Privacy Policy
Version: v1.0 (draft 14 Oct 2026)
Privacy Policy
Version [1.0] – effective [date]. Draft for solicitor review.
GreenBook Ltd (“GreenBook”, “we”, “us”) is the controller of the personal data described in this policy, except where
we say we act as a processor. Company number [●]; registered office [address]; ICO registration number [●]. Contact for
privacy matters: [privacy@ address]. [Data Protection Officer / privacy lead: name and contact, if appointed.]
This policy explains how we use personal data when you use our website and platform, or when we deal with you as a
hirer, contractor, PSC, umbrella company or representative of any of them, in accordance with the UK GDPR, the Data
Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations
2003 (PECR).
1. Whose data we hold and where it comes from
• Contractors – from you directly (registration, profile, documents, timesheets), from hirers, from your PSC or
umbrella company, from right-to-work verification providers, and from public registers.
• Hirer staff and PSC/umbrella signatories – from you, your organisation, and Companies House or accreditation
bodies.
• Referees, approvers and other individuals named on the platform – from the person who named them.
• Visitors to the website – from your browser and device.
Where a hirer records a Current External Supplier or its workers on the platform, we receive that information from the
hirer. We hold it for the hirer’s workforce visibility and do not use it to approach the individuals or the supplier
[confirm].
2. How we use personal data and our lawful bases
Purpose Personal data Lawful basis (UK GDPR Art. 6)
Create and run your account; Name, email, phone, job title, company details, Contract; legitimate interests (account
verify you or your organisation login credentials, authority to bind a company security and fraud prevention)
Operate profiles and make Profile details, skills, certifications, work Contract (for work-seekers using
contractors visible to hirers history, availability, location (area), photograph GreenBook to find work); legitimate
interests (operating the marketplace)
Contract with hirers, PSCs, Identity, company details, rate, Assignment Contract; legal obligation (Conduct
contractors and umbrella details, acceptance logs (timestamp, IP address, Regulations 2003 – KID, records);
companies; record acceptance of device) legitimate interests (evidence of
agreements and KIDs acceptance)
Right-to-work checks and re- Name, date of birth, nationality, share code or Legal obligation (Immigration, Asylum
checks identity documents, check outcome, expiry and Nationality Act 2006 and successor
date; face image/biometric data if processed by provisions). Where biometric data is
a digital verification provider processed for identity verification, a
Schedule 1 DPA 2018 condition applies
[confirm with DVSP: substantial public
interest / employment, statutory
purposes]
Timesheets, approval, invoicing, Hours worked, Assignment, approver, query Contract; legal obligation (tax and
payment and 14-day payment records, bank details, invoices, payment history, accounting)
commitment VAT status
Tax status determinations Status determination inputs, tax reference Legal obligation; contract
(IR35/status, agency legislation) numbers (UTR, NI number, PAYE reference),
and PAYE pay and deductions
Agency Workers Regulations Pay, working-time and role information, Legal obligation; legitimate interests
and hirer information comparator information
Funding of payments Invoice, hirer, Assignment and payment-status Legitimate interests (financing the
(assignment of receivables) data relevant to the debt business and honouring the 14-day
commitment); contract
Umbrella supplier due diligence Umbrella contact details; sample payslips and Legal obligation (where relevant);
and monitoring Worker pay data; remittance evidence; Worker legitimate interests (managing PAYE
complaints liability risk)
Customer support, complaints Correspondence, call notes, case records Legitimate interests; contract
and disputes
Security, fraud prevention and Log data, IP address, device information, usage Legitimate interests
platform integrity events
Service updates and marketing Name, email, preferences Service messages: contract. Marketing to
corporate subscribers: PECR corporate
exemption/legitimate interests with opt-
out; to individuals: consent or soft opt-in
where available
Legal claims and regulatory Any relevant data Legal obligation; legitimate interests
requests
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.
Automated checks (for example, flagging a timesheet that exceeds approved hours, or a right-to-work expiry date) are
reviewed by a person before any adverse outcome. [Update if this changes; Art. 22 UK GDPR as amended by the Data (Use
and Access) Act 2025.]
3. Right-to-work, identity and special category data
Right-to-work checks are a legal requirement. We use digital verification providers registered on the Office for Digital
Identities and Attributes (OfDIA) register to perform checks and may also carry out manual or Home Office online
checks using a share code. Providers act as our processors unless stated otherwise in their own notice. Where a provider
uses face matching, it will process biometric data; we will tell you before the check and offer a manual alternative where
legally permitted. Right-to-work evidence is kept only for the periods in section 8. We do not otherwise ask for special
category data (such as health or trade union membership), or criminal-offence data, unless a client requires a lawful
check (for example a DBS check) and we will then tell you separately.
4. Who we share personal data with
• Hirers – contractor profiles, Assignment details, timesheet and approval data, and confirmation that required
checks are complete.
• PSC and umbrella company counterparties – the information needed to engage and pay the individual. This
includes GreenBook's approved umbrella and payroll partner, which becomes the contractor's employer and a
separate controller of the data it needs for payroll and tax. Its own privacy notice applies to that processing.
• Funding providers and professional advisers – invoice, debt and payment-status data for the purposes of financing
and enforcing receivables, under confidentiality terms.
• Right-to-work and identity verification providers, payment and banking providers, accounting, hosting, email,
support, analytics and security service providers acting as our processors.
• Accreditation bodies (for umbrella verification), HMRC, the Fair Work Agency, the Home Office, the Information
Commissioner, courts, law enforcement and other authorities where required or permitted by law.
• A buyer or investor in the business, under confidentiality, if GreenBook is restructured or sold.
We do not sell personal data.
5. Who sees your profile
Contractor profiles are visible to hirers who use the platform to find or manage contractors, in the form you choose in
your profile settings. Your contact details and right-to-work documents are not displayed publicly and are shown to a
hirer only where needed for an Assignment [confirm product behaviour]. You can edit or hide your profile at any time,
subject to our obligations on active Assignments.
6. International transfers
We aim to keep personal data in the UK. If a provider processes data outside the UK, we make sure a lawful transfer
mechanism applies (a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum to the EU
Standard Contractual Clauses, or another permitted safeguard) and that protection is not materially lower. A list of
providers and locations is available on request. [Complete from the chosen hosting and tooling stack.]
7. Cookies and similar technologies
The Site uses strictly necessary storage (for example to keep you logged in, remember your session and preferences, and
for security). These do not require consent. [If analytics, advertising or non-essential cookies are introduced: list them,
obtain consent where PECR requires it (analytics may be exempt if they meet the conditions in PECR as amended by the
Data (Use and Access) Act 2025 and users are given a clear opt-out), and provide a cookie banner and a cookie table.]
Fonts and assets are served from our own domain [confirm]; we do not currently load third-party advertising trackers
[confirm before launch].
8. How long we keep personal data
Data Retention period Reason
Right-to-work evidence (copies, share-code Duration of the Assignment plus 2 Statutory excuse – Immigration,
outcome, check date, checker, re-check diary) years Asylum and Nationality Act 2006
and Code of Practice
Current External Supplier visibility records While held on the platform plus [2] Audit trail and legal claims
(hirer-side record only) years
Contracts, acceptance logs, KIDs 6 years after the engagement ends Evidence and limitation period
[Conduct Regulations Reg 29 requires
at least 1 year; 6 years covers
limitation]
Timesheets, invoices, payment and funding 6 years from the end of the financial Tax and accounting; limitation
records year
Tax status determinations and PAYE records 6 years [or longer if HMRC enquiry Tax law
open]
Account and profile data While the account is active; deleted or Service delivery
anonymised [24] months after last
activity unless held for another
purpose in this table
Unsuccessful or dormant contractor [12] months Legitimate interests; re-contact
applications
Support and complaints records [6] years from closure Limitation
Marketing preferences Until you opt out, plus a suppression PECR/UK GDPR
record
Website logs and security data [12] months Security
We delete or anonymise data when the period ends unless we need to keep it for an open claim, investigation or legal
requirement.
9. Security
We use access controls, encryption in transit and at rest, logging and supplier due diligence appropriate to the risk, and
restrict identity documents to staff and providers who need them. If a personal data breach is likely to result in a risk to
your rights we will report it to the ICO within 72 hours and tell you where there is a high risk.
10. Your rights
You have the right, subject to exceptions, to be informed, to access your personal data, to have inaccurate data corrected,
to have data erased, to restrict or object to processing (including processing based on legitimate interests and direct
marketing), to data portability for data you provided under contract, and to withdraw consent at any time. We will
respond within one month of a verified request. Some data must be kept for legal reasons set out in section 8, and we
will tell you if we cannot delete it. To exercise a right, email [privacy@ address].
11. Complaints
Please tell us about any concern first – email [privacy@ address]. We will acknowledge it within 30 days and respond
without undue delay, and we will tell you the outcome. You may also complain to the Information Commissioner’s
Office (ico.org.uk, 0303 123 1113) at any time.
12. Children
The Site is intended for people aged 18 and over and we do not knowingly collect data from anyone under 18.
13. Changes to this policy
We will update this policy when our processing changes and will tell you about material changes through the Site or by
email.