Privacy policy

1. Personal data we collect

• Business contact and account information: names, business email addresses, employer or organisation, job role, account identifier, administrator status, account preferences and authentication information appropriate to the login method. Sources include you and your organisation's administrator.
• Enquiry and relationship information: messages submitted through contact forms, demo requests, correspondence, meeting arrangements and support records.
• Billing information: billing contacts and addresses, subscription details, invoice and payment status, company and VAT information, etc.
• Technical and security information: IP addresses, device and browser information, authentication events, timestamps, security logs, etc.
• Website and preference information, including your consent choices.

2. Personal data purposes and lawful basis

• Account administration and the business relationship. We use necessary business contact and account information to provide access, manage the organisation's subscription and communicate with its representatives. Our legal basis is our legitimate interest in administering and securing that business relationship. Where the individual is personally the contracting customer, necessary processing may instead be based on performance of that individual's contract or steps requested before it.
• Enquiries and support. We use contact details and correspondence to respond and resolve issues, based on our legitimate interests in communicating with interested persons and supporting customers, or taking requested pre-contractual steps where the individual is the prospective contracting party.
• Billing, accounting and compliance. We use relevant billing and transaction data for our legitimate interest in collecting agreed business payments and for legal obligations that apply to us, including applicable accounting and tax duties. Where a natural person contracts directly, necessary billing processing may also be based on that contract.
• Security and legal claims. We process proportionate account and security information to protect the service, investigate misuse, prevent fraud and establish, exercise or defend legal claims. We rely on the corresponding legitimate interests and, where applicable, a specific legal obligation.

Consent may be withdrawn at any time without affecting the lawfulness of earlier processing. You can object to legitimate-interest processing as explained below; objections to direct marketing will be honoured. We assess relevant legitimate interests against individuals' rights and reasonable expectations.

3. How we protect personal data

We use technical and organisational measures appropriate to the processing and risks.

All received information that the customer provides is stored on secure servers and only authorized staff have access to this information. We take reasonable precautions to prevent the loss, misuse or alteration of customers’ personal information. Our employees, contractors and agents who have access to your personal information are required to keep that information confidential and are not permitted to use it for any purposes other than those listed in the Privacy policy or to deal with requests which you submit to us. We assess incidents and notify customers, individuals and authorities where required by the applicable role and law.

4. Who receives personal data

We disclose relevant data to authorised personnel and service providers as necessary for the purposes described here. These may include hosting, storage, security monitoring, support, business email, billing and payment providers.

We may disclose proportionate information to professional advisers, authorities or courts where lawfully required or necessary for legal claims.

A potential or actual corporate transaction may involve restricted disclosure to advisers or a successor, subject to confidentiality, lawful grounds and applicable notice duties.

We do not sell personal data or allow third parties to use customer HR information for their own advertising.

5. Cross-border transfers

Our hosting and storage location is Europe. Where personal data is transferred outside the European Economic Area, we use an applicable lawful transfer mechanism.

6. How long we retain personal data

We use purpose-specific retention periods as follows.

• Account and business contact records: Retained for the duration of your subscription. You may request data return within 30 days of termination. Following return (or expiry of the request window), data is deleted from production systems and all remaining copies purged within 90 days.
• Enquiries and support correspondence: Retained for as long as necessary for support purposes.
• Billing, invoices and transaction records: Retained for as long as necessary for accounting, tax and legitimate business purposes.
• Customer HR records, uploads, prompts, outputs, histories, indexes, embeddings, caches and processor support material: the customer's instructions.

We may preserve specified information for a legal obligation or a necessary legal claim, with restricted access and periodic review.

7. Your rights

You have the following rights, which we will always work to uphold:

a)The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.

b)The right to access the personal data we hold about you.

c)The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete.

d)The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have.

e)The right to restrict (i.e. prevent) the processing of your personal data.

f)The right to object to us using your personal data for a particular purpose or purposes.

g)The right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

Send requests to info@hrgate.io. We may seek proportionate identity verification, but will not routinely require excessive identification. We respond without undue delay and normally within one month. Where the law permits an extension for complexity or number of requests, we explain it within the initial month. Requests are normally free; any refusal or fee must meet the legal conditions and will be explained.

For HR data processed for an employer, contact that employer or customer first. If you contact us, we will identify the relevant role and assist or forward the request as appropriate, rather than disclose one customer's records without authority.

8. Required information, children and external services

Information identified as necessary for registration, access, billing or security must be provided to enable the relevant function; otherwise we may be unable to offer it. Optional marketing or analytics consent is not a condition of buying the service.

The website and service are directed to business users, not children as consumers.

Independent third-party websites and customer HRIS providers have their own privacy notices. That does not remove our responsibility for processing through our own service and appointed processors.

9. Changes and contact information

We may update this Policy to reflect actual practices or law. We identify the effective date and provide appropriate notice of material changes. A new notice does not by itself create consent, change a customer's instructions or authorise an incompatible purpose. Contact info@hrgate.io with questions or requests.