What personal data we collect, why, and what your rights are.
Last updated 15 September 20261.1 Controller. Oneward, Inc., a Delaware corporation, c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, USA ("Oneward", "we"). Contact: privacy@oneward.com.
1.2 EU representative (Article 27 GDPR). Oneward GmbH i.G., Hardenbergstraße 12, 10623 Berlin, Germany, privacy@oneward.com. Oneward GmbH i.G. is Oneward's wholly owned German subsidiary in formation. You may contact it in addition to or instead of Oneward on all matters relating to the processing of your personal data.
1.3 Data protection contact: privacy@oneward.com.
2.1 This Policy covers the website oneward.com, the Oneward platform, and business communications with Oneward. Oneward is a business-to-business service and is not directed at consumers.
3.1 Oneward is a controller for: website visitors; prospects and business contacts; Customer account users; applicants for positions at Oneward; and vendors and their staff.
3.2 Oneward is a processor for Worker Data processed on behalf of Customers. The Customer is the controller.
3.3 Information for Workers of our Customers. If you are an employee, contractor, candidate or other workforce member of an organization that uses Oneward, that organization, not Oneward, decides why and how your data is processed on the platform. Direct requests to exercise your rights to that organization. Oneward assists its Customers in responding as required by the DPA and applicable law.
4.1 Website visitors: server logs (IP address, timestamp, requested page, referrer, browser and device information) and the strictly necessary storage described in the Cookie Notice. The website also uses Google Analytics and PostHog to measure how it is used: with your consent in the EEA, the United Kingdom and Switzerland, and unless you opt out elsewhere, as described in the Cookie Notice. The website uses no advertising trackers.
4.2 Prospects and business contacts: name, business email, company, role, and the content of your inquiries, provided by you through forms or email, or obtained from professional networks, events and business data providers.
4.3 Customer account users: name, business email, role, authentication data, product usage and analytics data (collected through PostHog inside the platform), support communications, and audit records of actions taken on the platform.
4.4 Worker Data (as processor). Depending on Customer configuration: identifiers and contact details; date of birth; identity documents; employment contracts; position, compensation and bank details; time and attendance; leave and absence; performance data; and, where a Customer lawfully processes them, special categories of data such as health-related leave, disability accommodations, union membership, or ethnicity for pay equity reporting. The platform stores payroll inputs and outputs but does not compute payroll.
4.5 Applicants to Oneward: application, CV, correspondence, interview notes and assessment results.
4.6 Vendors: business contact and contract data.
| Purpose | Legal basis (GDPR) |
|---|---|
| Operate and secure the website | Art. 6(1)(f): our legitimate interest in running a secure website |
| Measure how the website is used (Google Analytics, PostHog) | Consent (Art. 6(1)(a)) and § 25(1) TDDDG in the EEA, the United Kingdom and Switzerland; elsewhere Art. 6(1)(f) with an opt-out |
| Respond to inquiries and pursue business relationships | Art. 6(1)(b) for pre-contractual steps; Art. 6(1)(f) for business-to-business contact, subject to electronic marketing rules |
| Provide the platform and manage accounts | Art. 6(1)(b) |
| Product analytics and improvement | Art. 6(1)(f); consent (Art. 6(1)(a)) where required for non-essential storage under § 25 TDDDG |
| Comply with legal obligations (tax, commercial records, requests from authorities) | Art. 6(1)(c) |
| Recruitment | Art. 6(1)(b) and Art. 6(1)(f); § 26 BDSG where applicable |
| Establish, exercise or defend legal claims; enforce our terms | Art. 6(1)(f) |
6.1 Oneward processes Worker Data only on the documented instructions of the Customer and under the DPA. The Customer determines the legal basis, typically Art. 6(1)(b), (c) or (f) GDPR and, for special categories, Art. 9(2)(b) GDPR together with applicable employment law, works agreements or consent.
7.1 Platform features use large language models from Anthropic, OpenAI and Google, served through the providers' APIs and Google Vertex AI. Under our provider terms, Customer Data is not used to train the providers' models, and retention is zero or minimal where the provider offers it. Oneward does not use Customer Data to train its own models without written consent.
7.2 Oneward does not make solely automated decisions producing legal or similarly significant effects (Article 22 GDPR). AI outputs are proposals that the Customer's authorized personnel review; actions that move money or change access rights require human approval.
8.1 The subprocessors listed on the Trust & Security page (Section 13); professional advisers; authorities where legally required; and, subject to confidentiality, parties to a merger, acquisition, financing or asset sale involving Oneward.
9.1 Hosting. Customer Data is hosted within the geographic region selected by the Customer: the European Union or the United States. Customers in the EEA, the United Kingdom and Switzerland are hosted in the EU by default.
9.2 Transfers to the United States occur (a) when Oneward personnel in the United States access data for support and operations, (b) when AI model requests are processed by providers in the United States, and (c) when a Customer selects US hosting, including for personal data of its EEA, UK or Swiss workforce.
9.3 Safeguards. For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with transfer impact assessments and supplementary measures, and additionally on the EU-US Data Privacy Framework where the recipient is certified under it. For transfers from the United Kingdom we use the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses. For transfers from Switzerland we use the Standard Contractual Clauses with the Swiss amendments.
9.4 A copy of the applicable clauses is available on request from privacy@oneward.com.
| Data | Retention |
|---|---|
| Website server logs | 30 days |
| Prospect and business contact data | 24 months after last contact |
| Customer account and usage data | Duration of the subscription, then deleted together with the Customer's data |
| Customer Data (as processor) | Duration of the subscription; 30-day export window after termination; deletion within 90 days thereafter, with backups purged on the ordinary backup cycle |
| Applicant data | 6 months after the hiring decision; longer only with consent |
| Records subject to statutory retention | 6 or 10 years under § 257 HGB and § 147 AO, and equivalent US requirements |
11.1 Our technical and organizational measures are described on the Trust & Security page.
12.1 Subject to legal conditions, you may request access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interests, and withdraw consent at any time without affecting prior processing.
12.2 Email privacy@oneward.com. We may ask you to verify your identity. We respond within one month, extendable by two months for complex requests. Workers of Customers should contact their organization (Section 3.3).
12.3 You may lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin, Germany), the authority of your habitual residence or workplace, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner.
13.1 This Section applies to residents of US states with comprehensive privacy laws, including California, Delaware and others. Oneward provides these rights as a matter of policy even where a statutory threshold is not met.
13.2 Categories collected in the past 12 months: identifiers and business contact information; internet and usage activity on the website and platform; professional and employment information; and, as a service provider only, the Worker Data categories in Section 4.4.
13.3 Oneward does not sell personal information and does not share it for cross-context behavioral advertising. Oneward does not use sensitive personal information for purposes that would trigger a right to limit.
13.4 Rights: to know or access, delete, correct, obtain a portable copy, opt out of sale, sharing and profiling, and not to be discriminated against for exercising these rights. To exercise them, email privacy@oneward.com. If we deny a request, you may appeal by replying to our decision.
13.5 Oneward honors Global Privacy Control signals as an opt-out where applicable law requires it.
13.6 For Worker Data, Oneward acts as a service provider or processor and processes such data only for the business purposes in the Customer's agreement.
13.7 Sections 4 and 5 serve as our notice at collection.
14.1 The services are not directed at anyone under 18. We do not knowingly collect data from children.
15.1 We may update this Policy. The current version is always available on this page with its date. Material changes are announced to Customer account users by email or in-app notice.
16.1 privacy@oneward.com. EU representative: Oneward GmbH i.G., Hardenbergstraße 12, 10623 Berlin, Germany.