (ones a recruiter adds themselves, and some Right to Work documents), we may instead ask you to confirm the name we read.

If you are asked a check-in question after a job starts, your reply is read by AI into a reading of tone and how confident the AI is in that reading. For a retention check-in, a person at the recruitment agency who reviews an unconfident reading sees a summary of your reply, not your exact words; for the scheduled candidate survey questions, they see your actual answer. It is never turned into a verdict automatically. Every reply is checked for a safeguarding concern, such as a mention of a personal crisis, before any reading is made; a reply like that is never scored and goes straight to a person at the agency, without waiting for the next scheduled check-in. The reading does not decide anything about your job by itself — a person at the agency does. If you do not reply to several check-ins in a row, they pause automatically and your recruiter is told; that happens because you have gone quiet, not because of anything an answer said.

Each message you send to the assistant on WhatsApp is checked by fixed rules that look for particular words and phrases. They look for abuse aimed at the assistant or at staff at the recruitment agency, for threats, and for slurs. No AI is used for this check. The assistant still reads and answers your message. If the message is abusive or a threat, the assistant may add a short request to keep messages respectful. The recruiter sees a note in their dashboard. It names you and reads, for example, “sent hostile messages in chat” or “uses slurs casually in chat”. The note records the kind of message, not what you wrote. It is kept with the rest of your candidate record, as described under Data retention, and you can ask your recruiter about it. A slur that is not aimed at anyone gets no reply from the assistant, does not count towards a hand-over, and adds one note for the chat. Swearing that is not aimed at anyone does not lead to a note, a warning or a hand-over. If you send three abusive messages in one chat, the chat is handed to a person at the agency. This check does not decide anything about your application. A person at the agency decides what, if anything, to do. It does not run once you have finished, opted out, or withdrawn or declined consent, or while a person at the agency has the chat. While we are asking for your consent, an abusive message with no yes or no in it goes to a person at the agency instead of being treated as a refusal.

11.Security

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls, and audit logging. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

When a recruiter signs in from a browser we have not confirmed before, we email a one-time security code to that account's own email address and ask for it before letting the sign-in continue. We keep a record that the browser was confirmed, and when. We do this on the basis of our legitimate interest in keeping accounts secure.

Once you have entered the code, a small cookie tells us that browser has been confirmed. It lasts 30 days if you tick “Remember me” when you sign in, and otherwise until you close your browser. A private window or cleared cookies means we ask for a code again.

We delete the record of a sent one-time security code within 24 hours, whether or not it was used.

12.Your rights

Subject to applicable law, individuals have rights over their personal data, including the right to:

• Access the personal data we hold about you. If you ask your recruiter for a copy, they download it from Onboardly as one file (your details, your messages, the documents you sent, and a copy other systems can read) and send it to you. It does not include your referees' contact details or what they wrote about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Object to or restrict certain processing.
• Request portability of data you provided.
• Withdraw consent at any time where processing is based on consent.
• Reply "stop" to any check-in message, or tell your recruiter, to stop receiving further check-ins.
• If you are a referee, you can reply to the reference email to ask about your own details, for example for a copy or to have them deleted. Your recruiter gets the request to deal with, and your reply is not used as a reference unless they find it was one. If you reply from the address the email was sent to, asking for your details to be deleted or no longer used also stops reference reminders.
• Complain to the Information Commissioner's Office (ICO) — https://ico.org.uk/make-a-complaint/.

13.Cookies

Onboardly uses cookies and local/session storage that are strictly necessary to operate the dashboard (such as keeping you signed in) and to remember a small number of preferences (such as your chosen appearance). We do not use cookies for analytics or advertising. See our Cookies page (/cookies) for the full list.

14.Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you.

15.Contact us

If you have questions about this policy or wish to exercise your rights, please contact us at admin@rca-onboardly.com. Candidates and referees should contact the recruitment agency or employer who is collecting their information in the first instance.