Draft for review. This document was prepared as a starting point and has not been checked by a lawyer. Please have counsel review it against how HavernHR actually handles data, and against the jurisdictions you operate in, before launch. Delete this notice once that review is done.
1. About this policy
This policy explains what HavernHR collects when you visit havernhr.com or use the HavernHR platform, why we collect it, and what you can ask us to do about it. It applies to visitors to this website as well as to people who use the product through an employer that subscribes to it.
2. Who we are
HavernHR is operated by [LEGAL ENTITY NAME], registered at 245 Newkirk Avenue 3, Brooklyn, New York, US. For anything relating to this policy, including the requests described in section 10, you can reach us at hello@havernhr.com.
3. Two different roles
The distinction below matters, because it decides who controls a given piece of data.
When you browse this website, contact us, or sign up for a trial, we decide why and how your information is used. In data protection terms we are the controller for that information.
When an employer subscribes to HavernHR and loads employee records into it, that employer decides what goes in, who may see it, and how long it stays. We process that data on their instructions, which makes us a processor. If you are an employee of a HavernHR customer and you want your record corrected or removed, your employer is the right first point of contact. We will support them in responding, though we cannot act on their data without their instruction.
4. Information we collect
Information you give us directly. Your name, work email address, company name, job title, phone number where you provide one, and anything else you type into a form, a support request or a demo booking.
Information created by using the service. Account identifiers, log-in times, IP address, browser and device details, pages viewed, features used, and error reports. We use this to keep the service running, to investigate problems, and to understand which parts of the product are actually used.
Customer data. Employee records that a subscribing organisation loads into the platform. Depending on the modules that organisation has enabled, this can include contact details, employment history, compensation, attendance, leave, performance notes and documents. We hold this on their behalf under the terms of their agreement with us.
Billing information. Company billing details and a record of transactions. Card numbers are handled by our payment processor rather than stored on our systems.
5. Why we use it and on what basis
- To provide the service, administer accounts and deliver support, which is necessary to perform our contract with you or your employer.
- To secure the platform, detect abuse and keep audit trails, which rests on our legitimate interest in running a safe service.
- To improve the product and prioritise what we build, again on the basis of legitimate interest, using aggregated or pseudonymised data wherever that is sufficient.
- To send service notices such as billing, security and downtime messages, which are part of providing the service rather than marketing.
- To send marketing email, which we do only where you have opted in or where an existing business relationship permits it. Every such message carries an unsubscribe link.
- To meet legal, tax and accounting obligations.
6. AI features
Parts of HavernHR use automated processing to draft text, rank candidates, flag anomalies or answer questions about records the requester is already permitted to see. Two commitments are worth stating plainly. First, we do not use one customer’s employee data to train models that other customers benefit from. Second, decisions with a significant effect on a person, including hiring outcomes, disciplinary action, pay and termination, are designed to stay with a human reviewer rather than the software.
[Confirm this section matches the shipped product before launch, and list any third-party model providers used.]
7. Cookies and similar technologies
This website uses cookies that are strictly necessary for the site to function, along with analytics cookies that tell us how the site is used. Analytics cookies are optional and you can refuse them without losing access to anything. Most browsers also let you block or delete cookies from their settings, although doing so may affect how parts of the site behave.
[Add the specific cookie names, providers and retention periods once the analytics and consent tooling is finalised.]
8. Sharing and sub-processors
We do not sell personal information. We share it only in these situations:
- With service providers who host our infrastructure, send our email, process payments or help us support customers. Each is bound by contract to use the data only for the work we have asked them to do.
- With a subscribing employer, where the data belongs to their account.
- Where the law requires it, or to establish or defend a legal claim.
- With a buyer or successor in the event of a merger, acquisition or sale of assets, subject to this policy continuing to apply.
[Maintain a current sub-processor list and link it here. Customers on annual contracts often ask for it during procurement.]
9. International transfers, retention and security
Data may be processed in countries other than the one you live in, including the United States. Where personal data moves out of the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or another recognised transfer mechanism.
We keep account and billing records for as long as the account is active, then for the period our legal and tax obligations require. Customer data is retained according to the subscribing organisation’s instructions and is deleted or returned at the end of their agreement.
We protect data with encryption in transit and at rest, role-based access control, audit logging and regular review of who can reach what. No system is perfectly secure, so we also maintain a process for detecting incidents and notifying affected customers without undue delay.
10. Your rights
Depending on where you live you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, to withdraw consent you previously gave, and to receive your data in a portable format. Write to hello@havernhr.com and we will respond within the period the applicable law allows.
If your data sits inside an employer’s HavernHR account, we will pass your request to that employer and assist them in answering it.
People in the European Economic Area or the United Kingdom may also complain to their national data protection authority.
11. California privacy rights
California residents may request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of parties it was disclosed to. You may also request deletion or correction, and you may ask us to limit the use of sensitive personal information. We do not sell personal information, nor do we share it for cross-context behavioural advertising as those terms are defined under California law. Exercising these rights will not result in worse service or different pricing.
12. Children
HavernHR is a workplace product intended for business use. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, write to us and we will remove it.
13. Changes to this policy
We update this policy when our practices change or when the law requires it. The date at the top reflects the most recent revision. Where a change is material we will tell account holders by email or through a notice in the product before it takes effect.
14. Contact
Questions, requests and complaints about this policy can go to hello@havernhr.com, or by post to [LEGAL ENTITY NAME], 245 Newkirk Avenue 3, Brooklyn, New York, US.