Privacy and Data Processing Policy

YourStaffGY is a recruitment and workforce placement service operated by Talent Force Solutions in Guyana. Talent Force Solutions is the party responsible for the personal information described in this policy, and is the party you contact to exercise the rights in section 13.

We process personal information subject to the law of the Co-operative Republic of Guyana, including the Data Protection Act 2023.

This policy covers the YourStaffGY website and the recruitment, unlock, verification, placement, promotional, immigration and support services provided through it. It applies to candidates, employers and the people acting for them, to people whose details someone else entered (see section 7), and to visitors who never create an account.

Where an employer receives your information from us, that employer becomes responsible for what it then does with it. Where you send information to a government authority through us, that authority is responsible for its own use of it.

The detail of each category, what it is used for and on what legal basis is in section 5. This section explains how information reaches us, because that is what determines whether you knew about it.

Each row is a category of information, what we do with it, and the legal basis we rely on. Where the basis is your consent, you can withdraw it (section 13) — that stops the processing going forward, and does not make what was lawfully done before it unlawful. Where the basis is our legitimate interest, you can object and we will weigh it against your reasons.

What we do not do with any of it: we do not sell personal information, we do not rent or share it for advertising, and we do not use it to build profiles for anyone other than the recruitment purposes described above.

Some of the information we hold is about people who never created an account and never accepted anything, because somebody else entered it. This section is for them.

• Immigration agents, representatives and sponsors, entered by an employer to register its sponsorship chain: business and contact details, and identity document numbers.
• Accompanying family members, entered by a work permit applicant: name, relationship, nationality, date of birth and passport number. This can include children.
• The responsible person of a company, whose identity document an employer uploads so that we can verify the company.
• Referees and former employers, whose answers we record during a verification.
• People named in free text — in a CV, a support message or an explanation box — by whoever wrote it.

If somebody entered your details and you did not agree to it, the whole of section 13 is available to you exactly as it is to our users. You do not need an account to use it, and you do not need the permission of whoever entered them. Write to us through the channels in section 17 and tell us what was entered and by whom, as far as you know.

Whoever enters another person's details into YourStaffGY is responsible for having a lawful reason to do so, and our Terms require it. That responsibility does not remove ours, and it is not a reason for us to refuse your request.

One case where we deliberately hold less: when an employer invites a candidate who is not in our directory, we store only a one-way fingerprint of the contact used, never the name, email or phone in readable form, because that person has not registered or agreed to anything yet.

We use the following providers to run YourStaffGY. They process personal information on our instructions and for the purposes in section 5, and none of them is permitted to use it for its own purposes.

• Supabase — hosted database, authentication and document storage. Everything described in this policy is stored there.
• Cloudflare — hosting and delivery of the site, which involves request data such as your IP address and browser; and the automated inference service described in section 6, which receives the full text of CVs and profile free text.
• Resend — sending our emails: sign-in links, email verification and service notifications. It receives the recipient address and the content of the message.
• Google Fonts and a public asset network — these serve fonts and scripts used by our pages. Because your browser fetches them directly, they receive your IP address and browser details on page load, before you have logged in or agreed to anything. They do not receive your account data, your profile or your documents.

We also fetch currency exchange rates from a public service. Nothing personal is sent in that request.

All of these providers operate infrastructure outside Guyana, so your information is stored and processed outside the country. There is no way to use YourStaffGY without that transfer happening, and you should know it before you decide to use us.

If we add a provider that receives personal information, or change what an existing one receives, this section is updated before the change goes live.

We do not use advertising cookies, tracking pixels or third-party analytics. Nothing on this site follows you to another site.

What we do store in your browser:

• A session cookie once you sign in, which is what keeps you signed in. Signing out removes it.
• Your language and display currency choices, so the site opens the way you left it.
• Your light or dark theme preference, stored locally in your browser and never sent to us.
• If you use the support chat without an account, a random key that lets us show you the replies to your own conversation. It is not a name and is not linked to one.

All of these are necessary for the site to work or to remember a choice you made deliberately. You can clear them from your browser at any time; if you clear the session cookie you will be signed out, and if you clear the chat key you will no longer see an earlier anonymous conversation.

Separately, the providers in the last row of section 9 receive your IP address when your browser fetches fonts and scripts from them. That is not a cookie, and it happens on page load.

Our candidate registration accepts people from 16 years of age, because 16 is the minimum working age the service assumes. So a candidate profile may belong to a person who is 16 or 17.

A work permit application can also list accompanying family members who are children, entered by the applicant, including their date of birth and passport number.

We do not currently have a parental or guardian consent step for either case, and we are not going to describe one that does not exist. We are working out what that step should be. In the meantime, a parent or guardian can exercise every right in section 13 on behalf of a person under 18, including asking us to remove a profile, and we will act on it.

We do not knowingly register anyone under 16 as a candidate. If you believe we hold information about a child in a way that should not be, tell us through section 17 and we will look at it as a priority.

The measures that matter most here are structural rather than declarative:

• Access is enforced row by row in the database itself, not only in the pages. A page cannot show what the database will not release for that user.
• Your contact details and date of birth live in a separate table from your public profile, released only to an employer that purchased access, to you, or to our staff.
• Every document store is private. There is no public link to a CV, an identity document, a payment receipt, a permit document or even a profile photograph: each is served through a short-lived authorised link, so that a photograph blocked by moderation actually stops being visible.
• Passwords are stored only in hashed form; nobody at YourStaffGY can read yours. Traffic to the site is encrypted.
• Changes made through audited paths and every session in which staff accessed an account are recorded, and those records cannot be edited or deleted by anyone, including an administrator.
• Invited candidates who have not registered are stored as a one-way fingerprint of the contact used, not as a readable name, email or phone.

No system is beyond compromise, and we are not going to claim otherwise. If a security incident affects your personal information, we will tell you and the authority what happened, what information was involved and what we are doing about it.

Your part in this: keep your password to yourself, and do not upload documents that a form did not ask you for.

We update this page when what we do with personal information changes — a new provider, a new purpose, a new category of data, a retention period we can finally state. The date at the top tells you when it was last checked against our systems.

If a change means we would use your information for something materially new, or send it to someone new, we will tell you before it takes effect and, where the basis is your consent, ask you again. We will not extend an existing consent to a new purpose by editing this page quietly.

Corrections of wording that do not change what we do are made without notice.

Questions about this policy, and any request under section 13, go to Talent Force Solutions through the official YourStaffGY support channels identified on the platform. The support bubble is on every page, and the support page lets you open a ticket that leaves a record.

For a request about your rights, a ticket is better than a chat message: it is what gives you a written record of what you asked and when.

If your details were entered by somebody else and you have no account (section 7), use the same channels. You do not need to register to write to us about your own information.

You can also complain to the data protection authority in Guyana. You do not have to come to us first.

Do not rely on statements about privacy, your data or your rights made by anyone who is not an authorised YourStaffGY representative.