Privacy Policy.

1. Who we are

WorkOfficially Inc., a Delaware (United States) corporation ("we", "our", or "WorkOfficially"), is the data controller for personal information processed through the WorkOfficially marketplace. This policy explains what we collect, why we collect it, who we share it with, and the rights you have over it.

2. What we collect

Information you provide. Name, email, phone, profile fields (headline, bio, portfolio, skills, hourly rate, location, languages), uploaded files and attachments, messages you send through the platform, job posts and proposals, dispute evidence.

Identity verification. When you start KYC, our regulated partners (Sumsub, Veriff, or similar) collect government ID, selfie video, address proof. We receive only the pass/fail verdict and a few demographic fields needed to determine sanctions risk; the underlying documents are held by the partner.

Payment data. Card details are tokenised by Stripe or PayPal and never touch our servers. We retain the last 4 digits and brand for receipts.

Payout instrument data. Bank account or PayPal account details you provide for payouts are encrypted at rest and only used to process your withdrawals.

Usage data. IP address, browser user-agent, login times, request URLs, error logs. These are retained for security and abuse detection.

Cookies. See Section 5.

2b. Reputation Bridge data

If you submit a Reputation Bridge import (Upwork, Fiverr, Toptal, Freelancer.com, Guru, PeoplePerHour, etc.), we fetch the public contents of the source profile URL you provide. We extract: your displayed name on that platform, your composite star rating, the count of reviews, each review's text, each reviewer's first name + initial, and each review's posted date. We do not request, store, or use any private data from the source platform.

A WorkOfficially Reputation team member reviews the import by hand against your live source profile before approving it. The verified data is stored on your WorkOfficially profile. You can remove any imported source at any time; removed data is retained for 90 days for fraud investigation and then permanently deleted.

3. How we use it

• To operate the marketplace - match talent to jobs, enforce contracts, process payments and escrow, settle invoices, run EOR payroll.
• To verify identities and screen for sanctions and fraud.
• To send transactional emails: signups, password resets, milestone events, disputes, reviews. You cannot opt out of essential transactional email while you have an active account.
• To improve the platform: aggregated, de-identified analytics.
• To respond to legal process and protect our users.

3b. Legal bases for processing

Where the GDPR or UK GDPR applies, we rely on these legal bases: performance of a contract (to provide the marketplace you signed up for and to administer contracts, payments, and escrow); legal obligation (KYC, anti-money-laundering, sanctions, tax, and accounting records); legitimate interests (security, fraud and abuse prevention, service improvement, and direct communications about the service, balanced against your rights); and consent (optional analytics cookies and any optional marketing, which you can withdraw at any time). Where we rely on legitimate interests, you may object as described in Section 8.

California residents (CCPA/CPRA). We do not sell or "share" your personal information for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights. You may exercise access, deletion, and correction rights via the contacts in Section 8.

4. Sharing & disclosure

We share your data only with:

• Service providers - hosting (AWS), email (SMTP), payments (Stripe, PayPal), KYC (Sumsub or Veriff), EOR (Deel or Remote), analytics, error tracking. Each is bound by a data-processing agreement.
• Counterparties on the platform - your public profile is visible to other users. Inside an active contract, the other party sees your name, identity-verification status, and messages.
• Legal authorities - when required by valid legal process.

We do not sell personal data, ever.

4b. Current subprocessors

The following third parties process data on our behalf. Each is bound by a data-processing agreement and is named here so you know who can see what.

We update this list when subprocessors change. Material additions are announced 14 days in advance via email and on this page.

5. Cookies & tracking

We use the following cookies:

• wrk_session - HttpOnly, Secure, SameSite=Lax. Required to keep you signed in.
• _csrf - double-submit token for form protection.
• Optional analytics cookies (only if you opt in). We do not use Google Analytics or Facebook Pixel.

6. Retention

We keep your account data while your account is active. After closure, we retain transaction records for 7 years to satisfy tax and AML obligations. Message attachments and uploaded files are retained for 3 years after the last related contract closes.

7. Security

We protect your data with:

• Argon2id password hashing with HMAC-SHA256 pepper.
• TLS in transit; AES-256 at rest for sensitive columns.
• Two-factor authentication, WebAuthn-ready, backup codes.
• Least-privilege database users.
• Segregated escrow accounts held with regulated banking partners - the application server never has authority to move client funds without policy-bound approvals.
• Independent security audits and a published responsible-disclosure policy.

8. Your rights

Subject to applicable law (GDPR, CCPA, PDPA, etc.) you can:

• Access your personal data - request a copy.
• Correct inaccurate data.
• Delete data we no longer need to retain.
• Port your data to another service in a structured format.
• Object to processing that is not required to run the marketplace.
• Withdraw consent at any time for processing that is consent-based.

Send requests to [email protected]. We respond within 30 days.

8b. Automated decisions

You have a right under GDPR Article 22 and similar laws not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. WorkOfficially does not make significant account decisions by automated processing alone. Sanctions screening, fraud signals, and AI suggestions may flag an account for review - a human on our team makes the final call before any restrictive action (suspension, KYC denial, dispute resolution, Reputation Bridge approval).

9. International transfers

WorkOfficially is operated from the United States. Our primary servers are in the EU (Frankfurt). Some of our processors operate globally. When we transfer your data across borders, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the EU-US and UK-US Data Privacy Framework where applicable, or an equivalent valid transfer mechanism.

9b. Data-breach notification

If we suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, in line with GDPR Article 33. If the breach is likely to result in a high risk to you specifically, we will also notify you directly without undue delay, in line with GDPR Article 34. The notification will describe what happened, what data was affected, what we are doing about it, and what you can do.

10. Children

WorkOfficially is not intended for anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy. Material changes are announced by email and on this page at least 14 days before they take effect.

12. Contact

Privacy questions: [email protected]
Data Protection Officer: [email protected]

© WorkOfficially Inc. · Effective May 30, 2026