This Privacy Policy explains how OGS CAREER WORKFORCE LIMITED ("CareerWorkforce", "we", "us") collects, uses, shares and protects personal information when you use careerworkforce.com, our dashboards for candidates, employers, agencies, agents, referral partners, domestic worker offices and labour supply offices, our website chat assistant, and our WhatsApp number. It also explains your rights and how to use them.

This is a notice, not a contract. You do not have to "agree" to it. We process your information on the lawful bases described in section 5.

1. Who we are

The controller of your personal information is OGS CAREER WORKFORCE LIMITED, a private limited company registered in England and Wales under company number 17393127. Our registered office is 5 Siu Offices, 4-6 Greatorex Street, London E1 5NF, United Kingdom.

CareerWorkforce is part of the OGS Group. Where a candidate who is a citizen of Pakistan is recruited for employment abroad, that recruitment is carried out by the OGS Group's licensed Overseas Employment Promoter (Licence No. MPD/2978/RWP, Rawalpindi, Pakistan), or by another overseas employment promoter holding its own licence, and not by CareerWorkforce itself.

Privacy contact: info@careerworkforce.com (please put "Privacy" in the subject line). You can also write to us at our registered office. We have not appointed a Data Protection Officer, because the law does not require one for our business, but our privacy contact handles every data protection request and complaint.

2. The information we collect

2.1 Information you give us

• Account details: your name, email address, phone and WhatsApp number, password (stored only as a secure hash), the type of account you hold, and your profile settings.
• Candidate profile and CV: work history, education, skills, languages, job preferences, nationality, country of residence, expected salary, photograph, intro video, CV files and application history.
• Identity and visa documents: passport details, national identity card (CNIC or equivalent), certificates and licences, and other documents you upload for verification, job applications or visa processing. Some destination countries also require medical results or a police clearance certificate. We ask for these only when a specific recruitment or visa step needs them.
• Business information: for employers, agencies, agents, referral partners and domestic worker offices: company name, registration and licence documents, contact people, vacancies, demands, contracts, commissions and payout details.
• Messages: messages you send through the platform, to our website chat assistant or to our WhatsApp number, support requests, complaints and feedback.
• Payments: which plan or service you bought, the amount, currency, date and payment reference. Card details are entered directly with our payment provider. We never see or store your full card number. When you pay, we also keep a record of the versions of our Terms, Refund Policy and Privacy Policy you accepted, the billing email you gave, when, and the IP address and browser you used, as evidence of the agreement.
• Refund requests: the plan, the amount and how it was worked out (including how much of the plan you had used), your reason if you give one, the email address for refund updates, and, only when a refund cannot go back to your card, the bank account details you give us (account holder, bank, account number or IBAN, SWIFT/BIC, country). Bank details are stored encrypted, shown only to staff who pay refunds (each viewing is logged), and deleted 90 days after the refund is decided.

2.2 Information collected automatically

• Device and usage data: IP address, browser and device type, pages visited, and the date and time of each visit.
• Security data: sign-in events, one-time passcode (OTP) checks, and records we need to detect fraud, spam and abuse.
• Cookies: we use cookies that are strictly necessary to keep you signed in and secure. We use other cookies only as described in our cookie banner, where you can make your choices.

2.3 Information we receive from others

• Agencies, agents, employers, domestic worker offices and referral partners may add a candidate's details to the platform, for example to propose that candidate for a vacancy. They must have the candidate's permission and a lawful reason to share it (see our Terms and Conditions). A candidate added this way is not shown publicly. Only the organisation that added the candidate and the parties it proposes the candidate to can see the profile.
• Sign-in providers such as Google, if you choose to sign in with them: your name, email address and profile picture.
• Meta (WhatsApp): when you message our WhatsApp number, as described in section 4.
• Meta (Facebook and Instagram lead forms): when you fill in and submit one of our forms on Facebook or Instagram, as described in section 4.8.
• LinkedIn (lead forms): when you fill in and submit one of our forms on LinkedIn, as described in section 4.10.
• Google (lead forms, comments and reviews): when you fill in and submit one of our forms on a Google advert, comment on one of our YouTube videos or review our business on Google, as described in section 4.12.
• TikTok (lead forms and comments): when you fill in and submit one of our forms on a TikTok advert, or comment on one of our TikTok videos or photo posts, as described in section 4.15.
• Payment providers: confirmation that a payment succeeded, failed or was refunded.

An organisation that adds a candidate to CareerWorkforce must first give that candidate this Privacy Policy and tell them it is adding their details. That way you know we hold your information and where it came from. You can ask us at any time what information we hold about you and who provided it.

3. How we use your information

• To create and secure your account, including verifying you by email or WhatsApp one-time passcode, and to confirm an action you take, such as signing a contract, with a one-time passcode.
• To show your profile to employers and recruiters, to match candidates with vacancies, and to process applications, interviews, offers, contracts and visa steps.
• To check documents and licences, and to prevent fraud, fake job offers and misuse of the platform.
• To answer your questions and complaints, including through our website chat assistant, our WhatsApp number and our Facebook Page and Instagram account.
• To contact you about the jobs or services you asked about in a Facebook or Instagram lead form, and to see which of our adverts work by recording which advert and campaign the form came from.
• To contact you about the jobs or services you asked about in a LinkedIn lead form, and to answer comments on our LinkedIn Page's posts (section 4.10).
• To contact you about the jobs or services you asked about in a TikTok lead form, and to read and answer comments on our TikTok videos and photo posts (section 4.15).
• To handle forms on our own pages, keep business contacts, spot duplicates, assign new leads to a member of our team, record your consents and opt-outs, and show that we respected them (section 4.16).
• To take payments, issue receipts and handle refunds for paid plans and optional services.
• To send service messages about your account, applications and payments.
• To send marketing only where the law allows it and you have not opted out. You can opt out of marketing at any time by emailing us or changing your notification settings.
• To keep the platform secure, fix faults and improve our services using aggregated statistics.
• To comply with the law and with lawful requests from courts, regulators and immigration or labour authorities.

4. WhatsApp, Facebook, Instagram, LinkedIn, Google, YouTube and TikTok

Our only official WhatsApp number is +44 7473 070244 (display name: CareerWorkforce). We use the WhatsApp Business Platform, which is provided by Meta. We will never ask you on WhatsApp for your password, your full card details, or payment for a job.

4.1 One-time passcodes

If you choose WhatsApp to verify your account, we send your passcode to your WhatsApp number as an authentication message. We keep a record that a passcode was sent and whether it was verified. We do not keep the passcode after it expires. If WhatsApp is unavailable, you can use email instead.

We also send a passcode to confirm an action you take yourself, such as signing a contract. It goes to your email address. If your account has no email address, it goes to the WhatsApp number you verified on your account, as an authentication message.

4.2 Our automated WhatsApp assistant

• It is automated. When you message our WhatsApp number, the replies come from an automated assistant, and it tells you so in its first reply. It answers only questions about CareerWorkforce: our services, our latest jobs, your application status, and facts and answers our team has approved in advance. It may use AI (OpenAI) to understand your question and to give an approved answer in your language, but it does not answer anything outside those approved facts; for anything else it offers to put you in touch with a person.
• You can reach a person. Choose "Talk to a person" at any time. If you confirm by pressing "Yes", we create a callback request and our team contacts you. While a person is handling your request, the assistant stays silent. Our team can reply on WhatsApp only within 24 hours of your last message, as WhatsApp's rules require. After that, we contact you by phone or email. You can also reach a person at info@careerworkforce.com.
• We ask which kind of user you are. The assistant asks which kind of user you are (for example job seeker, employer or agency). You can skip the question and just ask what you want. We keep your answer.
• What goes to our customer-relationship system. When you message us we record there your WhatsApp number and profile name, the steps you take in the chat (arrived, asked a question, started or finished creating an account, sent a CV, asked for a call-back), the kind of user you chose and, if you came from one of our adverts, which advert. We do this to measure which adverts work and to follow up people who ask for help (our legitimate interests). We never send the text of your messages there. If you ask for a call-back and press "Yes", your request and the conversation are passed to our team as well. To have this removed, send "delete my data" in the chat.
• We don't mix up conversations. We never share your conversation with another customer.

4.3 Stopping and restarting messages

Send STOP (or UNSUBSCRIBE) at any time. In Urdu you can send بند or روکو, and in Arabic إيقاف or توقف. We will confirm once and then send you no further WhatsApp messages, except a passcode you ask for yourself. To start again, send START (Urdu: شروع, Arabic: ابدأ). We also respect opt-out requests you make by email or any other way. To keep honouring your choice, we keep a minimal record that your number opted out.

4.4 What we collect on WhatsApp

• Your WhatsApp phone number or, where WhatsApp provides it instead, your WhatsApp business-scoped user ID (BSUID) and username.
• Your WhatsApp profile name.
• The messages, button choices and files you send us, and the replies we send you.
• Delivery and read status of our messages, and technical logs such as message IDs and error codes.

4.5 Voice notes

If you send a voice note, we convert it to text to understand your request, then treat the text like a typed message. We do not store the audio. It is processed in memory and discarded, and only the text transcript is kept, for the message retention period in section 9.

4.6 Sending your CV on WhatsApp

You can send us a CV on WhatsApp only after choosing "Send my CV" and pressing "I agree" on a screen that explains what happens next. This is available only when your WhatsApp number is linked to your Job Seeker or Selected Domestic Worker account. We add the CV to your account's CVs and read it to fill in empty fields of your profile (job title and a short summary). Please do not send your passport or identity card on WhatsApp. If one is detected, we delete it and ask you to upload it through your secure dashboard instead. A CV sent on WhatsApp is stored with the other CVs on your account, under the same access controls as a CV uploaded on the website.

4.7 No AI training

We do not use WhatsApp messages, or information WhatsApp gives us about you, to train, develop or improve any artificial-intelligence model: not ours and not anyone else's. When we use an AI provider to process a message (for example, to transcribe a voice note, to find the approved answer that best matches your question, or to check that an answer is safe before we send it), we send only the content needed for that task. We never send your WhatsApp number, BSUID or WhatsApp profile name with it, and we hide email addresses and phone numbers you type before a question is sent. A CV you choose to send is read in full, because reading it is the purpose. The same applies to a company document or a job advert that an employer chooses to send (section 4.13). Our contract with the provider does not allow it to use the data to train its models.

Some of the WhatsApp features above are being introduced gradually, starting with a small pilot. This policy describes how each one works once it is switched on.

4.8 Facebook and Instagram lead forms and messages

We advertise jobs and our services on Facebook and Instagram, which are provided by Meta. Some of our adverts open a form. If you choose to submit it, Meta sends us what you entered: usually your name, phone number and email address, and your answers to our questions (for example the job or trade you are interested in and your experience). Meta also tells us which advert, form and campaign it came from, and whether you ticked any consent box on the form. Nothing is sent to us unless you press Submit.

• How we use it. We contact you by phone or email about the jobs or services you asked about. We message you on WhatsApp, or send you job alerts, only if you ticked the box for that on the form. You can withdraw that at any time (see section 10).
• Where it goes. Your form goes straight into our customer-relationship system, which runs on our own servers, and only our staff can see it. We do not sell it. We do not pass it to an employer unless you later apply for a job or agree to us putting you forward.
• What we never ask. Our forms never ask for your passport or identity number, your health, your religion or other sensitive information. Please do not type such information into a form.
• What we never do. We do not use Facebook or Instagram to build profiles of people. We never collect information about people who comment on, react to or follow other companies' pages.
• Meta's own use. The form is part of Facebook or Instagram, so Meta also processes what you enter, under Meta's Privacy Policy.

If you message our Facebook Page or Instagram account, or comment on our posts, the message or comment reaches our customer-relationship system, which only our staff can see, and our team reads it. We answer comments ourselves. We may answer a direct message automatically, and when we do:

• It says so. Every automated reply ends with a line saying that it is an automated reply and how to reach a person.
• Approved answers only. The reply is an answer our team wrote and approved in advance for that kind of question. It is not written by AI and it is general information, not legal, immigration or financial advice. If we have no approved answer for your question, or you are upset or ask for a person, the automated reply only tells you that our team has your message, and a person replies.
• You can reach a person at any time. Type "speak to a human" in the chat, or email info@careerworkforce.com. While a person is handling your conversation, no automated reply is sent. We never use automated replies to send you adverts or messages you did not ask for: they are sent only straight after you message us.
• AI reads your message, but does not write the reply. To work out what you are asking and whether you are upset, we send the text of your message to our AI provider, OpenAI (section 7). We hide email addresses and phone numbers in it first, and we never send your name or profile with it. Our contract with the provider does not allow it to use the data to train its models.
• What we keep. We keep the conversation (your message, our reply and your Facebook or Instagram name) in our customer-relationship system only while we need it to answer you and follow up. We delete it when you ask (see section 11). If you ask for a call-back or send us details so that we can help you, we treat that under the rest of this policy.
• Meta's own use. The conversation takes place on Facebook or Instagram, so Meta also processes it under Meta's Privacy Policy. You can block or mute our Page at any time.

4.9 Our adverts and the website assistant

If you reach our website from one of our adverts, we note in your browser session which advert brought you (the campaign and advert identifiers in the link). If you tell our website assistant which kind of user you are, we note that as well. We send these, with a random code that is not your session identifier, to our customer-relationship system to measure which adverts work (our legitimate interests). If you reached us from one of our adverts, the assistant may then offer an optional form asking for your name, phone number and email address, so that we can contact you or help you if you need it. Every field is optional, you can skip it, and you do not have to fill it in to use the assistant. If you fill it in, we store those details with the advert and the kind of user you chose in our customer-relationship system, and we use them only to contact you and help you; we never share them or misuse them. If you then create an account, the name, email address and phone number of your account are added to the same record. We do not send your IP address or anything else you type in the assistant. We keep this for 12 months (section 9) and you can ask us to delete it (section 10). We do not keep Facebook's click identifier.

4.10 LinkedIn

We have a LinkedIn Page and we may advertise jobs and our services on LinkedIn. This section explains what we receive from LinkedIn and what we do with it.

• Lead forms. Some of our LinkedIn adverts open a form. LinkedIn may fill in some answers for you from your LinkedIn profile (for example your name, email address, job title or country), and you can change them before you send the form. If you press Submit, LinkedIn sends us what the form contains: usually your name, email address and phone number, and your answers to our questions (for example the job or trade you are interested in and your experience). LinkedIn also tells us which advert, form and campaign it came from, and whether you ticked any consent box on the form. Nothing is sent to us unless you press Submit.
• How we use your form. We contact you by phone or email about the jobs or services you asked about. We message you on WhatsApp, or send you job alerts, only if you ticked the box for that on the form. You can withdraw that at any time (see section 10). Your form goes straight into our customer-relationship system, which runs on our own servers, and only our staff can see it. A person reads it: we do not send it to any AI service and we do not use it to make any automated decision about you. We do not sell it, and we do not pass it to an employer unless you later apply for a job or agree to us putting you forward. Our forms never ask for your passport or identity number, your health, your religion or other sensitive information. Please do not type such information into a form.
• No profiles. We never use LinkedIn to build profiles of people, and we never add information from your LinkedIn profile or from anywhere else to your form. We never use LinkedIn to try to work out your nationality, immigration status or any other sensitive information about you.
• Comments on our posts. Comments on our LinkedIn Page's posts appear in our customer-relationship system so that our staff can read them and reply as the Page. Every reply is written by a person: nothing is automated and no AI writes a reply. LinkedIn normally gives us only the comment and LinkedIn's reference number for the person who wrote it. If LinkedIn also gives us the commenter's name or photo, we delete it within 24 hours, and we delete the text of every comment within 48 hours. Our encrypted backups may hold a copy for a short time longer, until they are replaced. After that we keep only LinkedIn's reference numbers for the comment and the post, and our own replies. Comments are seen only by our staff who look after the Page, and they are never downloaded or exported.
• What we never do. We never turn someone who comments on, reacts to or follows our Page into a lead, and we never contact you because you did. We never collect information about people who comment on, react to or follow other companies' pages. We do not receive messages sent to our LinkedIn Page in our own systems: we read and answer them on LinkedIn.
• Statistics. LinkedIn gives us statistics about our Page, our posts and our adverts: for example how many people saw or reacted to a post, how much an advert cost and how many forms it brought, and how our followers or the people who saw an advert divide by job function, seniority, industry and country. These are totals only. They do not identify anyone and we do not receive the names of the people they count.
• LinkedIn's own use. The form, our Page and our posts are part of LinkedIn, so LinkedIn also processes what you enter or post there, under LinkedIn's Privacy Policy.

4.11 Job alerts and updates on WhatsApp

If you tick "Also send me WhatsApp updates about my applications and jobs from Career Workforce" in your alert settings, we send to your verified WhatsApp number:

• Job alerts: at most one message a day, saying how many new jobs match your job alert, naming one of them and linking to your Job Alerts page.
• Updates on your own applications and visa process: for example a new application status ("Interview") or a visa step ("Medical test completed").

We use only a number you have proved is yours by entering a code we sent to it on WhatsApp. The box is never ticked for you. These messages contain your first name, a job title or destination country and a status; they never contain passport details, documents or payment details. To stop them, untick the box or reply STOP (see section 4.3). Your email and dashboard alerts are not affected.

If you tick "Send me WhatsApp messages from Career Workforce about my payments, receipts, refunds and when my plan ends" in your settings, we send to your verified WhatsApp number: that a payment was received (the plan, the amount and until when it runs), that your refund request was received, paid or not approved (and why), and that your plan ends soon or has ended. These messages contain your first name, a plan name, an amount and a date; never card or bank details. The box is never ticked for you. To stop them, untick the box or reply STOP (see section 4.3). Your email and dashboard messages are not affected.

If you hold an employer, domestic worker office, agency, agent or referral partner account and tick the WhatsApp box in your settings, we send to your verified WhatsApp number updates on the visa cases you manage (for example "Medical test completed") or, for referral partners, on the status of your demands (for example "Verified"). The same rules apply: only a number you have verified with a WhatsApp code, never ticked for you, no passport details, documents or payment details, and unticking the box or replying STOP stops them.

4.12 Google and YouTube

We may advertise jobs and our services on Google, we have a YouTube channel, and our business has a profile on Google Search and Google Maps. This section explains what we receive from Google and YouTube and what we do with it.

• Google Ads lead forms. Some of our Google adverts open a form. If you choose to submit it, Google sends us what you entered: usually your name, phone number and email address, and your answers to our questions (for example the job or trade you are interested in and your experience). Google also tells us which advert, form and campaign it came from, and a reference number for the click. Nothing is sent to us unless you press Submit.
• How we use your form. We contact you by phone or email about the jobs or services you asked about. We message you on WhatsApp, or send you job alerts, only if you answered Yes to the question on the form that asks for that. You can withdraw that at any time (see section 10). Your form goes straight into our customer-relationship system, which runs on our own servers, and only our staff can see it. A person reads it: we do not send it to any AI service and we do not use it to make any automated decision about you. We do not sell it, and we do not pass it to an employer unless you later apply for a job or agree to us putting you forward. Our forms never ask for your passport or identity number, your health, your religion or other sensitive information. Please do not type such information into a form.
• What we never send back to Google. We never upload lists of people, contact details or what happened to a lead (for example "hired") to Google, and we never use your form to target adverts at you or at people like you.
• Comments on our YouTube videos. Our customer-relationship system uses YouTube API Services to show our staff the comments on our own channel's videos, so that they can read them and reply as the channel. Every reply is written by a person: nothing is automated and no AI writes a reply. We receive the comment, the name of the YouTube channel that wrote it and YouTube's reference numbers. We delete the name and the text within 30 days unless YouTube still shows the comment, in which case we refresh it from YouTube, and we delete all of it if our channel is disconnected. Comments are seen only by our staff who look after the channel, and they are never downloaded or exported. By using YouTube you are bound by the YouTube Terms of Service.
• Reviews on our Google Business Profile. Reviews that people leave about us on Google appear in our customer-relationship system so that our staff can read them and answer as the business. Every answer is written by a person. We keep a review for no more than 30 days after Google last showed it to us, and we delete all of them if our profile is disconnected.
• What we never do. We never turn someone who comments on our videos, subscribes to or watches our channel, or leaves us a review into a lead, and we never contact you because you did. We never collect information about people who comment on or follow other channels or businesses.
• Statistics. YouTube and Google give us statistics about our videos, our adverts, our business profile and our website: for example how many times a video was watched, how much an advert cost and how many forms it brought, how many people visited our website and from where, and which searches on Google showed our pages. These are totals only. They do not identify anyone and we do not receive the names of the people they count.
• Google Analytics and cookies. Our website uses Google Analytics to count visits. Google Analytics cookies are set only if you accept them in our cookie banner, and you can change your choice there at any time. Until you accept, our pages tell Google only that a page was viewed, without cookies and without anything that identifies you.
• Jobs on Google. We mark our public job adverts so that Google can show them in its job search, and we tell Google when a public job advert is added, changed or removed. This is information about the job only: it contains nothing about candidates.
• Google's own use. The form, our channel, our videos and our business profile are part of Google's services, so Google also processes what you enter or post there, under the Google Privacy Policy. Our own connection to YouTube and Google is made by our staff signing in with the company's Google account; that access can be removed at any time on the Google security settings page.

4.13 Employer, Domestic Worker Office, Recruitment Agency and EU Work Permit Specialist accounts on WhatsApp

An employer can create and run an employer account by messaging our WhatsApp number. A Domestic Worker Office can do the same for its own account. This section explains what happens to your information when you do. Everything below applies to a Domestic Worker Office in the same way: where it says "employer" or "company", read your office.

• Creating the account. The assistant asks for your name, your company's name, your email address and your company's registration number. If you give an email address, we email you a code to confirm it is yours. If you have no email address, you can skip it: your account is then tied to the WhatsApp number you are chatting from, you log in with that number, and the link to choose your password is sent to you in the chat. The link works once, for 60 minutes. We never ask for your password in the chat.
• Creating the account from a business card or a voice note. Instead of answering those questions one by one, you can send a photo or PDF of your business card or company profile, send a voice note, or type the details in one message. We use AI (OpenAI) to read your name, your company's name, its registration or trade licence number and an email address from it, together with the company details used for your profile. We show you what we read, and nothing is created until you press "Create account". We do not store the file or the voice note: only the details you confirm are saved, and a logo cut from the card may be saved as your company logo. Please do not send a passport or personal identity card. If one is detected, we do not read it or keep anything from it. An account created this way has no password: you log in on our website with a code we send to your WhatsApp number, and you can set a password at any time. If you confirm an email address with the code we email you, you can log in with it as well; otherwise it is kept only as your company's contact email.
• Posting before your documents are checked. Where this is switched on, you can complete your profile and post jobs before your verification documents are approved. Those jobs are saved but are not shown to anyone until our team has approved your documents; they then go live.
• Your account's progress. When you message us from the number verified on your employer account, the assistant tells you the step your account is at (for example "upload your company documents" or "under review") and gives you the link for it. Your verification documents are uploaded on our website, not in the chat.
• Completing your company profile. You can send a photo or PDF of a company document (such as a company profile, letterhead or business card), or type the details. We use AI (OpenAI) to read the company details from it and fill in your profile. We do not store the file: it is read in memory and discarded, and only the details you confirm are saved. Please do not send a passport or personal identity card. If one is detected, we do not read it or keep anything from it. If you send a logo as a photo, we save it as your company logo. The same reading is offered on our website: on the page where you complete your company profile you can upload a company card or a company profile PDF. We read it with AI (OpenAI), show you the details we found together with a logo and a banner we prepared from it, and save only what you confirm. We do not store the file you upload.
• Posting a job. You can send a job advert as a message, a voice note, a photo or a PDF. We use AI (OpenAI) to turn it into a draft job and show it to you. Nothing is published until you press "Publish job". Before a job from the chat is published, an automated check looks for wording we do not allow: a preference by age, gender, religion, nationality or family status, a fee charged to the worker, a guaranteed job or visa, or a request for identity or bank details. If the check flags the job, it is not published and a person from our team reviews it. You are told why, and you can change the wording.
• Jobs posted by a Domestic Worker Office. From an advert a Domestic Worker Office sends, we also read the details of the household the worker would join, when the advert states them: the size of the household, the number of children, whether the work includes care for an elderly person, any special care the work involves, whether the worker lives in or out, and the languages the worker should speak. They are shown to you before you publish, and they appear on the job. Please describe the care that is needed, not a person: do not name anyone or state a medical diagnosis. If the advert states a preference by gender, age, religion or nationality, we do not publish that preference. We show you the same job without it, and it is published only if you press "Publish job" for that version.
• Recruitment Agencies. A Recruitment Agency can create and run its agency account on WhatsApp in the same way: where this section says "employer" or "company", read your agency, and what section 5 says about employer accounts on WhatsApp applies to an agency's account in the same way. Three things differ. First, your agency's recruitment licence number is always required: we read it from the business card or the details you send when it is there, we ask you for it when it is not, and the account is not created without it. It is your agency's business licence, not a personal document. Second, before a job you send in the chat is published we ask who may see it: everyone, approved recruitment agencies only, or only the agencies assigned to the job. Your choice is saved with the job, as it is on our website. Third, where posting before your documents are checked is switched on for agencies, you can post jobs before your agency's documents and licence are approved (they are saved and shown to nobody until then); the rest of your agency account opens after that approval. The box for the messages described next says "my Recruitment Agency account".
• EU Work Permit Specialists. An EU Work Permit Specialist can create and run its account on WhatsApp in the same way as an employer: where this section says "employer" or "company", read your EU Work Permit Specialist business, and what section 5 says about employer accounts on WhatsApp applies to your account in the same way. Your registration number is optional, as it is for an employer. A job you post is seen, and can be applied to, only by EU Work Permit Seekers, as on our website. Where posting before your documents are checked is switched on for EU Work Permit Specialists, you can post jobs before your documents are approved (they are saved and shown to nobody until then). The box for the messages described next says "my EU Work Permit Specialist account".
• Messages we send you. If you choose "Create with alerts" when you create your account, or tick "Send me WhatsApp messages from Career Workforce about my employer account, my jobs and new applications" in your settings (for a Domestic Worker Office the box says "my Domestic Worker Office account"), we send to your verified WhatsApp number: that your documents were received, that your account was approved or that new documents are needed, that your job is live, and that you have new applications (grouped, at most one message an hour for each job). These messages contain your name, your company's name, a job title and a number of applications. They never contain documents, identity details or payment details. The choice is never made for you. To stop them, untick the box or reply STOP (see section 4.3). Your dashboard notifications are not affected.

4.14 Labour Supply Offices and the workers they supply

Where the Labour Supply Office service is available, a licensed company that supplies its own workforce to employers (a "Labour Supply Office") can keep a private pool of its workers on CareerWorkforce, answer employers' workforce requirements with offers, and source more workers through recruitment agencies and agents. This section explains how that information is handled.

• Who decides. For the workers in its pool, the Labour Supply Office is the controller: it decides why and how their information is used. We process that information on the office's behalf, on its instructions and only to provide the service it uses. For the office's own account, and for employers' and agencies' accounts, we are the controller as described in the rest of this policy. Workers in a pool do not have a CareerWorkforce login; if you are such a worker, please send requests about your information to the office that holds it, and we will help the office answer them. You can also write to us at info@careerworkforce.com.
• What an office may hold about a worker. Name, nationality, date of birth, trade and skills, experience, languages, availability, current location, visa status, and documents such as a passport, work permit, trade certificate or medical result. Passport and identity numbers are stored encrypted. To stop one worker being offered twice, including by two different offices, we keep a one-way fingerprint of the passport number, from which the number cannot be read back. Documents are kept in private storage, opened only through short-lived links, and every view or download is logged.
• What employers see. Before selection, an employer sees a masked profile (trade, experience, skills, languages, availability and similar details), never the worker's name, contact details, photograph or identity numbers. Only after the employer selects a worker are the details needed for the deployment and the visa shared with that employer.
• Sourcing through agencies and agents. When an office asks a recruitment agency, agent or another office to propose workers, that party sends candidates' details to the office for that request only. For candidates from Pakistan, the receiving agency's overseas employment promoter licence number and the demand's attestation status are recorded.
• AI. Where AI features are switched on, matching, drafting and summaries use pseudonymised information: names, contact details and identity numbers are removed before anything is sent to our AI provider (OpenAI). A person at the office or the employer makes every selection decision. As section 4.7 says, nothing is used to train AI models.
• Records of activity. We keep an activity record (who changed what, and when) and an access record (who viewed or downloaded a worker's details or a document). These records cannot be edited. They protect workers and offices and help resolve disputes.
• Gender and age. A requirement can state a gender or an age range only where the law of the work country allows it and the employer gives a lawful reason; each such use is recorded.
• Transfers from the Gulf. Offices and employers are often in the United Arab Emirates or Saudi Arabia, and our servers are outside those countries (see section 8). Under the United Arab Emirates' Federal Decree-Law No. 45 of 2021 (Articles 22 and 23) and Saudi Arabia's Personal Data Protection Law (Article 29 and its regulation on transfers outside the Kingdom), personal data may leave those countries where the destination offers adequate protection or where appropriate safeguards are in place, such as a binding contract, or where another condition in the law applies. Our Terms with each office set out that we process its workers' information only on its behalf and on its instructions. Each office remains responsible for its own obligations under the law of its country, including registration or notification where that law requires it.
• WhatsApp. Where it is switched on, a Labour Supply Office can, from the WhatsApp number verified on its account, see its new requirements, decline one, check its offers and worker numbers, and reply to messages. Worker names and documents are never sent on WhatsApp.

4.15 TikTok

We have a TikTok account, we post videos and photos on it, and we may advertise jobs and our services on TikTok. This section explains what we receive from TikTok and what we do with it.

• TikTok lead forms. Some of our TikTok adverts open a form. If you choose to submit it, TikTok sends us what you entered: usually your name, phone number or email address, and your answers to our questions (for example the job or trade you are interested in). TikTok also tells us which advert, form and campaign it came from, and whether you ticked any consent box on the form. Nothing is sent to us unless you press Submit. Our adverts are not aimed at anyone under 18, and our forms never ask for your passport or identity number, your health, your religion or other sensitive information. Please do not type such information into a form.
• How we use your form. We contact you by phone or email about the jobs or services you asked about. We message you on WhatsApp, or send you job alerts, only if you ticked the box for that on the form. You can withdraw that at any time (see section 10). Your form goes straight into our customer-relationship system, which runs on our own servers, and only our staff can see it. A person reads it: we do not send it to any AI service and we do not use it to make any automated decision about you. We do not sell it, and we do not pass it to an employer unless you later apply for a job or agree to us putting you forward.
• Comments on our TikTok videos and photo posts. When you comment on one of our posts, TikTok tells our customer-relationship system within a few minutes. We receive your comment, your TikTok name and user name, a reference number that TikTok gives to you for our account, the time, and which post it is on. We do not receive your profile picture. Our staff read the comments and answer them as our account. A member of staff can also like a comment or hide it from public view.
• Automated replies to comments. We may answer a comment automatically, and when we do:
  • It says so. Every automated reply ends with a line saying that it is an automated reply, and that you can reply "speak to a human" to talk to a person.
  • Approved answers only, and no AI. The reply is an answer our team wrote and approved in advance for that kind of question. It is chosen by matching the words of your comment against the questions our team approved. It is not written by AI, and your comment is not sent to any AI service. It is general information, not legal, immigration or financial advice. If we have no approved answer, you are upset or you ask for a person, no automated reply is sent and a person answers.
  • Few and never repeated. We send an automated reply only to a comment that everyone can see, at most once to a person on one post, and never once a person has answered. We also limit how many automated replies we send in an hour, so that they are never sent in bulk. We never use automated replies to advertise to you.
• Direct messages. We do not receive the direct messages sent to our TikTok account in our own systems. Our team answers them in the TikTok app.
• What we never do. We never turn someone who views, likes, follows or comments on our TikTok account into a lead, and we never contact you because you did. We do not build profiles of the people who comment, and we never use a comment to target adverts at you or at people like you. We never collect information about people who comment on or follow other accounts.
• What we keep. We keep a comment and our replies to it for 12 months, then delete them automatically. If you delete your comment on TikTok, we replace its words with a note that it was deleted. We delete a whole conversation sooner when you ask (see section 11).
• Statistics. TikTok gives us statistics about our posts and our adverts: for example how many people watched a video, how many liked, commented on or shared it, how much an advert cost and how many forms it brought. These are totals only. They do not identify anyone and we do not receive the names of the people they count.
• Our posts. Our staff write our posts. They are sent to our TikTok account from our customer-relationship system only when a person presses the button, and a post that promotes our own business is marked as promotional content, as TikTok asks.
• TikTok's own use. Our account, our adverts, our forms and your comments are part of TikTok, so TikTok also processes what you enter or post there, under TikTok's Privacy Policy. Our connection to TikTok is made by the holder of our account approving it, and that access can be removed at any time in the TikTok app under Settings and privacy, Security, Manage app permissions.

4.16 Our customer-relationship system: forms, business contacts and how we handle them

Our customer-relationship system runs on our own servers and only our staff can see it. Sections 4.1 to 4.15 explain what it receives from each channel. This section explains what it does with that information, and what else it keeps.

• Forms on our own pages. We may publish a page with a form at careerworkforce.com. If you submit it, we receive what you typed (usually your name and your email address or phone number), the page and the version of the form you saw, the link or advert that brought you (its campaign identifiers), the time, and which consent boxes you ticked together with the exact words you saw next to them. A form never asks for more than it shows. Submitting a form does not by itself send you any message. A hidden field, a minimum time to fill the form in and limits on how often one address can submit protect it from spam. If a form shows an "I'm not a robot" box, Google reCAPTCHA checks it, under Google's Privacy Policy.
• Business contacts. For employers, agencies and other organisations we keep the details of the people we deal with: name, job title, work email address and phone number, company, country, and notes our staff write about our dealings. They come from a form, from the person, or from a list our team has the right to use: a list we import must say where it came from and what the people agreed to, and we never send marketing to people on a bought or scraped list. We keep a contact while we deal with the organisation.
• The same person twice. To avoid contacting you twice, our system compares phone numbers and email addresses to spot a possible duplicate. A member of staff looks at it and decides. Nothing is merged automatically.
• Where you came from. We keep with your lead the first and the latest campaign, advert or link that brought you to us, and each later one, with the time, to see which of our adverts and posts work (see also section 4.9).
• Who answers you. When a new lead arrives, our system can assign it to a member of our team by rules: the country, the trade, the kind of user, where the lead came from, and how many open leads each person has. This decides only who answers you. It decides nothing about you, and a person always decides what to do.
• Your choices are kept. We record what you agreed to: what for, how you gave it, when, and the wording you saw. If you unsubscribe, send STOP or tell us you do not want to be contacted, we add a one-way code of your email address or phone number to a do-not-contact list, so that we do not message you again, even if your other details are deleted. We also keep a log of each message our system sends (the channel, the purpose, the time and a one-way code for the recipient) and of each message it decided not to send, so that we can show that we respected your choices.
• Email we send. We send marketing email only where the law allows it and you have not opted out. Every marketing email has an unsubscribe link and our postal address, and may use your first name or your company name.
• Asking for your information online. You can ask for a copy of the information our customer-relationship system holds about you, or ask us to delete it, at careerworkforce.com/crm-api/api/v1/privacy/request. If you give an email address we hold, we email you a code to check that it is you; the code works once and expires after 10 minutes. Then you can download a copy of your information through a link that works for 30 minutes, or we record your deletion request. If you give a phone number instead, a member of staff calls you to check. A person carries out every deletion, and we reply within one month.

4.17 Calls to our WhatsApp number

• An AI assistant answers. When you call our WhatsApp number, the call may be answered by Sophia, our AI voice assistant. She tells you at the start that she is an AI and that the call is recorded. She answers only from information our team has approved, can tell you about jobs that are live on our website, and can ask our team to call you back. She never asks for passwords, codes, or passport, bank or card numbers.
• Calls are recorded. We record the call (the audio) and keep a written transcript of what was said. We use them to handle what you asked for (for example a call-back), to check the quality of the answers, to train our staff, to improve the answers our team approves, and to prevent and investigate misuse. Only authorised staff can listen to a recording or read a transcript, in our admin system and our customer-relationship system. We do not use recordings or transcripts to train any AI model (section 4.7).
• What we keep with a call. Your WhatsApp number and profile name, the time and length of the call, how it ended, any call-back reference, the recording and the transcript. If your WhatsApp number is linked to a CareerWorkforce account, our staff can see which account it is.
• Who processes your speech. Your speech is sent to OpenAI, as our processor, so the assistant can understand and answer you in real time. OpenAI may not use it to train its models.
• Messages about your call. Because you called us, WhatsApp lets us message you for 24 hours. We use this only for messages about your call: confirmation of a call-back request with its reference, a short thank-you with a link to our website after the call, and a notice if you were warned or blocked.
• Misuse. Abusive or sexual language, threats, attempts to misuse the assistant, or repeated silent calls can lead to a warning, the end of the call and a block of up to 24 hours from the assistant on calls and in the WhatsApp chat. A warning or a block is also sent to you as a WhatsApp message, with the time the block ends. Sending STOP and asking to delete your data always still work.
• How long, and deleting it. Recordings and transcripts are deleted automatically after 90 days. To have them deleted sooner, send "delete my data" in our WhatsApp chat or email info@careerworkforce.com with the subject "Delete my WhatsApp data".

5. Our lawful bases

Sensitive information. We do not ask you to tell us about your health, religion, ethnicity or other special categories of information. The exception is where a destination country's visa process requires a medical result or a police clearance certificate. We then process it only for that visa step, with your explicit consent or where the law permits it for employment purposes, and we limit who can see it. Please do not include sensitive information in your CV unless it is needed for the job.

6. AI and automated processing

• We use automated tools, some powered by AI, to read CVs and job adverts, suggest matching jobs and candidates, and translate CVs when you ask us to. A person at the employer or agency makes every hiring decision.
• Some vacancies have mandatory requirements set by the employer, such as a minimum amount of experience or a valid passport. If our system stops you applying because a requirement appears to be unmet, the reason is shown on screen. You can ask a person to review it by emailing info@careerworkforce.com, and you can tell us why you think the decision is wrong.
• We do not use your information to train AI models, and our AI providers may not use it to train theirs.
• Our website assistant, our WhatsApp number and our replies to Facebook and Instagram messages choose an approved answer by matching the words of your message against the questions our team approved. If the match is weak, or you ask for a person, the assistant does not answer: our team is told and a person replies.
• Our staff may use AI tools to draft posts, replies and email text, and to make pictures, voice-overs and short videos. Before any text goes to our AI provider we remove names, email addresses and phone numbers from it. A person reads every draft and decides whether to use it: the AI never publishes or sends anything by itself. We keep drafts nobody used for 90 days, then delete them. What we publish that AI wrote or made is labelled, with a short line or the platform's own AI label, and every AI-made video shows "AI-generated" on screen.

7. Who we share information with

We do not sell personal information. We share it only as follows:

• Employers, agencies and agents you apply to, or that you or your recruiter propose you to. They receive your profile and application documents and become responsible for how they use them.
• The OGS Group's licensed overseas employment promoter in Pakistan, where you are recruited through it for employment abroad, together with the Pakistani authorities that recruitment legally requires (such as the Bureau of Emigration and Overseas Employment and the Protector of Emigrants).
• Embassies, consulates and immigration or labour authorities, where a visa or work-permit process you have started requires it.
• Service providers who process information for us under contract and only on our instructions:
  • Hostinger: website and database hosting (servers in India)
  • Meta: WhatsApp Business Platform, for passcodes and WhatsApp messages
  • OpenAI: AI processing through its API, used for CV reading, translation, matching, voice-note transcription, selecting approved answers and understanding a Facebook or Instagram message (section 4.8). Under its API terms OpenAI does not use API data to train its models, and it keeps it for up to 30 days for abuse monitoring.
  • OCR.space (a9t9 software GmbH, Germany): reading text from images. Uploaded files are deleted after processing.
  • Brevo (France) and Resend (United States): email delivery
  • Stripe and other payment providers shown at checkout: payments and refunds
  • Google: sign-in with Google and push notifications, if you use them, and Google Analytics, if you accept its cookies
  • IPQualityScore (United States): fraud and abuse checks on sign-ups and support requests
• Our customer-relationship system, which runs on our own servers and is operated by us, holds callback requests and leads, including Facebook, Instagram, LinkedIn and Google lead forms.
• Meta, when you use one of our Facebook or Instagram lead forms: the form is part of Facebook or Instagram, so Meta processes what you enter under its own privacy policy before sending it to us (see section 4.8).
• LinkedIn, when you use one of our LinkedIn lead forms or comment on our LinkedIn posts: these are part of LinkedIn, so LinkedIn processes what you enter under its own privacy policy before sending it to us (see section 4.10). We never upload lists of people, contact details or lead information to LinkedIn.
• Google, when you use one of our Google Ads lead forms, comment on our YouTube videos or review our business on Google: these are part of Google's services, so Google processes what you enter under its own privacy policy before sending it to us (see section 4.12). We never upload lists of people, contact details or lead information to Google.
• TikTok, when you use one of our TikTok lead forms or comment on our TikTok posts: these are part of TikTok, so TikTok processes what you enter under its own privacy policy before sending it to us (see section 4.15). We never upload lists of people, contact details or lead information to TikTok, and we never send TikTok comments or lead forms to any AI service.
• Professional advisers, courts, regulators and law enforcement, where the law requires it or where it is necessary to protect our users or to establish or defend legal claims.
• A buyer or successor if our business is sold or restructured, subject to this policy.

8. International transfers

Recruitment on CareerWorkforce is international, so your information is transferred outside the United Kingdom, including to India (our hosting provider's servers), the United States (some of our service providers), the European Union, Pakistan (the OGS Group), and the country of the employer you apply to.

When we transfer information outside the UK, we use a lawful transfer mechanism: a UK adequacy regulation (for example for the EU, or for US companies certified under the UK Extension to the EU-US Data Privacy Framework), or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Sharing your application with an employer abroad that you have chosen to apply to is necessary to perform the service you asked for. Transfers out of the United Arab Emirates and Saudi Arabia for Labour Supply Offices are explained in section 4.14. You can ask us for a copy of the relevant safeguards at info@careerworkforce.com.

9. How long we keep information

We may keep information for longer where we must by law, or where it is needed for a legal claim or an investigation of fraud. We keep it only for as long as that reason lasts.

10. Your rights

Under UK data protection law you have the right to:

• access your personal information and get a copy of it;
• correct inaccurate or incomplete information;
• erase your information in certain circumstances;
• restrict how we use it in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability, to receive information you gave us in a machine-readable format;
• withdraw consent at any time, where we rely on consent;
• not to be subject to a decision based solely on automated processing that significantly affects you, without the safeguards described in section 6.

To use any of these rights, email info@careerworkforce.com. We will reply within one month. We may need to confirm your identity first. There is no fee.

11. How to delete your data

Website account. Candidates, employers, agencies and domestic worker offices can delete their account themselves: sign in, open Settings, and choose Delete account. Agents and referral partners, and anyone who cannot sign in, can email info@careerworkforce.com from the email address on the account with the subject "Delete my account".

WhatsApp data. To delete the information we hold from your WhatsApp conversations with us, email info@careerworkforce.com with the subject "Delete my WhatsApp data". Tell us the WhatsApp number you used. Or send "delete my data" in our WhatsApp chat (+44 7473 070244) and confirm: we then erase the text of your messages and transcripts, your WhatsApp name, the link to your website account and any unfinished form straight away. Copies shared with our team for a call-back request (including our CRM) are deleted within one month. We confirm by email or WhatsApp. For up to 90 days we keep a technical record without any message content (message times and delivery status), which we need to prevent abuse of our WhatsApp number, and we keep a minimal opt-out record if you asked us to stop messaging you, so that we keep respecting that choice. Deleting your website account is a separate request (see above). Sending STOP stops our messages but does not by itself delete your data.

Facebook and Instagram lead forms. To delete what you sent us in one of our lead forms, email info@careerworkforce.com with the subject "Delete my lead form data". Tell us the name, email address or phone number you entered. We delete it from our customer-relationship system within one month and confirm by email. If you do nothing, it is deleted automatically after the period in section 9. What Facebook or Instagram keeps about your use of their services is managed in your Facebook or Instagram settings.

Facebook and Instagram messages. To delete a conversation you had with our Facebook Page or Instagram account, email info@careerworkforce.com with the subject "Delete my message data" and tell us the name your Facebook or Instagram account uses. We delete it from our customer-relationship system within one month and confirm by email. What Facebook or Instagram keeps is managed in your Facebook or Instagram settings.

LinkedIn lead forms and comments. To delete what you sent us in one of our LinkedIn lead forms, email info@careerworkforce.com with the subject "Delete my lead form data" and tell us the name, email address or phone number you entered. We delete it from our customer-relationship system within one month and confirm by email. If LinkedIn tells us that a form you sent has been deleted, we erase it automatically. If you do nothing, it is deleted automatically after the period in section 9. Comments on our LinkedIn posts are cleared automatically as described in section 9, and you can delete a comment yourself on LinkedIn at any time. What LinkedIn keeps about your use of LinkedIn is managed in your LinkedIn settings.

TikTok lead forms and comments. To delete what you sent us in one of our TikTok lead forms, or a conversation about a comment you made on our TikTok posts, email info@careerworkforce.com with the subject "Delete my TikTok data" and tell us the name, email address or phone number you entered, or the TikTok name you commented with. We delete it from our customer-relationship system within one month and confirm by email. If you do nothing, it is deleted automatically after 12 months (see section 9). What TikTok itself holds is deleted through TikTok: we cannot do that for you, and TikTok does not tell us when you delete a form on TikTok, so please tell us as well.

Our customer-relationship system. To ask for a copy of what our customer-relationship system holds about you, or for it to be deleted, use our privacy request page or email info@careerworkforce.com with the subject "Delete my data". We reply within one month. To keep honouring an opt-out, we keep a one-way code of your email address or phone number on our do-not-contact list; we cannot read your address or number from it.

Sign-in with Google or another provider. Deleting your CareerWorkforce account removes the information we received from that provider. You can also remove CareerWorkforce's access in that provider's account settings.

We keep only what the law requires us to keep (see section 9).

12. Complaints

If you are unhappy with how we have handled your personal information, please tell us first at info@careerworkforce.com with the subject "Data protection complaint". We will acknowledge your complaint within 30 days and investigate and respond without undue delay.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live outside the UK, you may also be able to complain to the data protection authority in your country.

13. Security

We use technical and organisational measures to protect personal information. These include encrypted connections (HTTPS), hashed passwords, role-based access for our staff, two-factor authentication for administrators, encryption of stored WhatsApp message content, private storage for files sent to us on WhatsApp, and activity logging. No system is completely secure. Please use a strong, unique password and never share your passcode with anyone, including anyone claiming to be from CareerWorkforce.

14. Children

CareerWorkforce is for people aged 18 or over. We do not knowingly collect information about anyone under 18. If you believe a child has created an account, please contact us and we will delete it.

15. Other websites

Our pages may link to websites and services run by others, including employers. Their own privacy policies apply to them.

16. Changes to this policy

We will update this policy when our services or the law change. The effective date at the top of this page shows when it last changed. If we make a significant change, we will tell registered users by email or with a notice on the platform before it takes effect.

17. Contact us

• OGS CAREER WORKFORCE LIMITED, company number 17393127, registered in England and Wales
• Registered office: 5 Siu Offices, 4-6 Greatorex Street, London E1 5NF, United Kingdom
• Email: info@careerworkforce.com
• WhatsApp: +44 7473 070244