Privacy notice

Who we are

Hire the Best is a trading name of BishBosh Ventures Ltd, a company registered in England and Wales (company number 14699683), whose registered office is at 20–22 Wenlock Road, London N1 7GU. We are the controller of the personal data described here.

Contact us about your data at privacy@bishbosh.ai.

What Hire the Best is

A platform where hospitality and event venues find and book staff, and where staff build a profile that shows their experience and who vouches for them. Venues and staff agree work directly with each other. We do not employ staff and we never hold anybody's money.

What we collect, and why

Everybody with an account

• Name, email address, and phone number if you give one. To run your account, sign you in, and let the other side of a booking reach you.
• Profile photo, taken from your sign-in provider or uploaded by you.
• The version of our privacy notice and terms you accepted, and when.
• Messages you send in the app. Before a booking is confirmed, phone numbers and email addresses in messages are hidden automatically.
• Notifications we send you, and emails about invitations, confirmations, cancellations, shift reminders and references.
• A record of important actions (for example an administrator approving a check), kept for accountability.
• Notes our administrators write about you, for example after an in-person check or a support conversation. They are for our team and are not shown to you in the app, or to venues. They are deleted if your account is erased.
• Your IP address, each time you sign up, upload a file or change anything, to limit how often one connection can do so and so stop misuse. When you sign up while signed in, your sign-in identity is used instead. This is held only in the server's memory and never written to the database. Each count lasts at most an hour, and the entry is cleared when the server restarts or tidies its memory.

If you work shifts or keep a CV with us (staff)

• Your CV: headline, your story, the roles you do and your experience in them, your skills, and the past jobs you list (the venue, what you did, the town, when, and a line about it, in your own words). Venues who look at your profile see it.
• If you also want shifts: your hourly rate for each role, the postcode district you work from (not your full address), how far you will travel, and your availability. These are optional if you only want a CV.
• Identity check: the type of document you show us and a photo of it, which only you and our administrators can see. We check the original document in person before your first shift and record who checked it and when.
• Right to work in the UK: either the type of passport you hold with a photo of it, or your Home Office share code and date of birth, which we use to check your status on GOV.UK. We record the result, when your permission ends if it is time-limited, and who checked it.
• Certificates you upload (for example a personal licence or food hygiene) and their expiry dates.
• Your track record: shifts completed, whether you turned up, cancellations, the ratings and reviews venues leave you, and vouches from venues that know your work.
• Venue pools you are in. A venue can add you to its own list of people it likes to book, which can give you first sight of its shifts.
• A video of you, if you add one. Up to 30 seconds, with a still from it as its preview. Venues who look at your CV see it, and so does anybody with your public CV link if you turn that on. It is stored by Vercel. It is deleted when you remove or replace it, or your account is erased.
• Photos and links, if you add them. Up to six photos of you at work, and your Instagram, TikTok, LinkedIn or website. Venues who look at your CV see them, and so does anybody with your public CV link if you turn that on. Photos are deleted when you remove them or your account is erased.
• References you ask for. The job you ask about, and what the person says if they confirm. If we email them, the name and email address you give us; only ask somebody who has agreed to be contacted. If you send them a link yourself, on WhatsApp or anywhere else, we store nothing about them until they answer.
• Colleagues you ask back. If you confirmed somebody's job, you can ask them in the app to confirm one of yours. We tell them in the app, and they see your name and the job. You can only ask back people whose job you confirmed.

Your public CV link, if you turn it on

You can turn on a link to your CV that anybody can open, for example to send to a manager or put in your social media bio. It shows your name, photo, headline, story, past jobs, roles and skills, which of our identity and right-to-work checks you have passed, your video, photos and links if you have added them, confirmed references (the person's name, how they worked with you and what they said — never their email address), the shifts you have completed and your rating, and the names of the venues whose people vouch for you. It never shows your email address, phone number, where you are based or how far you travel, your rates, your availability, or any check you have not passed. We ask search engines not to list it. You can rename it or turn it off at any time, and the old link stops working straight away. Nobody else can ever use a link you have given up.

We count how many times your link is opened each day, and show you the total. We do not record who opened it: no IP address, cookie or other identifier is stored with the count.

If you run a venue (organisers)

• Your organisation's details, venues, events, the roles you need, the people you invite and book, the reviews you leave, and the colleagues you invite. If you invite a colleague who has no account yet, we hold their email address until they sign up or you cancel the invitation.
• If you vouch for somebody, the name of your organisation (not your own name) can appear on their public CV link, if they turn it on.

If you join the venue waitlist

Your name, your work email address, your venue or company, and who you hire if you tell us. We use them only to tell you when venues can hire on Hire the Best, and delete them after 12 months, or sooner if you ask.

If someone asks you for a reference

A worker may give us your name and email address and ask you to confirm that they worked with you. We use your email address only to send that request, and a thank-you with a link to take your reference back. If you confirm, we keep your name, how you worked together and anything you add, and show them on their CV under that job, marked as confirmed by email; we never show your email address. If you do not respond, the link expires after 14 days and the request is deleted 30 days after that. You can withdraw a reference you have given at any time, using the link in the email or by contacting us.

A worker may instead send you a link themselves. We know nothing about you unless you answer it. You can say you don't know them, or that the details are wrong, without telling us anything. To confirm, you sign in to Hire the Best or create a free account (with Google or an email code), so we know the confirmation really came from you and not from somebody the link was forwarded to. We then keep your name, your email address, how you worked together and anything you add, and show your name and words on their CV as above, never your email address. We show you a link to take your reference back; you can also ask us. If you go on to make a CV, we suggest the job you confirmed as your first one, and you can ask that worker to confirm yours.

We count how these links are used each day: links shared, answers given, and accounts made after confirming. The counts say how many, never who.

Safety reports and disputes

• If you report a safety concern or dispute a booking, we keep what you tell us and how it was resolved.

Our lawful bases (UK GDPR Article 6)

• Contract — running your account and the bookings you make.
• Legitimate interests — checking identity and the right to work in the UK before anybody can be booked, so that venues can rely on the people they book; keeping the platform safe and trustworthy (reliability records, reviews, vouches, safety reports, the audit trail); preventing misuse; and sending a reference request to the person a worker names. You can object; see "Your rights".
• Consent — your public CV link, video, photos and links, which you can turn off or remove at any time; and the venue waitlist, which you can leave by emailing us.

An identity document can show your nationality. We use identity and right-to-work documents only to confirm who you are and whether you can work in the UK. We do not use them to infer anything else about you, and we do not use facial recognition or any other biometric processing.

How matching uses your data

Matching works in two steps.

1. Eligibility filters. These are applied automatically.

A worker is left out of a venue's candidate list for a role, and that role is left out of the worker's list of open shifts, if:

• they don't work that kind of role;
• their identity or right-to-work check isn't complete, or their permission to work ends before the shift;
• they lack a certificate the role requires, or it will have expired by the shift;
• they lack a required skill, or have less experience than the role asks for;
• they aren't available for the whole shift, or are already booked;
• the venue is outside the distance they said they would travel;
• the booking would pay less than the minimum rate they set;
• their profile is hidden, or the venue has privately blocked them;
• the venue has offered the shift to its own pools first, the pool-only period hasn't ended, and they aren't in one of those pools;
• their profile isn't complete enough to be booked. That means it lists at least one role, each with an hourly rate, and has a profile photo, a short description, the area they work from and some availability in the next 60 days, and the account is active. The app shows each worker what, if anything, is missing.

When a venue invites the top matches automatically, only people within its budget are chosen. When it chooses people itself, people above its budget are shown too.

For people who work that kind of role and aren't already booked on it, the venue sees how many were left out for each of the other reasons, but not who they are.

2. Ranking. Everyone who passes the filters is put in order by distance, rate, experience above what the role asks for, and track record with that venue and others. The venue is shown why each person is suggested, and people above its budget are still listed, marked as over budget. References do not affect ranking.

Ranking only orders the list: the venue decides whom to invite, and the worker decides whether to accept. If you think a filter has wrongly left you out, contact us and a person will look at it.

Who we share it with

• The other side of a booking. Venues see staff profiles, and whether identity and right-to-work checks passed — not the documents, numbers, share codes or dates of birth. Staff see a venue's address and on-site contact only once they are confirmed for a shift.
• Our service providers, who process data on our instructions and under data processing terms with us:
  • Vercel (hosting — the app runs in London — and storage for videos);
  • Neon (database, including the files you upload — London);
  • Clerk (sign-in);
  • Resend (email).
• Anyone you give your public CV link to, if you turn it on.
• Authorities, where the law requires it.

We do not sell your data, and we do not use advertising or analytics trackers.

International transfers

Some providers (Clerk, Resend, and Vercel as a company) are based in the United States. Where your data is handled there, it is protected by the UK–US data bridge where the provider is certified under it, or otherwise by the UK International Data Transfer Addendum to the standard contractual clauses in that provider's data processing terms.

How long we keep it

• Account and profile: while your account is open.
• Videos, photos and links: until you remove or replace them, or your account is erased.
• Reference requests nobody answered: deleted 30 days after the link expires. Declined or cancelled ones 30 days after that happened. Confirmed references while the worker's account is open, or until the referee withdraws them.
• Daily counts of how often your public CV link was opened: 90 days.
• Daily counts of how reference links are used: kept, since they identify nobody.
• The venue waitlist: 12 months.
• Identity and right-to-work records: while your account is open. They are deleted if you close your account or ask us to erase your data. A venue that employs you may be required to keep its own copy of the right-to-work check; that is the venue's record, not ours.
• Booking records: up to 6 years, as the venue's record of who worked its event.
• Messages: up to 2 years after the booking or conversation they belong to.
• Notifications: up to 2 years.
• Audit log and safety reports: up to 6 years.

When you close your account or ask us to erase your data

We delete or anonymise what we hold about you:

• Deleted: your profile content, availability, uploaded documents, certificates, your videos, photos and links, your references, your public CV link and its view counts, pending invitations to you, and emails waiting to be sent to you.
• Anonymised: your name and contact details.

Some records are kept in pseudonymous form, because other people rely on them:

• a booking remains as the venue's record that the shift happened, without your name;
• your messages are redacted, but the thread remains for the other person;
• a safety report you made about someone else is kept, with you removed from it;
• the audit log is kept. It records who did what and when, and the reason an administrator gave for a decision, such as a failed check or a suspended account. The text of any note an administrator wrote about you is removed from it.

Your rights

You can ask for a copy of your data, and ask us to correct, erase or restrict it, to object to its use, or to move it to another service. Email privacy@bishbosh.ai. We will respond within one month.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would like the chance to put things right first.

Cookies

We use only cookies that are needed for the service to work:

• Sign-in cookies, set by Clerk, which keep you signed in.
• vouched_persona, which identifies your account to the app.
• htb_org, which remembers which organisation you are working in if you belong to more than one.

We set no advertising or analytics cookies, so we don't ask for consent to them.

Changes

If we change this notice in a way that affects you, we will ask you to read and accept it again before you continue.