Data Protection Policy

This is a working draft of Corpshore Solutions Corporation's internal data protection policy. It has not yet been reviewed by counsel or a qualified data protection officer, and should not be relied on as a final or binding statement of our practices. It describes how Corpshore is designed to protect data as an organisation. For what rights you have over your own personal data, see our Privacy Policy; for our EU/UK GDPR-specific commitments, see our GDPR statement.

1. Purpose and scope

This policy applies to every system, process and person that handles personal data on behalf of Corpshore, across all three platform surfaces (candidate, employer, admin) and every region Corpshore operates in. It governs how data is classified, where it's stored, who can access it, how long it's kept, and what happens if something goes wrong.

2. Data classification

Corpshore classifies data it handles into three tiers, with protection requirements that scale accordingly:

• Standard personal data: name, email, phone number, employment history, skills, and similar profile information. Protected by standard access controls and encryption.
• Special category / sensitive data: government identity documents, biometric liveness and face-match data, sanctions-screening results, and bank or payout details. Subject to stricter access controls, additional logging, and shorter default retention than standard data.
• Business and billing data: company registration details, tax identifiers, billing contacts and payment method references. Held in the global control-plane database, since it is not personal data about an individual candidate.

3. Data residency

Candidate identity documents and profile data are stored in one of four regional databases, matching the candidate's own region: Americas (NA), Europe (EU), Middle East and Africa (MEA), or Asia-Pacific (AP). A candidate's data defaults to the Europe region if their country can't be matched to one of the other three, pending manual correction. Matching between candidates and roles runs on anonymised vectors derived from this data, not the underlying documents themselves, so matching logic never needs to move identity documents outside their home region.

4. Access control

Access to personal data follows least-privilege: an employee, contractor or system component is granted only the access its role requires, not broader platform-wide access by default. Access to special-category data (identity documents, biometric data) is restricted to the specific admin review functions that need it, and every access is logged. Admin accounts are provisioned individually, are not shared, and are revoked promptly when someone's role changes or ends.

5. Encryption

Personal data is encrypted in transit (TLS) between the platform and every client, and between internal services. Data at rest in the production databases is encrypted at the storage layer. Session credentials are signed and verified server-side; they are never stored or transmitted in plain text.

6. Retention and deletion

Data is kept only as long as it serves the purpose it was collected for, or as long as Corpshore is legally required to retain it, whichever is longer. A candidate who deletes their account can request deletion of their profile and documents; identity verification artefacts tied to a completed engagement may be retained for a defined period afterward where compliance or dispute-resolution obligations require it. Exact retention periods per data category are being finalised and will be published here and in the Privacy Policy once set.

7. Sub-processors and vendors

Where Corpshore uses a third-party vendor to process personal data on its behalf (for example, a payment processor, an identity-verification provider, or infrastructure hosting), that vendor is assessed for its own data protection practices before being engaged, and is bound by contract to handle the data only as Corpshore instructs and to apply protections at least as strong as this policy requires. A current list of sub-processors will be published once finalised.

8. Incident and breach response

Corpshore maintains a process for identifying, containing and investigating a suspected data incident. Where a breach is confirmed to have affected personal data, affected individuals and relevant regulators are notified within the timeframe required by applicable law. The exact escalation path and notification timelines are being finalised as part of this policy's legal review.

9. AI features and data protection impact

Before a new AI-assisted feature that processes personal data goes live (matching, screening, CV parsing, or similar), it goes through an internal review of what data it touches, why, and whether a formal data protection impact assessment is required under applicable law. No automated decision from these systems is final without a human review option, consistent with the commitment in our Terms of Service.

10. Training and confidentiality

Anyone with access to personal data through their role at Corpshore is bound by confidentiality obligations and is expected to complete data protection training appropriate to their access level before being granted it, and periodically afterward.

11. Contact

Questions about this policy, or about how a specific system handles data, can be sent to support@corpshore.work. A dedicated data protection contact will be published here once appointed.