Legal

Privacy Policy

Effective date: 1 January 2026 · Applies to thedifference.work

This Privacy Policy explains how TheDifference ("TheDifference", "we", "us" or "our") collects, uses, discloses and protects personal data when you visit thedifference.work (the "Site"), engage our talent services as a client company (a "Client"), or apply to work through us as a specialist (a "Specialist"). It also describes the choices available to you regarding our use of your personal data and how you can access and update that information.

TheDifference operates an engagement platform: we introduce Clients to vetted independent professionals, formalise each engagement through a documented order, process engagement fees through a third-party payment processor, and issue official receipts. We are the data controller for the personal data described in this Policy.

1. Data We Collect

We collect the following categories of personal data depending on how you interact with us:

Account and enquiry data. When a Client registers we collect the company name, contact person, work email address, telephone number, country and a password stored only as a cryptographic hash.
Contact enquiries. When you write to us through the contact page or by email we collect your name, email address and the content of your message, together with the date and time it was received.
Application data. When a Specialist applies, we collect their full name, email address, telephone number, role title, a summary of skills and certifications, and the resume document they upload.
Engagement data. For each order we retain the project designation, descriptive title, description, required qualifications, hours, hourly rate, total amount, currency, status, timestamps and processor transaction references.
Payment and billing data. Payments are processed by our payment processor. We do not receive or store card numbers. Where a payment is completed, the processor shares with us the payer's name, email address, billing address, the card brand and last four digits, and transaction identifiers, which appear on the official receipt.
Technical data. Like most websites, our infrastructure logs request details such as IP address, browser type, referring page and timestamps for security and reliability purposes.

2. How We Use Personal Data

We use personal data to:

operate client accounts and authenticate access to the company portal;
receive, review and respond to contact enquiries;
evaluate Specialist applications against current and upcoming engagements and, where candidates qualify, contact them about the next step;
create orders, issue secure payment links, reconcile payments and generate official receipts;
maintain an auditable record of each engagement from posting through payment to receipt;
detect, prevent and investigate fraud, abuse, unauthorised access and other unlawful activity;
comply with legal, tax, accounting and regulatory obligations; and
understand aggregate usage of the Site so we can improve clarity, performance and reliability.

We do not sell personal data, and we do not use personal data for third-party advertising. We do not build behavioural profiles of visitors or applicants for marketing purposes.

3. Legal Bases for Processing

Where the General Data Protection Regulation or similar laws apply, we rely on the following legal bases: performance of a contract when we create accounts, formalise engagements and process payments; legitimate interests when we secure the Site, maintain business records and defend legal claims; consent when you submit an application or send us an enquiry, which you may withdraw at any time; and legal obligation where retention is required by tax, commercial or accounting law.

4. Sharing and Disclosure

We share personal data only with the following recipients, under contracts that restrict their use of the data:

Payment processor. Card data is collected directly on the processor's hosted checkout page under its own privacy terms. We receive only the confirmation and billing details needed for receipts.
Infrastructure providers. Hosting, storage and logging providers that operate this Site on our instructions.
Professional advisers. Accountants, auditors and lawyers bound by confidentiality.
Authorities. Where disclosure is required by law, regulation, court order or to protect the rights, property or safety of TheDifference, our clients or the public.

A Client's engagement details (title, description, qualifications, rate and totals) may be shown internally to our engagement desk staff who need them to scope and administer the work. They are never published publicly.

5. Cookies and Similar Technologies

We use a strictly limited set of technologies:

Session cookies — essential cookies that keep you signed in to the company portal and protect forms against cross-site request forgery. These expire when the browser closes or after a short period.

We do not use advertising cookies, social-media pixels, or third-party analytics trackers. You can clear or block cookies in your browser settings; blocking session cookies will prevent sign-in from functioning.

6. International Transfers

Where personal data is transferred across borders, including transfers originating in the European Economic Area or the United Kingdom, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses, and we take steps proportionate to the risk of each transfer.

7. Retention

We keep personal data only as long as necessary for the purposes above:

Order, payment and receipt records: retained for up to seven (7) years after completion of the engagement, consistent with commercial, accounting and evidentiary requirements. These records form part of the chain of custody for each engagement and are intentionally durable.
Client accounts: retained while the account is active and for twenty-four (24) months thereafter, then deleted or anonymised, except where orders require longer retention.
Contact enquiries: retained for twenty-four (24) months from the last message in the thread.
Specialist applications and resumes: retained for up to eighteen (18) months so that candidates can be considered for later engagements, unless the candidate asks us to delete them sooner.
Security logs: retained for up to twelve (12) months.

8. Your Rights

Subject to applicable law, you have the right to:

request a copy of the personal data we hold about you;
ask us to correct inaccurate or incomplete data;
ask us to delete personal data where there is no overriding legal basis to retain it;
object to processing based on legitimate interests and ask us to restrict processing while a dispute is resolved;
where processing is based on consent, withdraw that consent at any time; and
receive, in portable form, data you provided to us where processing is carried out by automated means.

To exercise any right, write to hello@thedifference.work. We will verify your identity where necessary and respond within thirty (30) days. If you believe our processing infringes data protection law, you may lodge a complaint with your local supervisory authority.

9. Security

We apply defence-in-depth measures appropriate to the sensitivity of the data: encryption of traffic using TLS; passwords stored only as bcrypt hashes with per-user salts; parameterised database queries throughout; least-privilege access controls for administrative functions; signature-verified webhooks from our payment processor; upload scanning with type allow-lists; private storage of resume documents behind authenticated endpoints; and security logging. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but we treat any incident seriously and will notify affected individuals and regulators as required by law.

10. Children's Privacy

The Site is intended for businesses and working professionals. We do not knowingly collect personal data from anyone under sixteen (16) years of age. If you believe a minor has provided us personal data, contact us and we will delete it.

11. Automated Decision-Making

We do not make legally significant decisions about individuals solely by automated means. Application reviews and engagement scoping involve human judgement by our engagement desk. System-generated values such as order numbers, project designations, and derived rates and hours are administrative identifiers, not evaluations of individuals.

12. Changes to This Policy

We may update this Policy to reflect changes in law, technology or our practices. The effective date above shows the current version. Material changes will be announced on the Site for a reasonable period before they take effect.

13. Contacting Us

TheDifference is the controller for the processing described here. Questions, requests or complaints can be directed to hello@thedifference.work, or by post addressed to our registered office care of the domain thedifference.work. We aim to acknowledge every privacy enquiry within two (2) business days.