Privacy policy

Draft – subject to legal review

Last updated: [date to be set when published]

This policy explains how WorkplaceHQ handles personal data. It covers two different situations, because our role is different in each.

1. Who we are

WorkplaceHQ is provided by Yorkshire Hospitality Ltd (trading as WorkplaceHQ), company number 09991958, registered office Management Suite Kepwick House, Peasholm Gap, Scarborough, England, YO12 7TN. You can contact us about privacy at [Deano to confirm privacy email]. [Deano to confirm whether there is an ICO registration number to show here.]

2. Staff using WorkplaceHQ through their employer

• If your employer uses WorkplaceHQ, your employer is the controller of your data in the app and we are their processor. We handle that data only on their instructions and to provide the service, under a written data processing agreement that we sign with each paying customer before their first paid charge.
• That data can include your name, work email, job role, site, profile photo, and the posts, messages, comments, kudos, event responses and documents in your organisation's space. It can also include technical data such as device type and notification settings.
• Questions or requests about this data (for example, to see or correct it) should go to your employer first. We will help them respond.

3. Our customers and website visitors

For these people, we are the controller.

• What we collect:

- details you give us when you start a trial, book a demo or contact us (your name, work email, company and staff numbers, and anything you write to us);

- billing details for paying customers, including Direct Debit details collected and processed by GoCardless, and the VAT invoices we issue;

- basic website usage data.

• Why we use it, and our lawful basis:

- To set up and run your trial or subscription and to bill you. Basis: contract.

- To reply to enquiries and arrange demos. Basis: legitimate interests.

- To keep our website and service secure and working well. Basis: legitimate interests.

- To keep the records the law requires, such as tax records. Basis: legal obligation.

- To send occasional product news, only where the law allows and with an easy way to opt out.

• We do not sell personal data.

4. Who we share data with

We use a small number of trusted suppliers to run WorkplaceHQ, under contracts that protect your data. These include GoCardless for Direct Debit payments. [Deano to confirm the rest of the list, e.g. hosting and email providers.] We may also share data where the law requires it.

5. Where data is stored

Data is hosted in [Deano to confirm location, e.g. the EU or UK]. If data is transferred outside the UK, we use lawful safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

6. How long we keep it

• Customer content: we keep it for as long as the customer's account is active, then for 30 days after the account ends, then we delete it (see our terms).
• Trial and enquiry details: we keep these for up to [Deano to confirm, e.g. 24 months] after our last contact.
• Billing records: we keep these for 6 years for tax purposes.

7. Cookies

Our website and app use only the cookies needed to work and to keep you signed in. [Deano to confirm whether any analytics will be used; if so, add a cookie banner.]

8. Security

We use encrypted connections, access controls, backups and regular updates to protect data.

9. Your rights

Under UK data protection law you have rights to:

• access your data;
• correct it;
• have it erased;
• restrict or object to how it is used;
• have a copy of it transferred to another organisation (data portability).

Contact us to use these rights. If your data is held for your employer, contact your employer. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

10. Changes

We may update this policy. The current version will always be on this page.