This policy explains how Pobl Software LTD ("Pobl", "we", "us" or "our") collects and uses personal information when acting as a controller. It also explains the different role Pobl has when processing HR and workplace information for a customer.

Pobl is a company incorporated in the United Kingdom with company number [COMPANY NUMBER] and registered office at 15 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ. Questions and rights requests can be sent to hello@poblhr.com.

1. About this policy

This policy applies to personal information collected through:

• the public Pobl HR marketing website;
• contact and demo enquiries;
• free-trial registration, customer and Partner relationships;
• billing, account administration and service communications;
• support, security and fraud-prevention activities; and
• Pobl's operation of the Pobl HR service and its business.

It should be read with our Cookie Policy, Terms and Conditions, Data Processing Agreement and AI Usage Policy.

2. When Pobl is the controller

Pobl is a controller when it decides why and how personal information is used for its own business purposes. This includes information about website visitors, enquirers, prospective customers, customer and Partner contacts, people who register or administer accounts, billing contacts and people who communicate with Pobl.

Pobl is also a controller for information it needs to administer commercial relationships, keep accounting and legal records, protect the website and Service, prevent fraud and misuse, establish or defend legal rights, and meet its own legal obligations.

3. When Pobl is a processor

A customer is normally the controller of employee, worker, contractor, applicant, emergency contact and other HR or workplace information placed in Pobl HR. Pobl processes that information for the customer under its documented instructions and acts as a processor.

The customer decides what information to collect, its lawful basis, who may access it and how it is used. The customer is responsible for giving its employees and other relevant people an appropriate workforce privacy notice and responding to their rights requests.

If your question concerns information that your employer, organisation or its HR Partner placed in Pobl HR, please contact that organisation first. Pobl will assist the relevant customer in accordance with our Data Processing Agreement.

4. Information we collect

4.1 Website and analytics

When someone visits the marketing website, we may process:

• internet protocol address and approximate location;
• browser, device, operating-system and screen information;
• requested pages, timestamps, referring pages and technical request information;
• security, availability and error information; and
• Google Analytics information about page views, scrolls and site searches, unless the visitor rejects analytics.

The marketing website is hosted by Vercel, with website execution configured for its London infrastructure. Necessary technical information is processed to deliver and secure the website. Google Analytics loads by default. If the visitor selects Reject analytics, Google Analytics is stopped, analytics cookies available to this website are deleted and no further analytics information is sent to Google.

4.2 Enquiries and demos

If someone contacts us or requests a demo, we may collect their name, work email, company name, phone number, approximate team size, enquiry topic, message, preferred arrangements and later correspondence.

Email correspondence is handled through Microsoft 365. Please do not include employee records, special category information or other confidential HR information in a marketing enquiry.

A name, email address and message are required to submit the current contact form because we cannot identify or answer the enquiry without them. Other contact-form fields are optional. Future demo booking will use a Pobl form, and Pobl will arrange the meeting directly rather than using a third-party scheduling service.

4.3 Trials, accounts and users

When someone registers for or uses Pobl HR, we may collect:

• name, work email and company name;
• company size, employee count, plan and trial information;
• password credentials in protected, non-readable form;
• two-factor authentication and trusted-device status;
• account preferences, accessibility, appearance and idle sign-out settings;
• roles, permissions, Company membership and Partner access;
• sign-in, session, device-verification, audit and security activity;
• support requests and service communications; and
• other information the user or their organisation chooses to enter or upload.

Some account and security information is processed on a customer's behalf and is governed by the Data Processing Agreement. Pobl may also use limited account, relationship and security information as a controller where necessary to administer the Service, protect its systems, communicate with business contacts and meet its own obligations.

4.4 Billing

When a Subscription begins, we may collect the paying business's identity, billing contact, billing address, plan, employee-count band, invoice details, payment status, transaction references and related correspondence.

Stripe processes payment-method and transaction information. Pobl does not receive or store full payment-card details. Stripe may provide payment status, limited card information such as brand and last four digits, and fraud or authentication results.

4.5 Support and security

We may process communications, support details, audit events, security alerts, sign-in activity, device and browser information, IP addresses and diagnostic information to provide support, protect accounts, investigate incidents and maintain the Service.

Pobl staff manually access a customer's Company or Customer Data for ordinary support, maintenance or investigation only after an administrator of that Company has given consent, except where access is required by law. Access is limited, protected and logged.

Sentry is configured to receive anonymised and minimised technical error information rather than Customer Data. If an error event unexpectedly contains personal information, we treat it in accordance with this policy and, where applicable, the Data Processing Agreement.

5. Sources of information

We obtain personal information:

• directly from the person when they contact us, register or use an account;
• from a Customer or Partner when it names a contact, creates an account or invites a user;
• from the website, Service, browser and device when they generate technical, usage or security information;
• from Stripe when it provides payment status, transaction references and limited billing information; and
• from professional advisers, public authorities or other organisations where necessary for legal, security or business-administration purposes.

6. How and why we use information

Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and balance our interests against the person's rights and reasonable expectations. A person may object as described in section 14.

7. Marketing and service messages

Pobl does not operate a newsletter or mailing list and does not send unsolicited promotional emails. Contact-form details are not added to a marketing list.

We may answer an enquiry, arrange and follow up a requested demo, discuss a product request, or send messages needed to operate an account or Subscription. These may include verification codes, security alerts, invitations, billing notices, service updates and responses to support requests.

8. AI and automated decisions

Pobl HR has no AI functionality. We do not use personal information to train AI models or to make AI-assisted employment or workplace decisions. More information is available in our AI Usage Policy.

Pobl does not make solely automated decisions about individuals that produce legal or similarly significant effects. The Service includes ordinary deterministic automation, such as applying permissions, routing approvals and calculating values from configured rules, but it does not profile people or make employment judgements.

9. Who we share information with

We do not sell personal information. We disclose it only where reasonably necessary for the purposes described in this policy, including to:

• Vercel, which hosts and delivers the marketing website using infrastructure configured in London;
• Microsoft, which provides Microsoft 365 email and mailbox services;
• Amazon Web Services, which provides the Pobl HR application's London-hosted EC2 infrastructure, S3 storage and SES transactional email;
• Stripe, which provides Subscription billing, payment processing, authentication and fraud-prevention services;
• Sentry, which provides minimised technical error monitoring using its EU data-storage region;
• Google, which provides Google Analytics 4 unless the visitor rejects analytics;
• professional advisers, accountants, auditors, insurers and banks where necessary;
• courts, regulators, law enforcement and public authorities where disclosure is required or reasonably necessary; and
• a genuine prospective buyer, investor or successor in connection with a business sale, investment or restructuring, subject to appropriate confidentiality and safeguards.

The organisations listed above may act as processors, independent controllers or both, depending on the activity and their legal obligations. Providers that process Customer Personal Data for Pobl HR are described further in our Data Processing Agreement and subprocessor schedule.

10. International transfers

The Pobl HR application's core hosting and storage is in the AWS Europe (London) region. The marketing website is configured to run through Vercel's London infrastructure. However, some providers or their authorised personnel and subprocessors may process information outside the United Kingdom.

In particular, Vercel, Microsoft, Stripe, Sentry, Google and their service providers may process information in the United States, European Economic Area or other countries.

Where a restricted transfer requires protection, we use or require an applicable United Kingdom adequacy regulation, the UK Extension to the EU-US Data Privacy Framework, the International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another legally recognised safeguard. We use supplementary security measures where required.

You may ask for more information about the safeguards relevant to your information by contacting hello@poblhr.com.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for its purpose, including legal, accounting, security and dispute-resolution requirements. Our usual periods are:

We may keep information longer where required by law, a regulatory request, an unresolved complaint, a reasonably anticipated legal claim or another documented necessity. We may keep information that has been irreversibly anonymised because it no longer identifies a person.

12. Cookies and similar technologies

The marketing website uses necessary local storage to remember a visitor's cookie choice. It also uses Google Analytics cookies by default to measure marketing-website use. Visitors can reject analytics at any time. We do not use advertising, remarketing or behavioural-tracking cookies.

Our Cookie Policy identifies the technologies, purposes, providers and durations and explains how to accept or reject analytics.

13. Security

We use technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. These include encryption in transit and at rest, access controls, logical Company separation, least-privilege administration, multi-factor protection for production access, logging, encrypted backups, security monitoring, testing and incident-management processes.

Users can enable authenticator-based two-factor authentication. New-device verification is required when signing in from an untrusted device, and users can configure idle sign-out periods. No online service is completely secure, so users must also protect their devices, credentials and exports.

14. Your rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information and a copy of it;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be deleted;
• ask for processing to be restricted;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent; and
• complain to the Information Commissioner's Office.

These rights are not absolute and may depend on why the information is processed. We may ask for information needed to verify identity and will respond within the period required by applicable law.

To exercise a right concerning Pobl's controller activities, email hello@poblhr.com. For employee or other HR information controlled by a Pobl HR customer, contact that customer first.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address a concern first, but contacting us is not a condition of making a complaint.

15. Information about children

The marketing website and Pobl HR are business services and are not directed at children. A Customer may use Pobl HR to hold lawful employment records about an employee, apprentice or other worker who is under 18. In that situation, the Customer remains responsible as controller and Pobl processes the information under the Data Processing Agreement.

A child must not independently enter into a Subscription or provide information through the marketing website without appropriate adult or organisational authority.

16. Changes and contact

We may update this policy when our services, providers or legal obligations change. We will update the date at the top and give additional notice where a change materially affects how personal information is used or requires a new choice.

Questions, concerns and rights requests can be sent to hello@poblhr.com.