1. Customer control and HERVIQ’s role
The customer organisation controls which workforce data is placed in HERVIQ, who may access it, which policies and workflows apply, and the purposes for which the platform is used. For customer workforce data, the customer generally acts as controller or business and HERVIQ acts as processor or service provider on the customer’s documented instructions.
HERVIQ may act as an independent controller for limited operational information required to secure accounts, prevent abuse, comply with law, administer subscriptions and maintain business records. Those activities are described in the Privacy Policy.
2. Customer workforce data
Depending on the customer’s configuration, customer data may include:
- Employee identity, contact, employment, department, manager and role information.
- Leave balances, requests, approvals, working calendars and related workflow records.
- Company policies, handbooks, procedures and permission assignments.
- Employment documents, document status, expiry dates and follow-up tasks.
- Questions, prompts, transcriptions, generated responses, citations, confirmations and action history.
- Audit, access, security and administrative records.
Customers are responsible for data accuracy, legal authority, transparency to individuals and avoiding unnecessary or excessive information.
3. Processing on documented instructions
HERVIQ processes customer data to provide, secure, maintain and support the services described in the customer agreement, product configuration and authorised user actions. HERVIQ does not independently determine employment outcomes and does not use customer data for unrelated advertising.
If HERVIQ believes an instruction violates applicable data protection law, it may notify the customer and suspend the affected processing while the issue is reviewed, unless legally prohibited from doing so.
4. Agentic AI processing
HERVIQ uses AI systems to interpret authorised requests, retrieve relevant company information, generate cited responses, prepare workflow steps and execute actions permitted by customer configuration. The platform is designed around role permissions, source controls, confirmation steps and activity records.
HERVIQ does not sell customer workforce data and does not use it to target third-party advertising. Customer data will not be used to train general-purpose models for other customers unless the customer expressly authorises that use under a separate written agreement.
AI output may be incomplete or incorrect. Customers must configure appropriate review and approval controls, especially for decisions that could materially affect employment, compensation, discipline, access or legal rights.
5. Voice input and transcription
Where voice input is enabled, audio is processed to create a text transcription so HERVIQ can handle the request in the chat and workflow interface. The service is designed to minimise retention of raw audio and to retain the resulting text, action and audit records only as required by the customer’s configuration, contractual obligations and applicable law.
Customers are responsible for enabling voice features lawfully, providing required notices and obtaining consent where recording or transcription laws require it. Users should not speak sensitive information that is unnecessary for the requested HR task.
6. Human oversight and consequential actions
HERVIQ is designed to support—not remove—accountable human decision-making. Customers determine which actions may be automated and which require review, confirmation or approval. Consequential actions should remain reviewable and attributable to authorised users.
HERVIQ should not be configured as the sole basis for decisions producing legal or similarly significant effects on individuals unless the customer has determined the processing is lawful, fair, transparent, appropriately validated and subject to required safeguards and human review.
7. Subprocessors and international processing
HERVIQ may engage vetted infrastructure, hosting, AI, communication, monitoring, support and security providers to process customer data. Providers receive only the access reasonably required for their services and are bound by contractual confidentiality, security and data-use restrictions.
Where cross-border transfers require safeguards, HERVIQ uses recognised legal mechanisms appropriate to the relevant jurisdictions. Customer-specific regional hosting, transfer restrictions or subprocessors are governed by the applicable subscription order or data processing agreement.
8. Security and access governance
HERVIQ applies risk-based measures designed to protect customer data, including role-based access, authentication controls, encrypted transport, logical tenant separation, controlled service access, audit records, monitoring, backup protections and secure engineering practices.
Customers remain responsible for user lifecycle management, permission configuration, policy accuracy, secure endpoints, lawful uploads and prompt removal of access when roles change.
Where required by contract or law, HERVIQ will notify the affected customer after becoming aware of a confirmed personal-data breach and provide available information reasonably necessary for the customer’s response obligations.
9. Retention, export and deletion
Customer data is retained while the subscription is active and as needed to provide the service. On termination or expiry, HERVIQ will make customer data available for export where supported and delete or return it in accordance with the agreement, documented instructions and applicable law. Residual copies may remain temporarily in protected backups until overwritten through normal cycles.
HERVIQ may preserve limited information where required by law, necessary to establish or defend legal claims, or required for security and fraud-prevention records. Preserved information remains protected and is not used for unrelated purposes.
10. Individual rights and customer assistance
Individuals should direct requests concerning workforce data to the customer organisation that controls the account. HERVIQ will provide reasonable assistance so customers can respond to valid requests for access, correction, deletion, restriction, objection, portability or review, subject to the customer agreement and applicable law.
HERVIQ will not respond directly to a workforce-data request in a manner that overrides the customer’s lawful instructions, except where required by law. Requests concerning information controlled directly by HERVIQ may be submitted through the privacy channel available within the service.
11. Accountability
HERVIQ maintains privacy and security governance proportionate to the nature of the service and processing risks. Product changes involving new categories of sensitive processing, material automation or significant individual impact are assessed for privacy, security and human-oversight requirements.
Customers remain responsible for their own privacy notices, lawful bases, employment-law obligations, impact assessments and consultation requirements.