Privacy Policy

Effective date: 14 October 2026

1. About this policy

Legends EOR is an employer of record service run by two companies:

The Legends Agency Limited, registered in England and Wales (company number 15421071). Registered office: Iceni Court, Evolution House, Delft Way, Norwich NR6 6BB. London office: 10 Lower Thames Street, London EC3R 6AF.
The Legends Agency South Africa (Pty) Ltd, registered in South Africa (registration number 2020/134946/07). Office: 2nd Floor, Wembley Square, 40 Solan Road, Gardens, Cape Town, 8001. This company is the legal employer of the people we employ on our clients' behalf.

In this policy, "we", "us" and "our" mean both companies. They work together to deliver our service and share information with each other under a written agreement. Each is responsible for the personal information it handles.

This policy covers website visitors, people at client and prospective client businesses, candidates, the employees we employ for our clients, and referees. Sections 2 to 11 apply to everyone. Then:

Part A explains your rights under the UK GDPR and, where it applies, the EU GDPR.
Part B explains your rights under South Africa's Protection of Personal Information Act (POPIA).

Because the two companies share information, both laws may apply to the same information about you. Where they do, you can use the rights in either part.

2. Information we collect

What we collect depends on how you deal with us.

Website visitor: IP address, device and browser type, pages visited, and how you use the site, including session recordings and heatmaps if you accept analytics cookies. If you use our salary benchmarking tool, we record the details you enter.
Client or prospective client contact: Name, job title, company, work email, phone number, country, the hiring requirements you share with us, contract and billing details, and records of our communications.
Candidate: Name, contact details, CV, work history, qualifications, skills, salary expectations, interview notes and assessments, references and, with your consent, background check results.
Employee we employ for a client: Identity and contact details, ID or passport number, tax number, bank details, salary and payroll records, benefits (medical aid and retirement fund), leave and sick notes, performance information, equipment issued, emergency contacts, and information needed to meet employment law.
Referee: Name, job title, contact details and the reference you give.

You don't have to give us personal information. But if you don't give us what we need, we may not be able to respond to your enquiry, consider you for a role or employ you. Some employee information, such as a tax number, is required by law.

3. How we collect it

We collect most information directly from you: through our website forms, by email or phone, in meetings, and through our recruitment system when candidates apply for roles via job boards.

We also collect information from other sources:

professional networks and referrals, when we search for candidates. We tell you who we are and why we have your details when we first contact you;
business directories and professional networks, to identify contacts at businesses that may be interested in our service;
our clients, who tell us about the roles they need filled and share information about the employees we employ for them, such as performance feedback;
referees and background check providers, with the candidate's consent; and
cookies and similar technologies on our website (section 9).

4. How we use it and our legal basis

The law requires us to have a legal basis for each use of personal information. The table shows ours. These bases appear in Article 6 of the UK and EU GDPR and section 11 of POPIA.

Responding to enquiries and preparing cost estimates: Taking steps you asked for before a contract; our legitimate interest in responding to enquiries
Providing our service to clients and managing the relationship, including billing: Our contract with the client; our legitimate interest in managing client relationships
Finding, assessing and shortlisting candidates, and sharing their details with the client hiring for the role: Our legitimate interest, and the candidate's, in matching candidates with suitable roles
Reference and background checks: The candidate's consent
Employing people on our clients' behalf: contracts, payroll, benefits, leave and equipment: The employment contract; our legal obligations as an employer
Sharing employee information with the client the employee works for (section 6): The employment contract and our contract with the client; our legitimate interest in delivering the service
Meeting tax, employment and other legal obligations: Legal obligation
Sending newsletters and business emails about our service (section 8): Our legitimate interest in promoting our service, or your consent where the law requires it
Website analytics and advertising: Your consent, given through our cookie banner
Protecting our legal rights and preventing fraud: Our legitimate interest

Where we rely on legitimate interests, we have weighed our interests against your rights. Where we rely on consent, you can withdraw it at any time; this doesn't affect anything we did before you withdrew it. We won't use your information for an unrelated purpose without telling you first.

5. Sensitive information

Some of the information we handle gets extra protection by law. GDPR calls it special category data; POPIA calls it special personal information. For us it includes:

health information, such as sick notes and medical aid details for employees;
race, gender and disability, where South African employment equity law requires it; and
criminal records, from background checks.

We use this information only where the law allows it: to meet our obligations as an employer, or with your explicit consent. We use background checks only when the role requires them and the candidate has given written consent. We share sensitive information with a client only where it's needed for the role or the employment, for example to confirm a background check was completed. We do not knowingly collect information about anyone under 18.

6. Who we share it with

We never sell personal information. We share it only with:

each other: our UK and South African companies share information as needed to deliver our service, under a written data sharing agreement;
our clients: for candidates, we share CVs and assessment results with the client hiring for the role. For employees, we share what the client needs to manage their work, which can include leave records, performance information, payslip summaries and equipment details;
payroll and benefits providers: our payroll provider, and the medical aid and retirement fund providers our employees belong to;
background check providers and referees: for checks the candidate has consented to;
other service providers: who run our recruitment, client management, email, file storage, IT, office space, cookie consent, website analytics and advertising services, under written agreements that require them to protect your information;
professional advisers: such as lawyers and accountants; and
authorities: tax authorities such as SARS and HMRC, and other regulators, courts or the police, where the law requires it.

7. International transfers

Our business moves personal information between countries in two main ways.

From the UK and EU to South Africa. Our team in South Africa handles information about clients and prospects. South Africa is not recognised by the UK or the EU as providing adequate data protection. We therefore protect these transfers with the approved contract terms: the UK International Data Transfer Agreement or Addendum, and the EU Standard Contractual Clauses.
From South Africa to our clients. Our clients are based around the world, and we share candidate and employee information with them as described in section 6. Under section 72 of POPIA, we do this because it's needed to perform the employment contract and our contract with the client, and our client contracts require clients to protect the information.

Some of our service providers also store data outside the UK, the EU and South Africa, including in the United States. Where they do, we rely on adequacy decisions or the approved contract terms above.

You can ask us for more information about these safeguards using the contact details in Part A or Part B.

8. Marketing

We send newsletters to our clients and business emails about our service to people at businesses that may be interested in it. We send these only to business contacts, never to candidates or employees.

UK: we email business addresses on the basis of our legitimate interests, as UK law allows.
EU and other countries: where local law requires consent before business emails, we ask for it first.
South Africa: we only send marketing emails to existing clients, or to people who have opted in, as section 69 of POPIA requires.

Every email includes a simple way to unsubscribe, and you can ask us to stop at any time. We'll keep a note of your request so we don't contact you again.

9. Cookies

Our website uses cookies and similar technologies. Necessary cookies keep the site working and are always on.

We partner with Microsoft Clarity and Microsoft Advertising. With your consent, Clarity captures how you use and interact with our website, such as clicks and scrolling, through behavioural metrics, heatmaps and session recordings. It does this using first- and third-party cookies. We use this information to improve our website and service, for security and fraud prevention and, if you accept advertising cookies, to measure and improve our advertising. To learn how Microsoft collects and uses this data, see the Microsoft Privacy Statement.

Analytics and advertising cookies are used only if you accept them through our cookie banner, and you can accept one type without the other. You can change your choice at any time using the cookie settings link on our website.

10. How long we keep it

We keep personal information only for as long as we need it, then delete it, destroy it or anonymise it. How long that is depends on why we have it:

Employees: for the length of employment, then for as long as employment and tax laws require. This is typically between three and seven years after employment ends.
Clients: for the length of the relationship, then for as long as we need it for tax, accounting and possible legal claims.
Candidates: while we may have suitable roles for you. If you're not hired, we delete your details when they're no longer useful, or sooner if you ask.
Enquiries and marketing contacts: until the enquiry is closed or the contact is no longer relevant. If you unsubscribe, we keep a note of that so we don't contact you again.
Website data: as set out in our cookie banner.

11. Security, breaches and automated decisions

We protect personal information with technical and organisational measures. These include access controls, multi-factor authentication, confidentiality obligations for our staff, and written agreements with our service providers. No system is completely secure. If a breach puts your information at risk, we will notify the relevant regulator and, where the law requires, tell you.

People make every decision about candidates and employees. We may use software, including AI features in our recruitment system, to help organise and search applications, but no decision about you is made solely by automated means.

Part A - UK and EU (GDPR)

This part applies under the UK GDPR, the Data Protection Act 2018 and, where you are in the EU, the EU GDPR.

Who is responsible. The Legends Agency Limited is the controller for information about clients, prospects and website visitors. Where it shares information with our South African company, that company is also responsible for the information it handles.

Contact: enquiries@legendseor.com
Phone: +44 (0)20 3918 6575
Post: 10 Lower Thames Street, London EC3R 6AF

Your rights. You have the right to:

get a copy of your personal information;
have inaccurate information corrected;
have your information deleted;
restrict how we use your information;
receive information you gave us in a portable format;
object to our use of your information where we rely on legitimate interests, and object to direct marketing at any time;
withdraw your consent where we rely on it; and
not be subject to decisions made solely by automated means that significantly affect you.

Some of these rights have limits; for example, we may need to keep employee records the law requires. To use your rights, contact us using the details above. It's usually free, and we will respond within one month, or tell you if we need longer for a complex request.

Complaints. Please contact us first so we can try to put things right. We'll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the EU, you can complain to the data protection authority in your country.

Part B - South Africa (POPIA)

This part applies under the Protection of Personal Information Act 4 of 2013 (POPIA). Where it differs from the rest of this policy, this part applies to information processed in South Africa.

For POPIA purposes, terms used elsewhere in this policy have these meanings: "controller" means "responsible party"; service providers that process information on our behalf are "operators"; "personal data" means "personal information"; and "special category data" means "special personal information".

Who is responsible. The Legends Agency South Africa (Pty) Ltd is the responsible party for information about candidates and the employees we employ, and for any other information it handles. Under POPIA, personal information also includes information about companies, so this part covers our client businesses too.

Information Officer: Anthony Kettle
Email: data@legendseor.com
Post: 2nd Floor, Wembley Square, 40 Solan Road, Gardens, Cape Town, 8001

Information the law requires. As an employer, we must collect certain employee information under laws including the Basic Conditions of Employment Act, the Income Tax Act, the Unemployment Insurance Act, the Employment Equity Act and the Tax Administration Act.

Your rights. You have the right to:

ask whether we hold personal information about you, free of charge, and request a copy of it;
ask us to correct or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained;
object to our use of your information where we rely on legitimate interests, and object to direct marketing at any time;
withdraw your consent where we rely on it;
not be subject to decisions made solely by automated means; and
complain to the Information Regulator.

To use your rights, contact our Information Officer. You can also use the Information Regulator's official forms: Form 1 to object to processing, and Form 2 to ask for correction or deletion. Send completed forms to data@legendseor.com. We will confirm your identity before acting on a request. Requests for copies of records are handled under the Promotion of Access to Information Act (PAIA), and a prescribed fee may apply.

Complaints. Please contact our Information Officer first. You can also complain to the Information Regulator, using its complaint form (Form 5):

Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Phone: 010 023 5200
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

Changes and contact

Links to other websites. Our website links to other sites, such as LinkedIn and job boards. We aren't responsible for their privacy practices.

Changes to this policy. We may update this policy from time to time. We'll post the new version on this page with a new effective date and, if a change significantly affects you, tell you directly where we can.

Contact us. For questions about this policy, use the contact details in Part A or Part B, or email enquiries@legendseor.com.