Effective Date: October 27, 2026

Tideworks Technology, LLC. (“Tideworks”) may collect information, including personal information, on this website.  Tideworks is committed to protecting the privacy of our users and have created this GDPR Compliance Statement, which supplements our Privacy Policy, in order to provide additional information about our personal data processing practices relating to individuals who access our services or otherwise interact with us from the European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland.

Contact Information

If you have any questions or concerns in connection with Tideworks’ information collection practice summarized in this Statement, please send an email to Tideworks.Info@Tideworks.com stating your questions or concerns.  Alternatively, the postal address is:

Tideworks Technology, LLC.
Attn: Data Privacy Officer
1131 SW Klickitat Way, Building E
Seattle, WA 98134

If you have a concern about our processing of personal data, you have the right to lodge a complaint with the Data Protection Authority where you reside, where you work, or where an alleged violation of the law has occurred. Contact details for applicable Data Protection Authorities can be found using the links below:

The Types of Personal Data That We Collect

Tideworks may collect personal data from individuals from the EEA, UK, or Switzerland who visit our public-facing web site (“Website Visitors”), and individual representatives of our current and potential corporate customers, suppliers and business partners from the EEA, UK, or Switzerland (“Business Contacts”).

From Website Visitors, Tideworks may collect the individual’s name, phone number, email address, mailing address and IP address.  From Website Visitors applying for employment, Tideworks may also collect the individual’s driver’s license number, passport number, social security number, marital status, family member information, financial information and professional career/employment information.

From Business Contacts, Tideworks may collect the individual’s name, business phone number, business email address, IP address, company name and company mailing address.

Tideworks is the data controller for the above types of personal data. In addition, Tideworks may be in possession of client data that contains information defined as personal data as a service provider (data processor) to its clients (data controllers).  In performing these services, Tideworks does not process, store, or handle personal data in any other manner other than that directed by the primary data controller.  Accordingly, Tideworks does not share, uniquely identify, or in any way use personal data for any commercial purpose other than that defined by the controller.  In some cases, in accordance with our client agreements, we may disclose personal data with a subcontractor contracted to provide services on our behalf, in order to provide service to our clients. This GDPR Compliance Statement only applies to personal data that Tideworks collects as a controller. For information about how your personal data is processed on behalf of our clients, please contact the applicable client.

Purposes for the Processing of Personal Data; Legal Basis

Tideworks processes the personal data of EEA, UK, and Swiss data subjects for the purposes of:

  • Evaluating job candidates for positions for which they have applied;
  • Identifying prospective customers, marketing our services, and building our mailing list for information distribution;
  • Communicating with corporate business partners about business matters and conducting related tasks for legitimate business purposes;
  • Meeting legal or regulatory requirements and Tideworks’ internal policies;
  • Other purposes disclosed at the time of collection; and
  • Processing client data as a data processor (i.e., at the direction of our clients, who are the data controllers).

When we process your personal data, we will do so in reliance on the following lawful bases:

  • Contract: Where the processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract with you. This applies to any processing where you sign a contract with us, for example when you become our customer or deliver services to us as a vendor or contractor. This may also include processing necessary for the performance of our Terms of Use.
  • Legitimate Interest: Where the processing is necessary for the purposes of a legitimate interest that are not overridden by your interests or fundamental rights and freedoms (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you regarding our services).
  • Vital Interest: Where the processing is necessary to protect the vital interests of you or another person (e.g., to protect your physical safety).
  • Public Interest: Where the processing is necessary to perform tasks carried out in the public interest or in the exercise of official authority vested in us (e.g., to cooperate in an ongoing law enforcement investigation).
  • Legal Obligation: Where the processing is necessary to comply with our legal obligations (e.g., to maintain a record of your personal data to comply with laws and regulations related to bookkeeping, accounting, taxation, and employment).
  • Consent: Where we have your consent for the processing (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing of your personal data, you may withdraw your consent at any time.

You are not required to provide personal data to us, but we do rely on your personal data to provide certain of our products and services. For example, we need your personal data to facilitate and deliver an order that you request. If you choose not to provide us with your personal data, we may not be able to provide you with a service or product you request. We will inform you at the point that we collect personal data from you if the provision of certain personal data is mandatory or optional for receipt of our products and services.

Transfer of Personal Data to a Third Country

Tideworks’ primary business operations are not in the EEA, UK, or Switzerland, and as such personal data collected by Tideworks may be stored or processed in the United States or in any other country where Tideworks or its affiliates, subsidiaries, or third-party service providers maintain facilities.  Data subjects who provide personal data to Tideworks consent to the processing and transfer of that data to the United States and other locations outside of the EEA, UK, or Switzerland, including to countries with laws that may not provide the same level of protection of personal data.

Tideworks may also execute agreements with third parties for the transfer of personal data outside of the EEA, UK, or Switzerland using Standard Contractual Clauses approved by the relevant Data Protection Authority, which are designed to provide safeguards for personal data transferred outside of the originating jurisdiction.

Retention Period

Personal data is retained by Tideworks no longer than necessary to fulfil the purposes for which it was collected (e.g., to execute obligations to former employees to provide post-employment benefits) or as agreed upon under applicable contracts with clients or business partners. However, if necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights.

The criteria used to determine the period of time for which personal data about you will be retained varies depending on the legal basis under which we process your personal data:

  • Contract: Where we are processing personal data based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.
  • Legitimate Interest: Where we are processing personal data based on legitimate interests, we generally will retain the information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects.
  • Vital Interest: Where we are processing personal data based on vital interests, we generally will retain the information for the period of time necessary to protect the vital interests of the relevant person plus some additional limited period of time that represents any applicable statute of limitations for legal claims that could arise out of the related events.
  • Public Interest: Where we are processing personal data to perform tasks carried out in the public interest or in the exercise of official authority vested in us, we generally will retain the information for a reasonable period of time based on the public interest / official authority, taking into account any obligations we may have to retain the information for a longer period of time.
  • Legal Obligation: Where we are processing personal data based on a legal obligation, we generally will retain the information for the period of time necessary to fulfill the legal obligation plus some additional limited period of time that represents the statute of limitations for legal claims that could arise from the legal obligation.
  • Consent: Where we are processing personal data based on your consent, we generally will retain the information for the period of time necessary to fulfill the purposes for which you have provided your consent.

In certain circumstances, we may need to apply a “legal hold” that retains information beyond our typical retention period where we face threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved. In all cases, in addition to the purposes and legal bases identified above, we consider the amount, nature and sensitivity of personal data, as well as the potential risk of harm from unauthorized use or disclosure of personal data, in determining the relevant retention period.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if that is not possible (for example, because personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion or deidentification is possible.

Your Additional EEA, UK, and Swiss Privacy Choices

Subject to certain limitations at law, you may be able to exercise the following rights:

  • Right to Access: The right to obtain confirmation of whether we are processing personal data about you, access to and a copy of the personal data we are processing about you, and information relating to its processing, including:
    • The categories of personal data being processed;
    • The purposes of the processing;
    • The categories of the sources of the personal data;
    • The categories of recipients to whom the personal data have been or will be disclosed;
    • The envisaged period for which the personal data will be stored, or the criteria used to determine that period;
    • Any automated decision-making or profiling performed in connection with your personal data; and
    • The safeguards relied upon for the transfer of personal data to any third country.
  • Right of Portability: The right to obtain a copy of the personal data we have collected about you in a structured, commonly used, and machine-readable format, and the right to transmit that personal data to another controller without hindrance.
  • Right to Rectification: The right to correct or update any personal data about you that is inaccurate or incomplete.
  • Right to Restriction of Processing: The right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
Right to Object to Processing: The right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
  • Right to Withdraw Consent: The right to withdraw your previously provided consent to our processing of your personal data. Please note withdrawing your consent will not affect the lawfulness of our use of your personal data before your consent was withdrawn, nor our processing of personal data pursuant to a different lawful basis for processing.
  • Right to Erasure: The right to have us erase your personal data if the continued processing of that personal data is not otherwise justified.

Please note that if the exercise of these rights limits our ability to process personal data, we may not be able to provide our services to you, or otherwise engage with you in the same manner.

Please submit a request specifying the right you wish to exercise by completing our Privacy Rights Form available at https://tideworks.com/contact/consumer-rights-request-form/.

To exercise your right to object as it relates to the use of automatic data collection technologies (including cookies) that facilitate our online targeted advertising activities, please visit our Cookie Management Tool by clicking on the cookie icon in the bottom left corner of the site and adjust your preferences accordingly. Please note this preferences tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting. In addition, you may follow the other steps set forth in the Your Choices section of the Third-Party Tracking and Online Advertising section of our Privacy Policy to further exercise control over automatic data collection technologies.

Before processing your request to exercise certain rights (taking into account the confidential nature of any personal data we maintain), we will need to verify your identity and confirm you are accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted through our online form to include first and last name, email address, phone number, country of residency and/or information about your last transaction with us.

There may be cases where restrictions on the amount of information that can be disclosed to data subjects under applicable law (for example, if that would necessarily involve disclosing information about another person).  Tideworks is permitted to withhold some types of personal data in certain circumstances, subject to applicable local law requirements. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity as needed to protect your personal data or locate your information in our systems, or where you are not accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland.

If there is a dispute, please contact the Tideworks privacy officer at the address listed at the top of this GDPR Compliance Statement.  In addition, data subjects have the right to lodge a complaint with a supervisory authority.

Automated Decision-Making and Profiling

We do not conduct automated processing of personal data, including profiling, for the purposes of making decisions about you.

Changes to This Statement

We may update this GDPR Compliance Statement to reflect changes to our practices or applicable laws.  If we make any updates, we will notify data subjects by means of a notice on this Statement.  We encourage you to periodically review this page for the latest information on our privacy practices.