Privacy policy

What this policy covers

This policy applies to all users of www.onwingman.com and anyone else who deals with Wingman: candidates, client and company representatives, partners, and applicants for roles at Wingman itself. For most processing Wingman is the responsible party (data controller); in limited cases we process on a client’s instructions as an operator.

What we collect

Candidates: identity and contact details; profile and professional information (CV, work history, education, qualifications, skills, right-to-work, LinkedIn); assessment results where applicable; application and placement information; and communications with us.

Client and company representatives: name, work contact, job title, organisation, hiring requirements, and a record of our dealings.

Partners: name, business contact, organisation, and relationship details.

Applicants for roles at Wingman: the same as candidates, plus the role applied for.

Sensitive information is collected only in defined circumstances and, where required by law, with consent: diversity information (voluntary, and never used to match or decide); background-screening and criminal-history information; biometric (facial) verification; and identity or right-to-work documents, each only where a role requires it. We do not ordinarily request health or disability information.

Where we get it

• Directly from you: when you register, build your profile, apply, or communicate with us.
• Business contact-data and sourcing providers: ZoomInfo, Lusha, Apollo, and LinkedIn Sales Navigator.
• Background-screening providers: MIE where screening is required.
• Referees you nominate.
• Hiring organisations that share information for a role.
• Publicly available sources: professional networking profiles.

How and why we use it

• Creating and operating your account and the platform: performance of contract; legitimate interests.
• Matching candidates to roles: taking steps at your request; legitimate interests.
• Introducing a candidate to a hiring organisation: consent, instruction, or platform preferences.
• Sourcing and contacting potential candidates and client contacts: legitimate interests; consent where required for electronic marketing.
• Diversity monitoring and employment-equity reporting: consent.
• Background, identity or biometric checks for a specific role: consent and the hiring organisation’s requirements.
• Communicating and providing support; marketing (consent for electronic marketing); securing and improving the platform; and meeting legal obligations.

Automated processing and recommendations

We use automated tools, including machine learning and third-party AI services, for initial qualification of candidates and to recommend roles. These tools support the team; they do not make final hiring, employment or placement decisions on their own. Where an automated output materially affects whether someone is introduced or progressed, human review is used.

Diversity information is not used in automated qualification or matching. You can ask how it works, ask for human review, give your point of view, or object, by contacting privacy@onwingman.com.

Marketing communications

• Service messages (account notifications, role matches, assessment links, interview coordination, introductions) are not marketing: they are part of the service.
• Electronic marketing (email, WhatsApp) is sent only with consent, and every message includes a way to opt out. Opt-outs are honoured across all channels.
• Introductory contact. Where we obtain contact details from another source, we may contact the person where permitted, including to ask whether they want further communications. If they object or opt out, no further electronic marketing follows.

Who we share it with

• Hiring organisations: we do not make candidate profiles openly searchable. We share only after a candidate has agreed to be introduced.
• Service providers under contract, using information only on our instructions: Google Cloud, Odoo, Namecheap, GitHub, Anthropic, Google (Gemini), WhatsApp, and MIE.
• Professional advisers: lawyers, auditors, insurers where needed.
• Law, regulators and courts: where required or permitted.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

International transfers

Because we are South Africa–based and use reputable global cloud and service providers, personal information may be stored or processed outside South Africa, the UK, the EEA, Australia, New Zealand and the US. When we transfer across borders, we use the safeguards applicable laws require: standard contractual clauses, adequacy-recognised destinations, or reliance on consent or necessity for the service.

How long we keep it

• Candidates: up to 5 years from our last meaningful interaction, after which we ask you to reconfirm; if not confirmed, we delete or anonymise.
• Unsuccessful applicants for Wingman roles: 12 months, unless you remain registered.
• Client and partner contacts: the duration of the relationship plus a reasonable period after.
• Legal retention: some records are kept longer where the law requires.

Cookies

We use three cookie types: strictly necessary (site function and security); analytics (Google Analytics); and advertising (Google Ads). Where the law requires (UK, EEA), we ask for consent before non-essential cookies, and Global Privacy Control is honoured where required. Manage them any time on our cookie policy page.

Your privacy rights

Depending on your jurisdiction, your rights may include: access, correction, deletion, objection, restriction, data portability, withdrawing consent, opting out of marketing, and complaining to a regulator. To exercise any of these, contact privacy@onwingman.com.

Country-specific rights

• South Africa: POPIA. Rights to be notified, access, correct or delete, object, and complain to the Information Regulator (010 023 5200 · POPIAComplaints@inforegulator.org.za).
• United Kingdom: UK GDPR and Data Protection Act 2018. Access, rectification or erasure, restriction or objection, portability, and withdrawing consent. Complain to the ICO: ico.org.uk, 0303 123 1113.
• United States: state privacy laws. Know or access, delete, correct, opt out of sale or sharing (we do neither), limit sensitive-information use, and appeal. GPC honoured where required; FCRA for background checks, Illinois BIPA for biometrics.
• Australia: Privacy Act 1988 and the APPs. Access and correct, opt out of direct marketing, complain to the OAIC: oaic.gov.au, 1300 363 992.
• New Zealand: Privacy Act 2020. Access and correct, complain to the Privacy Commissioner: privacy.org.nz, 0800 803 909.

Children

The platform is for users aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we delete it or take appropriate steps.