Employees, Contractors and Candidates Privacy Policy

1. Introduction

At TurnKey we prioritise your privacy and are committed to the protection of personal data. “TurnKey” includes Turnkey Labs LLC, its affiliates and TurnKey group of companies. This Employees, Contractors and Candidates Privacy Policy (the “Policy”) explains how we process your personal data in compliance with the global data protection laws, including but not limited to General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazilian General Data Protection Law (LGPD), Federal Law on the Protection of Personal Data Held by Private Parties, Mexico (LFPDPPP) and other applicable data protection laws.

This Policy applies to all candidates applying for a position at Turnkey, and or willing to collaborate with Turnkey in either form as well as our current and former employees and contractors. We created this Policy using straightforward and clear language, ensuring our privacy principles are both transparent and easily understood. Our goal is to give you all the necessary information to be well informed about your personal information safety measures. If you have any questions regarding this Policy, please contact us at: legal@turnkeystaffing.com.

2. Data controller

For candidates applying for roles within the European Union, our main establishment and data controller is TURNKEY LABS SRL, located in Romania. For candidates applying for roles within the LATAM region or for global roles, our Costa Rica entity, CL ENTERPRISES, S.R.L., is the data controller. For successful candidates, specific local Turnkey entity you sign a contract with also may act as a joint controller to manage your engagement, local hiring process.

For candidates applying for roles within the LATAM region or for global roles, our Costa Rica entity, CL ENTERPRISES, S.R.L., is the data controller.

3. Lawful basis for processing

We collect and process your personal data based on one or more of the following lawful bases:

Pre-contractual Necessity: Processing necessary to take steps prior to potentially entering into an employment or service contract with you.
Performance of a contract: If your application is successful and you accept an offer from us, processing necessary for the performance of your employment contract or service contract with the respective Turnkey entity.
Consent: Where legally required or appropriate, we may seek your explicit consent for specific processing activities
Legal Obligation: Processing necessary to comply with our legal or regulatory obligations
Legitimate Interests: Processing necessary for our legitimate interests, provided these are not overridden by your data protection interests or fundamental rights and freedoms. Our legitimate interests include, but not limited to:

• Evaluating your suitability for current and future roles.
• Managing and improving our recruitment process.
• Ensuring the security of our IT systems.
• Undergoing of HR and retention activity.
• Career growth and development. 
• Staff training and professional coaching. 
• Evaluating and managing employee and contractors performance. 
• Day-to-day HR administration. 
• Administering and enforcing legal and policy compliance. 
• Corporate and transactional matters. 
• Operating, securing, and maintaining company systems. 
• Core business operations. 
• Internal workplace communications. 

4. Why We Process Your Personal Data

Recruitment and Candidate Assessment. During the hiring process, we process personal data to assess your skills, qualifications, and suitability for the role for which you have applied, or other suitable roles within Turnkey. This includes verifying information, conducting interviews and assessments, making hiring decisions, and managing our talent pool.
Identity Verification and Fraud Prevention. We may process certain data to verify your identity and protect against fraud during the application and hiring process, in accordance with applicable law and, where required, with your consent.
Legal and Regulatory Compliance. We process your personal data to comply with applicable laws and regulations (e.g., labor laws, health and safety, tax laws), fulfill reporting obligations, or exercise or defend our legal rights.
Communication with Applicants. We use your personal data to communicate with you throughout the recruitment process, including scheduling interviews, providing updates on your application status, and informing you of hiring decisions.
Offer and Onboarding Preparation, Engagement Management. If your application is successful and you accept an offer, we process personal data necessary to prepare your employment contract or service agreement, complete any final pre-employment checks, and facilitate your onboarding, as well as ongoing support of your engagement. This may include initial setup for payroll and benefits, where applicable and legally required or permitted.
To administer your employment contract, offer letter or service agreement. We collect and use your personal data primarily for the purposes of managing our employment or contract relationship with you, and to fulfill our obligations under your employment or service contract, or applicable TurnKey policies, including on-boarding, payroll, tax reporting, expense reimbursement, benefits and compensation administration, managing vacation and other types of leave, tax reporting, and other accounting tasks.

Automated Systems and AI Processing. As part of our efforts to streamline and enhance the recruitment and HR processes, some of your personal data may be processed using Artificial Intelligence (AI) systems, including automated tools to support identity verification, fraud detection, skill-matching, note taking, and workflow optimization. These systems operate under human oversight and are designed to assist – not replace human decision-making. Where applicable, such processing is done in accordance with GDPR and other relevant data protection laws. We ensure that adequate safeguards are in place, and you have the right to request human intervention, express your point of view, and contest decisions made through automated processing, if any.

Training and Coaching.We provide training and coaching to support your role, help you build new skills, and support your overall professional development.

Performance Management. We run performance reviews, including evaluating, rewarding, and assessing employees or contractors.

General HR Administration. We handle day-to-day HR tasks, including support services for employees and contractors, general management, keeping a global directory of staff, and tracking personnel sentiment.

Internal Investigations. We may conduct investigations into potential misconduct or policy violations. This includes gathering information related to incidents and managing disciplinary actions.

Corporate Transactions. We may manage activities related to corporate transactions, such as selling, assigning, or transferring parts of the business, or handling acquisitions or integrations involving TurnKey.

Managing, Monitoring, Protecting, and Improving Our Systems. We maintain and protect our systems, networks, devices, and data. This includes monitoring usage, assessing system performance, preventing unauthorized access, and applying cybersecurity and data-protection measures. We may use workplace and device data to support business operations, security, manager effectiveness, and overall employee and contractor experience.

General Business Operations. We handle general business management, including managing personnel, running our services and systems, and supporting communication and collaboration across the company.

Workplace Communications. We provide and maintain workplace
communication tools (email, chat, phone, video). This may include recording or storing communications under the provider’s Terms of Use.

Other Legitimate Purposes. We may also process personal data for other lawful business purposes needed to manage your employment or contractor relationship.

Consent Where Required. If the law requires your consent for any of these uses, we will request it. When we ask for consent, it will be informed, voluntary, and you will not face negative consequences if you choose not to give or later withdraw consent.

5. What personal data we collect

The personal data we process about you may differ based on the role, engagement status, your location, local legal requirements, or the stage of the recruitment process.

We generally collect personal data directly from you, from third parties you authorize or, where legally permitted, from publicly available sources (e.g., professional networking sites), individuals who refer you for positions at TurnKey, your provided referees, and, where permitted by law, third-party background and screening agencies.

We have described the main types of personal data we process.

Identification data. Your first and last name, date of birth, government-issued identifiers (e.g., passport number, national ID, tax ID, photo (if provided by you or part of an ID document).

Demographic Data. This includes your gender, date of birth, and other similar information used in employment or onboarding processes.

Contact data. Your home address, personal email address, and telephone number(s).
Hiring data and Professional Information. Information related to your qualifications, education history (degrees, institutions, qualifications), past and current employment history (job titles, responsibilities, dates of employment), professional certifications, skills, language proficiency, your CV/resume, cover letter, references, interview notes and recordings, assessment results, your
current remuneration, desired salary/compensation expectations, work permits, visas, and other information relevant to your eligibility to work and your application.

Employment and Engagement Data. This includes your job or contractor role, account credentials, office or remote work location, employment or contractor agreement, offer or engagement letter, your service contract or employment agreement, start and end dates, performance history, disciplinary records, hours worked, access logs, training history, and records related to leave, sick time, and vacation/holiday periods. This includes offer letters,
contracts, NDAs, and employment verification letters.
Workplace, Device, Usage, and Content Data. This includes data from workplace applications and communication tools—such as email, calendars, task lists, chat messages, residential address, office/work location, IP-based or system-tracked location data and other internal business systems. It may also include technical and system-generated information, which typically contains only limited identifiers and may not include personal data at all.
Health and Leave-Related Data. This includes health information needed to manage sick leave, fitness-for-work assessments, workplace accommodations, and other legally required employment or contractor-related obligations.
Benefits and Reimbursement Data. This includes information needed to manage benefits, expense reimbursements, and related proof or supporting documentation required to process or verify such claims.

Biometric data. To automatically verify your identity and prevent fraud in certain circumstances, we may use your biometric data. Specifically, with your explicit consent, we may collect a photo of you (a selfie) along with an image of your government-issued identification. Using facial recognition technology, the information from your photo may be matched against the information on your identification document.
Spouse’s/partner’s and dependents’ information. Your spouse and dependents’ first and last names, dates of birth, and contact details, if required according to labor law.

Background information. Your academic and professional qualifications, education, sanction or any restrictions (if any) and criminal records data (where permitted, utilized for background screening and vetting purposes where permissible). This includes criminal record checks, sanctions screening, and related verifications where permitted by applicable law. 


Video, voice and image. We may collect and use your video and image data, interview recording, required for the hiring process or for your engagement managing.

Legal and Contractual Documentation. This includes signed consent forms, contracts, legal declarations, background check authorizations, and any contractual documents. 


Financial information. We may process your bank account details, tax information, and other information necessary to administer payroll, taxes, benefits and compensation.


HR Retention and Feedback Data. This includes your responses to employee and contractor engagement surveys, as well as feedback you provide or receive. This data helps us assess workplace satisfaction, manager effectiveness, and team dynamics as part of our retention and development efforts.
Client and Offboarding Feedback Data. This includes feedback received from clients, internal teams, and managers during or after engagement and offboarding, including summaries of project performance and exit evaluations. 


Other information you share with us. Any other information you voluntarily choose to provide to us during your application or the interview process, information related to the hiring process.


Workplace and Equipment Usage Data. We collect information about your use of our equipment, devices, and application usage, technical data, for business and security purposes. Including system access logs, login timestamps, device IDs, and application activity.

Under Brazil’s LGPD, certain data receives special protection as “sensitive personal data.” This includes the biometric data and criminal records data mentioned in this Policy. We will only process your sensitive personal data based on your explicit, specific, and highlighted consent. Our legitimate interest is never used as a basis for processing sensitive personal data.

6. Consent to Record Interviews

As part of the recruitment and HR processes, interviews may be recorded for evaluation purposes via AI note taking tools.

By participating in an interview:

• You may choose to consent to the interview being recorded.
• Recordings will be used solely for recruitment-related decision-making or HR purposes.
• Recordings will be retained for a period required for a recruitment or HR process and securely deleted thereafter;
  You may request access to, correction of, or deletion of the recording at any time.
• AI tools may be used for note-taking, transcription, or summarization purposes.
• Recordings and AI-generated notes will only be used for legitimate business purposes, including recruitment evaluation, onboarding, training, or performance management.

We may use AI-powered tools to record and/or transcribe meetings, interviews, HR sessions, or performance reviews to enhance accuracy, streamline documentation, and support recruitment, HR, and business operations.
Your participation in the recruitment process is not conditional upon consenting to recording. If you prefer not to be recorded, alternative methods (e.g., manual note-taking) will be used.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes outlined in this Policy unless otherwise required by law. We will only keep your personal data for as long as it is necessary for the purposes set out in this privacy notice unless a longer retention period is required or permitted by law.

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize such data, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

8. Data Security

We implement appropriate technical and organisational measures to safeguard your personal data against accidental loss, destruction, or damage. These measures include access controls, encryption (where appropriate), firewalls, and staff training on data protection.

We also require third parties who process personal data on our behalf to implement appropriate security measures.

9. Your Rights under applicable privacy laws

Under applicable privacy laws, including, but not limited to the GDPR, Brazil’s LGPD, and Mexico’s LFPDPPP, you have the right to:

1. Request access to your personal data;
2. Request correction of your personal data;
3. Request erasure of your personal data;
4. Object to the processing of your personal data;
5. Request restriction of processing your personal data;
6. Request the transfer of your personal data;
7. Withdraw consent where we rely on consent to process your personal data;
8. Request information on entities with whom your data has been shared (according to LFPDPPP in Mexico);
9. For individuals in Brazil, you may also request the anonymization or blocking of unnecessary or excessive data or data processed in non-compliance with the LGPD;
10. Be informed about the possibility of not providing consent and the consequences of such refusal (as per LGPD requirements).

10. CCPA Notice for California Residents

If you are a resident of the State of California, the following additional provisions apply to you in accordance with the California Consumer Privacy Act (CCPA):

a. Your CCPA Rights

As a California resident, you have the right to:
Know: Request disclosure of the personal information we collect, use, and disclose about you.
Delete: Request the deletion of your personal information stored by us, subject to certain exceptions.
Non-discrimination: Exercise your CCPA rights without being denied goods or services, being charged different prices or rates, receiving a lower quality of goods or services, or being suggested that you will receive a different rate or level of quality of goods or services.
Correct: Request correction of inaccurate personal information.

b. Exercising Your Rights

To exercise any of the above rights, please contact us at legal@turnkeystaffing.com. Verification of your identity may be required before processing your request.

11. Data Sharing and Transfers

We might share your personal data with our employees, contractors, affiliates, clients (if you are applying for a role that involves providing services to one of our clients) trusted third parties relevant to the recruitment or engagement process, such as professional advisors (including lawyers, accountants and auditors), third party service providers, including our data hosting service provider, background screening check provider or if we are under a duty to disclose or share your personal data in order to comply with any legal obligation. Any transfers of data will be conducted in line with GDPR or any other applicable requirements.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Affiliated company (affiliate) means our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.

List of Sub-Processors

The controller has authorised the use of the sub-processors listed at https://turnkeystaffing.com/sub-processor-list/.

12. Additional Provisions for Employees, Candidates, and External Staff in Canada

Manner of Collection

We collect personal data that you provide directly to us, such as during the job application process or in connection with the administration of your employment or contractual relationship. We also collect certain information automatically through your use of workplace systems and devices, as previously described. In some cases, we may collect personal data indirectly, with your consent. For example, we may obtain background verification data from third-party screening providers, and we may also receive personal data from recruitment agencies or individuals providing references. Please refer to the section titled “What personal data we collect” for further details on the types of personal data we collect.

Transfer of Personal Data

TurnKey and our service providers (including our affiliates) may access, store, and otherwise process your personal data outside of your province or territory of residence (including, for Quebec residents, outside of Quebec), as well as in other countries such as the United States and other foreign jurisdictions where we or our service providers operate. We, our affiliates, and our service providers may disclose your personal data where required or permitted by applicable law or legal process, which may include lawful access by courts, law enforcement agencies, or other governmental authorities in the jurisdictions in which we or our service providers are located.

Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, as outlined in this privacy notice, and to satisfy our legal, regulatory, or legitimate business requirements. Retention periods are defined in accordance with TurnKey’s internal corporate data retention schedule.

Your Rights

Subject to limited exceptions under applicable law, you have the right to request access to, correction of, or updates to your personal data held by us. You also have the right to withdraw your consent to our collection, use, and disclosure of your personal data. However, please note that employees cannot withdraw consent for the collection and processing of personal data necessary to administer their employment relationship.

To exercise your rights or submit a request regarding your personal data, you may contact us at legal@turnkeystaffing.com. We may request specific personal data from you in order to verify your identity or the identity of the individual making the request.

How to Contact Us

If you have questions or concerns about this privacy notice, or about how TurnKey or our service providers (including those located outside of Canada) handle your personal data, or if you wish to access, correct, or withdraw your consent to the use of your personal data, you may contact us by emailing legal@turnkeystaffing.com.

13. Notice for European Union, United Kingdom, and Switzerland

As we are the “data controller” of your personal information, we have appointed our Legal Department to be our representative according to GDPR rules.

Turnkey Labs SRL, located in Romania, acts as our main establishment in the European Union, and the Romanian Data Protection Authority (ANSPDCP) is our lead supervisory authority.

However you have the right to lodge a complaint with a supervisory authority in your country of habitual residence, place of work, or the place of the alleged infringement.

You have the right to contact us as your personal information data controller at legal[a]turnkeystaffing.com.

14. International Transferring of Data

Your personal data will be stored on servers located in the United States, UK EEA, or other jurisdictions where our service providers or clients operate. As a U.S. company, we may transfer, store, and process your information in countries where our employees, contractors, affiliates, clients, and third parties responsible for data processing are located. We will take all reasonable steps to ensure that such transfers are conducted in compliance with applicable data protection laws and that adequate safeguards are in place to protect the privacy and security of your information during such international transfers. This may include:

• Transferring data to countries that have been deemed to provide an adequate level of data protection by relevant authorities (e.g., an adequacy decision by the European Commission or UK Secretary of State).
• Implementing Standard Contractual Clauses (SCCs) as approved by relevant authorities (e.g., the European Commission or UK ICO) or other appropriate contractual safeguards.
• Relying on other valid transfer mechanisms or derogations as permitted by applicable data protection laws.
• For individuals in Brazil: International transfers of your personal data will be conducted in accordance with the LGPD, using mechanisms such as specific contractual clauses approved by the Brazilian Data Protection Authority (ANPD) or to countries recognized by the ANPD as providing an adequate level of protection.

15. Changes to this Policy

We will update this notice as necessary to stay compliant with relevant laws. Should significant modifications occur in this privacy notice, we will inform you either by displaying a noticeable announcement or through direct communication.

16. Contact Us

For any questions or concerns regarding this Policy or our data practices, please contact us at legal[a]turnkeystaffing.com.