Privacy notice

Who we are

The data controller is [Pending legal review: Legal entity name and registration number], [Pending corporate registration: Registered office address]. For privacy questions, email [email protected].

When a business uses our software, that business is usually the controller of its customers' and employees' records, and we act as its processor under a data processing agreement.

What we collect

• Request details you send through our forms: name, work email, company, country, the modules you are interested in, a preferred demo slot, your time zone, and any message you write
• The time you gave consent, and the version of this notice you consented to
• Technical details such as the page you came from, through a campaign link if you used one, and the browser type, used to keep the site secure and to measure which pages help people
• Business records that customers store in the software, such as invoices, customer lists and payroll details. We process these only to provide the service

Why we use it, and the legal basis

• To answer your request and arrange a demo or quote: performance of a request you made, or steps before a contract
• To keep the site secure and stop abuse: our legitimate interest in running a safe service
• To send product updates: your consent, which you can withdraw at any time
• To provide the software to a business: the contract between that business and us, under its instructions

Consent

Where we rely on consent, we ask you to tick a box that is not pre-ticked. We store the time of consent with your request. You can withdraw consent at any time by emailing us, and withdrawal does not affect what was done before.

Who we share it with

• Our hosting and cloud providers, which store the data on our behalf under contracts that limit its use
• Email and messaging providers that send our replies
• Payment providers, only when you pay for a plan
• Authorities, when the law requires it. We do not sell personal information, and we do not share it for advertising

Where data is stored and moved

Hosting regions are confirmed in your written terms. Where personal information moves between regions, for example from Europe to a processor in the United States, we rely on the transfer mechanisms that the law in that region recognises, such as standard contractual clauses or the UK addendum, and a transfer impact assessment.

How long we keep it

Request details are kept for 24 months after the last contact, then deleted, unless a longer period is needed to meet a legal duty. Business records in the software are kept for the period the customer chooses within the limits of the law in its country.

Your rights

Depending on where you live, you may ask to see, correct, export, delete or restrict the use of your information, and object to some uses. Under the GDPR and UK GDPR you can also complain to your supervisory authority. In California and other US states with privacy laws, you may ask us to disclose what we hold and to delete it, and you can opt out of any sale or sharing, which we do not do. Under the laws of the Middle East and North Africa and Asia, the rights are similar and are listed in the regional section below.

Send requests to [email protected]. We verify your identity before we act, and we reply within the time the law in your region sets, usually one month.

Regional notes

• United States: the California Consumer Privacy Act as amended by the CPRA, and other state privacy laws. We do not sell or share personal information for cross-context behavioural advertising.
• European Economic Area and UK: the GDPR and UK GDPR. You have the rights listed above and the right to lodge a complaint with your supervisory authority.
• Middle East and North Africa: where applicable, the UAE Federal Decree-Law 45 of 2021, the Saudi Personal Data Protection Law, and comparable laws in other countries. Personal data is handled under the same rights as above.
• Asia: where applicable, Singapore's Personal Data Protection Act, Japan's Act on the Protection of Personal Information, India's Digital Personal Data Protection Act 2023, and comparable laws. Personal data is handled under the same rights as above.

Children

Our services are for businesses. We do not knowingly collect personal information from anyone under 16, and we delete it if we learn we have.

Security

Access to personal information is limited to people who need it. Records are kept separate for each business, changes are logged, and data is encrypted in transit. We will tell affected people and the regulator when the law requires it after a breach.

Changes to this notice

When we change this notice, we post the new version here and show the date of the change at the top. Where a change is material, we tell you by email first.