Privacy policy.

KivoHR is provided by Sitenet Tech Ltd, company number 12750911, registered at 406-410 Eastern Avenue, Ilford, England, IG2 6NQ. We are registered with the Information Commission (the ICO) under number ZB665751.

For the personal data described in this policy, we are the controller: we decide how and why it is used.

This policy covers people who visit our website, ask us for a demo, sign up for or use an account, or are a contact at one of our customers.

• When you ask for a demo: your name, work email, organisation, its size, whether it sponsors workers, and anything you choose to tell us.
• When you sign up or use an account: your name, work email and organisation, and your password, which we store only in scrambled (hashed) form and can never read.
• When you ask our website to email you (a free tool’s reminder, a checklist or a template): your email address, what you asked for and its date, whether you also asked for news, and when you confirmed it.
• When you pay: invoicing details such as your organisation’s billing address, VAT number and purchase order number.
• When you contact support: what you send us, and our replies.
• Automatically: technical information such as your IP address, browser and the pages you request, kept in our server logs to run and protect the service.
• Website statistics, only if you agree: the pages you visit on our website, the site that sent you, and your browser, device type and country, counted by Plausible Analytics without cookies and without identifying you. Plausible does not store your IP address. It is not used inside the app.
• Bot checks: where one of our forms shows a Cloudflare Turnstile check, Cloudflare looks at signals from your browser and device, including your IP address, to tell a person from an automated program. It is not used for advertising.
• Your organisation’s public record: if you look up your organisation at Companies House when setting up your account, we send Companies House the name or number you type, and record the company’s name, number, registered office and status from its public register.

The inspection readiness check on our website runs entirely in your browser. Your answers are not sent to us.

UK data protection law requires a lawful basis for each use:

• To provide the service to our customers and their users, and to support it: performing our contract with your organisation.
• To answer a demo request or enquiry, and follow it up: our legitimate interest in responding to people who ask about our product.
• To send what you asked our website to email you, and nothing else unless you agreed to news: our legitimate interest in answering your request.
• To invoice and keep financial records: our contract, and our legal obligation to keep accounting records.
• To keep the service secure, prevent fraud and misuse (including bot checks), and fix faults: our legitimate interest in running a safe service.
• To understand how our website is used, in total and without identifying anyone: your consent, given in our cookie settings, where you can withdraw it at any time.
• To tell you about service changes that affect your account: our contract.
• To send marketing: only if you have agreed, or as an existing customer contact where the law allows. Every message lets you opt out.

We never sell personal data. We share it only with:

• service providers who help us run KivoHR, under contracts that require them to protect it and use it only for us: Laravel Cloud (hosting), Cloudflare (file storage, network and Turnstile), Resend and Amazon SES (email), Laravel Nightwatch (error tracking), Stripe (payments) and Plausible (website statistics). The full list, with where each processes data, is in our data processing agreement;
• Companies House, only the name or number you look up;
• professional advisers, such as accountants and lawyers, where needed;
• authorities, where the law requires us to; and
• a buyer of our business, if it is sold, under the same protections.

Our hosting is in the UK and our file storage in the EU, which UK law treats as adequate. If a provider processes personal data outside the UK, we make sure it is protected as UK law requires: the country is covered by UK adequacy regulations, or the transfer is made under the UK’s International Data Transfer Agreement or an equivalent safeguard.

• Demo requests and enquiries: up to two years after we last heard from you, unless you become a customer.
• An unfinished sign-up: 90 days after your last activity.
• Something you asked our website to email you: 90 days after we send it, or 30 days if you never confirm a reminder; for as long as you want our news, if you agreed to it.
• Security events and our log of emails sent: 13 months.
• Account data: for as long as the account exists. When an organisation leaves, its account stays read-only for 90 days and is then deleted as our terms describe.
• Our record of an organisation that has left (its name, agreement dates, plan, invoices, our staff’s access to it and its deletion request): six years, for tax and legal claims. Support conversations are kept for the same period with names and email addresses removed.
• Backups: 35 days.
• Invoices and financial records: six years, as UK tax law requires.
• Server logs: for a short period, unless we need them to investigate a security problem.

Under the UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong, or complete it if it is incomplete;
• delete it, where we no longer have a reason to keep it;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• give it to you, or another organisation, in a portable format; and
• stop using it for marketing, at any time.

Where we rely on your consent, you can withdraw it whenever you like. We will reply within one month. There is normally no charge.

We use only the cookies the site and app need to work, and ones that remember choices you make. We use no advertising, analytics or tracking cookies. Our website statistics (Plausible) set no cookies, and run only if you agree.

You can change your choices at any time in our cookie settings, linked at the foot of every page.

If we ever add a cookie that is not essential, it will stay off until you agree, and we will list it here.

We protect personal data with measures appropriate to it, including keeping each organisation’s data separate, two-factor sign-in, and limits on sign-in attempts. Our security page explains them in plain English.

We will update this policy when what we do changes, and change the date at the top. If a change matters to you, we will tell you before it takes effect.

To exercise your rights or ask about this policy, email support@kivohr.com, or write to us at 406-410 Eastern Avenue, Ilford, England, IG2 6NQ.

If you are unhappy with how we have handled your data, you can complain to the Information Commission (the ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put it right first.