GDPR Notice

Trust Squared is the data controller for personal data collected through trust-squared.site. As data controller, we determine the purposes and means by which your personal data is processed.

You may contact us regarding any data protection matter at:

We process the following categories of personal data:

• Basic identity data: full name, email address, phone number, country, and region
• Professional data: field of expertise, credentials, years of experience, career summary, LinkedIn URL
• Identity documents: government-issued photo ID (driver's licence or passport), selfie photograph
• Uploaded documents: CV or resume
• Technical data: IP address, browser information, and session data collected automatically

Identity documents are classified as sensitive data under our internal handling policy and are subject to additional access controls and encryption measures beyond our standard data security practices.

We rely on the following legal bases under Article 6 and Article 9 of the UK/EU GDPR:

• Article 6(1)(b) — Contractual necessity: processing your application data is necessary to take steps prior to entering into a contributor agreement
• Article 6(1)(f) — Legitimate interests: verifying eligibility, maintaining platform security, and preventing fraud
• Article 6(1)(a) — Consent: for processing your identity documents and biometric-adjacent data (selfie with ID). You may withdraw consent at any time without affecting the lawfulness of prior processing
• Article 6(1)(c) — Legal obligation: where processing is required to comply with applicable law

We apply the following retention schedules:

• Unsuccessful applications: personal data and uploaded documents are deleted within 12 months of the application decision
• Approved contributors: data is retained for the duration of the contributor relationship and for 3 years thereafter, in line with standard contractual limitation periods
• Identity documents: deleted within 6 months of identity verification being completed, unless a longer period is required by law
• Financial records: retained for 7 years as required by tax legislation
• Technical logs: retained for 90 days for security purposes

As a UK or EU resident, you have the following rights. We will respond to all requests within one calendar month.

To exercise any of these rights, email support@trust-squared.site with the subject “Data Rights Request” and we will respond within 30 days.

Personal data may be stored and processed in the United States (via our cloud infrastructure providers). Where we transfer data outside the UK or EEA, we rely on one or more of the following safeguards:

• UK adequacy regulations under section 17A of the Data Protection Act 2018
• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO
• The International Data Transfer Agreement (IDTA) for transfers from the UK

Copies of the applicable safeguards are available on request by emailing us.

We do not make solely automated decisions — including profiling — that produce legal or similarly significant effects on individuals. All application assessments involve human review before any decision is communicated to you.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• AES-256 encryption of all files at rest
• TLS encryption for all data in transit
• Role-based access controls limiting data access to authorised personnel only
• Regular access logging and security reviews
• Credential rotation policies for all system integrations

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the ICO or relevant supervisory authority within 72 hours.

If you are based in the United Kingdom, the relevant supervisory authority is:

If you are based in the EU, you have the right to complain to the data protection authority in your member state.

We may revise this GDPR Notice from time to time to reflect changes in law, our processing activities, or our business practices. The date at the top of this page will always reflect when the notice was last updated. For significant changes affecting your rights, we will provide direct notification by email.