1. Scope and relationship to customer data
This Privacy Policy applies to personal information processed by HERVIQ as an independent controller in connection with its website, account administration, billing, product communications, service security and business operations.
When an organisation uses HERVIQ to process information about its employees, workers, applicants or other authorised users, that organisation normally determines why and how the information is processed. In that context, the organisation is the controller or business and HERVIQ acts as its processor or service provider. Those activities are addressed in the Data Privacy Statement and the organisation’s own privacy notices.
2. Personal information we collect
Information provided directly
- Identity and professional details, including name, business role, employer and account permissions.
- Contact details used to create accounts, communicate about the service and respond to enquiries.
- Subscription, transaction and billing records. Payment-card details are processed by authorised payment providers and are not intended to be stored by HERVIQ.
- Communications, support requests, feedback and records of interactions with HERVIQ.
Information collected through use
- Device, browser, IP address, approximate location derived from IP, timestamps and diagnostic data.
- Authentication events, account activity, feature interactions and security logs.
- Cookie and similar-technology information used for essential operation, preferences, analytics and fraud prevention, subject to applicable consent requirements.
Information received from organisations
An organisation may provide administrator and authorised-user details so that HERVIQ can provision and manage its account. The organisation is responsible for ensuring it has a lawful basis to provide that information.
3. How we use personal information
- Provide, operate, authenticate and maintain HERVIQ.
- Create and administer subscriptions, accounts, roles and permissions.
- Process payments, maintain financial records and prevent fraudulent transactions.
- Deliver requested communications, service notices and support.
- Monitor reliability, troubleshoot errors and improve product usability and performance.
- Protect users, HERVIQ and third parties from misuse, security threats and unlawful activity.
- Comply with legal obligations, enforce agreements and establish or defend legal claims.
- Send relevant product or business communications where permitted, with available opt-out controls for non-essential marketing.
HERVIQ does not sell personal information for monetary consideration. HERVIQ also does not use customer workforce data for third-party advertising.
4. Legal grounds for processing
Where applicable law requires a legal basis, HERVIQ relies on one or more of the following: performance of a contract; steps requested before entering a contract; compliance with legal obligations; legitimate interests in operating, securing and improving the service; protection of vital interests; and consent where consent is required and may be withdrawn.
Legitimate interests are assessed against the rights and reasonable expectations of affected individuals. Withdrawing consent does not affect processing that was lawful before withdrawal.
6. International data transfers
HERVIQ may use infrastructure and service providers located in more than one country. When personal information is transferred across borders, HERVIQ uses legally recognised safeguards where required, which may include adequacy decisions, approved contractual clauses, contractual protections and supplementary security measures. Customer-specific hosting or transfer commitments, when offered, are stated in the applicable order or data processing agreement.
7. Data retention
HERVIQ retains personal information for the period reasonably necessary to provide the service, maintain security and business records, comply with law, resolve disputes and enforce agreements. Retention depends on the nature of the information, the purpose of processing, account status, contractual commitments and statutory limitation periods. Information is deleted or de-identified when it is no longer required, subject to secure backup cycles and lawful preservation requirements.
8. Privacy rights and choices
Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, information about processing, and review of certain decisions. Individuals may also have the right to complain to a competent data protection authority.
Requests relating to data controlled by an employer or other HERVIQ customer should ordinarily be directed to that organisation. HERVIQ will support the organisation as required by contract and law. Requests relating directly to HERVIQ may be submitted through the privacy and support channel available within the HERVIQ service. HERVIQ may verify identity and authority before acting on a request and may retain a record of the request.
HERVIQ will not discriminate against an individual for exercising an applicable privacy right.
9. Security and incident response
HERVIQ applies administrative, technical and organisational measures designed to protect personal information against unauthorised access, alteration, loss, misuse or disclosure. Measures are selected according to risk and may include access controls, authentication, encryption in transit, environment separation, logging, monitoring, backup controls and secure development practices.
No service can guarantee absolute security. Account owners are responsible for protecting credentials, configuring permissions appropriately and promptly reporting suspected compromise.
10. Children
HERVIQ is a business service and is not directed to children for independent consumer use. Organisations must not use HERVIQ to process children’s personal information unless the use is lawful, necessary for an authorised employment or workforce purpose, and covered by appropriate notices, permissions and safeguards.
11. Changes to this policy
HERVIQ may update this policy to reflect service, legal or operational changes. Material updates will be communicated through the website, service or account notice as appropriate. The effective date identifies the current version.
12. Contact and complaints
Privacy enquiries, rights requests and complaints may be submitted through the privacy or support channel available within the HERVIQ service. HERVIQ reviews privacy concerns in good faith and will respond in accordance with applicable legal timeframes. Individuals retain the right to contact the competent supervisory or data protection authority in their jurisdiction.