Recruiting Privacy Policy

1. Introduction

At TurnKey we prioritise your privacy and are committed to the protection of personal data. “TurnKey” includes Turnkey Labs LLC, its affiliates and TurnKey group of companies. This Recruiting Privacy Policy (the “Policy”) explains how we process candidates personal data in compliance with the global data protection laws, including but not limited to General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazilian General Data Protection Law (LGPD), Federal Law on the Protection of Personal Data Held by Private Parties, Mexico (LFPDPPP) and other applicable data protection laws.

This Policy applies to all candidates applying for a position at Turnkey, and or willing to collaborate with Turnkey in either form. We created this Policy using straightforward and clear language, ensuring our privacy principles are both transparent and easily understood. Our goal is to give you all the necessary information to be well informed about your personal information safety measures. If you have any questions regarding this Policy, please contact us at: legal@turnkeystaffing.com.

2. Data controller

For candidates applying for roles within the European Union, our main establishment and data controller is TURNKEY LABS SRL, located in Romania. The specific local Turnkey entity you apply to and sign a contract with also may act as a joint controller to manage the local hiring process.

For candidates applying for roles within the LATAM region or for global roles, our Costa Rica entity, CL ENTERPRISES, S.R.L., is the data controller.

3. Lawful basis for processing

We collect and process your personal data based on one or more of the following lawful bases:

Pre-contractual Necessity: Processing necessary to take steps prior to potentially entering into an employment or service contract with you.
Performance of a contract: If your application is successful and you accept an offer from us, processing necessary for the performance of your employment contract or service contract with the respective Turnkey entity.
Consent: Where legally required or appropriate, we may seek your explicit consent for specific processing activities
Legal Obligation: Processing necessary to comply with our legal or regulatory obligations
Legitimate Interests: Processing necessary for our legitimate interests, provided these are not overridden by your data protection interests or fundamental rights and freedoms. Our legitimate interests include, but not limited to:

• Evaluating your suitability for current and future roles.
• Managing and improving our recruitment process.
• Ensuring the security of our IT systems.
• Undergoing of HR and retention activity.

4. Why We Process Your Personal Data

Recruitment and Candidate Assessment. During the hiring process, we process personal data to assess your skills, qualifications, and suitability for the role for which you have applied, or other suitable roles within Turnkey. This includes verifying information, conducting interviews and assessments, making hiring decisions, and managing our talent pool.
Identity Verification and Fraud Prevention. We may process certain data to verify your identity and protect against fraud during the application and hiring process, in accordance with applicable law and, where required, with your consent.
Legal and Regulatory Compliance. We process your personal data to comply with applicable laws and regulations (e.g., labor laws, health and safety, tax laws), fulfill reporting obligations, or exercise or defend our legal rights.
Communication with Applicants. We use your personal data to communicate with you throughout the recruitment process, including scheduling interviews, providing updates on your application status, and informing you of hiring decisions.
Offer and Onboarding Preparation. If your application is successful and you accept an offer, we process personal data necessary to prepare your employment contract or service agreement, complete any final pre-employment checks, and facilitate your onboarding. This may include initial setup for payroll and benefits, where applicable and legally required or permitted.
To administer your employment contract, offer letter or service agreement. We collect and use your personal data primarily for the purposes of managing our employment or contract relationship with you, and to fulfill our obligations under your employment or service contract, or applicable TurnKey policies, including on-boarding, payroll, benefits and compensation administration, managing vacation and other types of leave, tax reporting, etc.
Other legitimate business purposes. We may also process your personal data for other legitimate business purposes, including HR administration, maintaining our global directory of staff and contractors , auditing and reporting, employee sentiment analysis, IT and network security, analytics, policy compliance, life safety, cybersecurity and data protection. Additionally, we may use systems to track performance metrics for business operations, performance reviews, rewards, coaching, and training administration.
Automated Systems and AI Processing. As part of our efforts to streamline and enhance the recruitment and HR processes, some of your personal data may be processed using Artificial Intelligence (AI) systems, including automated tools to support identity verification, fraud detection, skill-matching, and workflow optimization. These systems operate under human oversight and are designed to assist – not replace human decision-making. Where applicable, such processing is done in accordance with GDPR and other relevant data protection laws. We ensure that adequate safeguards are in place, and you have the right to request human intervention, express your point of view, and contest decisions made through automated processing, if any.

5. What personal data we collect

The personal data we process about you may differ based on the role, your location, local legal requirements, and the stage of the recruitment process.

We generally collect personal data directly from you, from third parties you authorize or, where legally permitted, from publicly available sources (e.g., professional networking sites), individuals who refer you for positions at TurnKey, your provided referees, and, where permitted by law, third-party background and screening agencies.

We have described the main types of personal data we process.

Identification data. Your first and last name, date of birth, government-issued identifiers (e.g., passport number, national ID, tax ID, photo (if provided by you or part of an ID document).
Contact data. Your home address, personal email address, and telephone number(s).
Hiring data and Professional Information. Information related to your qualifications, education history (degrees, institutions, qualifications), past and current employment history (job titles, responsibilities, dates of employment), professional certifications, skills, language proficiency, your CV/resume, cover letter, references, interview notes and recordings, assessment results, desired salary/compensation expectations, work permits, visas, and other information relevant to your eligibility to work and your application.
Biometric data. To automatically verify your identity and prevent fraud in certain circumstances, we may use your biometric data. Specifically, with your explicit consent, we may collect a photo of you (a selfie) along with an image of your government-issued identification. Using facial recognition technology, the information from your photo may be matched against the information on your identification document.
Spouse’s/partner’s and dependents’ information. Your spouse and dependents’ first and last names, dates of birth, and contact details, if required according to labor law.
Background information. Your academic and professional qualifications, education, sanction or any restrictions (if any) and criminal records data (utilized for background screening and vetting purposes where permissible).
Video, voice and image. We may collect and use your video and image data, interview recording, required for the hiring process.
Financial information. We may process your bank account details, tax information, and other information necessary to administer payroll, taxes, benefits and compensation.
HR Retention and Feedback Data: This includes your responses to employee and contractor engagement surveys, as well as feedback you provide or receive. This data helps us assess workplace satisfaction, manager effectiveness, and team dynamics as part of our retention and development efforts.
Other information you share with us. Any other information you voluntarily choose to provide to us during your application or the interview process, information related to the hiring process.
Workplace and Equipment Usage Data. We collect information about your use of our equipment, devices, and application usage, technical data, for business and security purposes.

Under Brazil’s LGPD, certain data receives special protection as “sensitive personal data.” This includes the biometric data and criminal records data mentioned in this Policy. We will only process your sensitive personal data based on your explicit, specific, and highlighted consent. Our legitimate interest is never used as a basis for processing sensitive personal data.

6. Consent to Record Interviews

As part of the recruitment process, interviews may be recorded for evaluation purposes.

By participating in an interview:

• You may choose to consent to the interview being recorded;
• Recordings will be used solely for recruitment-related decision-making;
• Recordings will be retained for a period required for a recruitment process and securely deleted thereafter;
• You may request access to, correction of, or deletion of the recording at any time;

Your participation in the recruitment process is not conditional upon consenting to recording. If you prefer not to be recorded, alternative methods (e.g., note-taking) will be used.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy unless otherwise required by law. We will only keep your personal data for as long as it is necessary for the purposes set out in this privacy notice unless a longer retention period is required or permitted by law.

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize such data, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

8. Data Security

We implement appropriate technical and organisational measures to safeguard your personal data against accidental loss, destruction, or damage. These measures include access controls, encryption (where appropriate), firewalls, and staff training on data protection.

We also require third parties who process personal data on our behalf to implement appropriate security measures.

9. Your Rights under applicable privacy laws

Under applicable privacy laws, including, but not limited to the GDPR, Brazil’s LGPD, and Mexico’s LFPDPPP, you have the right to:

1. Request access to your personal data;
2. Request correction of your personal data;
3. Request erasure of your personal data;
4. Object to the processing of your personal data;
5. Request restriction of processing your personal data;
6. Request the transfer of your personal data;
7. Withdraw consent where we rely on consent to process your personal data;
8. Request information on entities with whom your data has been shared (according to LFPDPPP in Mexico);
9. For individuals in Brazil, you may also request the anonymization or blocking of unnecessary or excessive data or data processed in non-compliance with the LGPD;
10. Be informed about the possibility of not providing consent and the consequences of such refusal (as per LGPD requirements).

10. CCPA Notice for California Residents

If you are a resident of the State of California, the following additional provisions apply to you in accordance with the California Consumer Privacy Act (CCPA):

a. Categories of Personal Information

Under the CCPA, personal information is classified into categories. During our recruitment process, we may collect:
Identifiers: This includes your full name, home/legal address, telephone number, email address, and IP address.
Professional or Employment-Related Information: We may collect details such as your employment history, current and past job roles, CV, cover letter, and additional employment-related information.
Education Information: This encompasses degrees, certifications, qualifications, and school records.
Additional Identifiers and Personal Information:

• Date of birth
• Gender
• Image and/or any recordings of you, where applicable
• Copies of passport, ID, or similar identification documents
• Biometric Information: we may collect an image of your face (from a selfie) and your government-issued ID to create a biometric identifier for identity verification and fraud prevention purposes.
• Education and training history
• Immigration status and any relevant work permits
• Languages spoken and levels of proficiency
• Criminal record information, as permitted by law
• Information Required for Contract Preparation: Details necessary for drafting employment or other relevant agreements
• Other Information Provided in Your Application
• Any other data included in your CV or application documents
• Interview notes and recordings collected during the recruitment process

b. Use of Personal Information

We collect and use the above categories of personal information for business purposes, including evaluating candidates for potential employment or business cooperation, ensuring compliance with legal requirements, and maintaining records related to the recruitment process.

c. Your CCPA Rights

As a California resident, you have the right to:
Know: Request disclosure of the personal information we collect, use, and disclose about you.
Delete: Request the deletion of your personal information stored by us, subject to certain exceptions.
Non-discrimination: Exercise your CCPA rights without being denied goods or services, being charged different prices or rates, receiving a lower quality of goods or services, or being suggested that you will receive a different rate or level of quality of goods or services.
Correct: Request correction of inaccurate personal information.

d. Exercising Your Rights

To exercise any of the above rights, please contact us at legal@turnkeystaffing.com. Verification of your identity may be required before processing your request.

11. Data Sharing and Transfers

We might share your personal data with our employees, contractors, affiliates, clients (if you are applying for a role that involves providing services to one of our clients) trusted third parties relevant to the recruitment process, such as professional advisors (including lawyers, accountants and auditors), third party service providers, including our data hosting service provider, background screening check provider or if we are under a duty to disclose or share your personal data in order to comply with any legal obligation. Any transfers of data will be conducted in line with GDPR or any other applicable requirements.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Affiliated company (affiliate) means our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.

List of Sub-Processors

The controller has authorised the use of the sub-processors listed at https://turnkeystaffing.com/sub-processor-list/.

12. International Transferring of Data

Your personal data will be stored on servers located in the United States, UK EEA, or other jurisdictions where our service providers or clients operate. As a U.S. company, we may transfer, store, and process your information in countries where our employees, contractors, affiliates, clients, and third parties responsible for data processing are located. We will take all reasonable steps to ensure that such transfers are conducted in compliance with applicable data protection laws and that adequate safeguards are in place to protect the privacy and security of your information during such international transfers. This may include:

• Transferring data to countries that have been deemed to provide an adequate level of data protection by relevant authorities (e.g., an adequacy decision by the European Commission or UK Secretary of State).
• Implementing Standard Contractual Clauses (SCCs) as approved by relevant authorities (e.g., the European Commission or UK ICO) or other appropriate contractual safeguards.
• Relying on other valid transfer mechanisms or derogations as permitted by applicable data protection laws.
• For individuals in Brazil: International transfers of your personal data will be conducted in accordance with the LGPD, using mechanisms such as specific contractual clauses approved by the Brazilian Data Protection Authority (ANPD) or to countries recognized by the ANPD as providing an adequate level of protection.

13. Changes to this Policy

We will update this notice as necessary to stay compliant with relevant laws. Should significant modifications occur in this privacy notice, we will inform you either by displaying a noticeable announcement or through direct communication.

14. Contact Us

As we are the “data controller” of your personal information, we have appointed our Legal Department to be our representative according to GDPR rules.

Turnkey Labs SRL, located in Romania, acts as our main establishment in the European Union, and the Romanian Data Protection Authority (ANSPDCP) is our lead supervisory authority.

However you have the right to lodge a complaint with a supervisory authority in your country of habitual residence, place of work, or the place of the alleged infringement.

You have the right to contact us as your personal information data controller. For any questions or concerns regarding this Policy or our data practices, please contact us at legal[a]turnkeystaffing.com.