Privacy policy
1. Who we are
This privacy policy explains how Elev8ed HR Ltd ("Elev8ed", "we", "us", "our") collects and uses personal data. We are a company registered in England and Wales under company number 16665064 with our registered office at 139 Longmeanygate, Midgehall, Leyland, Preston, PR26 6TD.
We provide an employee relations (ER) case management platform with an AI case co-pilot (the "Platform"), together with HR consultancy services. We are registered with the Information Commission under registration number ZC094762.
Joanna Griffin, Director, is responsible for data protection at Elev8ed HR Ltd and can be contacted at Joanna@elev8edhr.co.uk or by post at the registered office address above.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
2. What this policy covers, and our two roles
We handle personal data in two different capacities. Which one applies to you determines who is responsible for your data and who you should contact.
2.1 Where we are the controller
We are the controller of personal data that we collect and use for our own purposes. This policy applies in full to that data. It covers you if you:
- visit our website;
- join our early access list or subscribe to our news and updates;
- contact us, by email, through a form or otherwise;
- hold a user account on the Platform (for example as an HR professional, manager or invited case participant) in respect of your account, billing, support and security information;
- are a contact at a customer, prospective customer, supplier or other business we deal with; or
- engage us for HR consultancy or training services.
2.2 Where we are a processor for our customers
Our customers (employers and HR consultancies) use the Platform to manage ER cases such as disciplinaries, grievances, absence and performance matters. The case content they put into the Platform includes personal data about employees, witnesses and others, and can include special category data such as information about health, disability, pregnancy or maternity and trade union membership.
For that case content, our customer is the controller and we are its processor. We handle it only on the customer's documented instructions under a written data processing agreement. The customer decides what is collected, why, on what lawful basis and for how long it is kept.
If you are an employee, witness or other person whose information appears in a case, the privacy notice that applies to you is the one issued by your employer (or the organisation handling the case). Requests to exercise your rights should be sent to that organisation. If you contact us instead, we will pass your request to the relevant customer and assist them in responding. Section 9 gives a summary of how we handle case content so that you can see what happens to it.
3. The personal data we collect
| Who you are | Personal data we collect |
|---|---|
| Website visitors | IP address and technical information about your device and browser, recorded in server and security logs; pages visited and the page on which you completed a form; cookie and similar identifiers, as described in section 7. |
| Early access and news subscribers | Email address; name and business name; the page you signed up on; the date and record of your consent; your marketing preferences; and, where you have consented, whether you open our emails and click on links in them. |
| People who contact us | Name, email address, business name, any other contact details you give us and the content of your message and our reply. |
| Platform account users | Name, email address, login identity and authentication data (including two-factor authentication settings); your organisation and role within it; business profile details such as company name, HR contact, logo and letterhead; account settings; records of consents given in the Platform; audit records of actions taken in your account (what was done, when, and the IP address and browser used); usage and metering data (volume of AI usage per user and case, not its content); the ratings and comments you give on the Platform's letters and co-pilot answers; and support correspondence. |
| Customer and billing contacts | Name, role, business contact details, subscription and invoicing records and payment status. Card details are entered directly with our payment provider, Stripe, and are not stored by us. |
| Business contacts, suppliers and advisers | Name, role, organisation, business contact details and correspondence. |
| Consultancy and training clients | Name, role and contact details of client contacts, and information supplied to us for the purpose of the engagement. We are the controller for training and our own consultancy records; where we handle a client's employee casework for them, we act as their processor under a data processing agreement. |
We do not ask you for special category data (such as health information) or criminal offence data for our own purposes, and we ask that you do not include it in enquiries or support requests unless it is necessary. Special category data that customers enter into cases is handled as described in section 9.
4. Where we get your personal data
Most of the personal data we hold comes directly from you, when you complete a form, create or use an account or correspond with us. We also obtain personal data:
- from your organisation or another Platform user, where they create an account for you or invite you to take part in a case (name, email address and role);
- automatically, when you use our website or the Platform (technical, log and usage data); and
- from publicly available business sources such as Companies House, company websites and professional networking sites, where we identify business contacts.
5. How we use your personal data and our lawful bases
We only use personal data where the law allows us to. The table sets out our purposes, the lawful basis under Article 6 of the UK GDPR that we rely on for each and, where we rely on legitimate interests, what those interests are.
| Purpose | Lawful basis | Legitimate interest, where relevant |
|---|---|---|
| Creating and managing your Platform account and providing the Platform to you and your organisation | Performance of a contract (Art. 6(1)(b)) where the contract is with you; otherwise legitimate interests (Art. 6(1)(f)) | Providing the service our customer has contracted for to its authorised users. |
| Billing, collecting payment and keeping accounting records | Performance of a contract; legal obligation (Art. 6(1)(c)) for tax and accounting records | |
| Sending service messages, such as invitations, case digests, security alerts and notices of changes to the service or our terms | Performance of a contract; legitimate interests | Keeping users informed about the service they use. |
| Responding to enquiries and providing customer support | Legitimate interests; performance of a contract (or steps before entering one, at your request) | Answering people who contact us and supporting our users. |
| Sending marketing emails to our early access and news lists | Consent (Art. 6(1)(a)) | |
| Measuring opens and clicks in our marketing emails | Consent | |
| Contacting business contacts at prospective customers about our services | Legitimate interests | Promoting and growing our business, in a way a business contact would reasonably expect, with the right to opt out at any time. |
| Keeping the website and Platform secure: authentication, audit logging, rate limiting, error monitoring, and preventing and investigating misuse | Legitimate interests; legal obligation (security of processing) | Protecting our systems, our customers and the data held on the Platform. |
| Metering usage and understanding how the website and Platform are used, in order to manage costs and improve them | Legitimate interests; consent where required for non-essential cookies | Operating the service efficiently and improving it. We use aggregated or content-free data for this wherever we can. |
| Delivering HR consultancy and training services | Performance of a contract; legitimate interests | Delivering the services the client has engaged us for. |
| Handling data protection requests and complaints, and complying with our legal and regulatory obligations | Legal obligation | |
| Establishing, exercising or defending legal claims, and taking professional advice | Legitimate interests | Protecting our legal position. |
| A sale, merger or reorganisation of our business | Legitimate interests | Enabling an orderly transfer of the business, subject to confidentiality. |
6. Marketing
We send marketing emails to individuals who have asked to receive them by joining our early access list or news list. We may also send marketing emails to existing customers about similar services, where they were given the chance to opt out when their details were collected and in every message.
You can withdraw your consent or opt out at any time, free of charge, by using the unsubscribe link in any marketing email or by contacting us at privacy@elev8edhr.co.uk. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it. When you unsubscribe, we keep your email address on a suppression list so that we do not email you again.
We do not sell personal data, and we do not share it with third parties for their own marketing.
7. Cookies and similar technologies
Our website and the Platform use cookies and similar technologies. Some are strictly necessary, for example to keep you signed in and to protect the service against attack, and do not require consent. Any analytics or other non-essential cookies are used only as permitted by PECR: with your consent or, for aggregate statistical cookies, with clear information and a simple way to object. Our marketing emails may contain tracking that records opens and clicks; we use this only where you have consented.
This website sets no cookies of its own and runs no analytics. The product film is embedded through YouTube's privacy-enhanced mode and loads only when it scrolls into view; from that moment YouTube's own privacy policy applies. For details of the cookies the Platform uses and how to control them, see our cookies policy.
8. Who we share your personal data with
We share personal data with the service providers listed below, who act as our processors under written contracts that require them to protect the data and use it only on our instructions.
| Category of provider | Description |
|---|---|
| Marketing and customer relationship management providers | Maintain our early access and news subscriber lists and send marketing emails on our behalf. |
| Website delivery, security and file storage providers | Deliver and protect our website, route form submissions and store files uploaded to the Platform. |
| Email hosting providers | Host our business email mailboxes. |
| Authentication providers | Manage user sign-in and authentication for the Platform. |
| Application hosting providers | Host and operate the Platform application. |
| Database hosting providers | Host and maintain the Platform database. |
| Service email providers | Send operational emails, such as Platform invitations and case digests. |
| Backup storage providers | Store encrypted database backups. |
| Payment service providers | Process subscription payments. They may also act as independent controllers for purposes such as fraud prevention and regulatory compliance, as explained in their own privacy notices. |
| AI service providers | Process relevant case content to generate responses for the AI case co-pilot, as described in section 9. |
We may also share personal data with:
- your organisation, where you use the Platform under its account. Account owners can see the actions that participants take on their cases;
- our professional advisers, such as lawyers, accountants and insurers, under duties of confidentiality;
- regulators, courts, law enforcement bodies and others, where we are required to by law or where it is necessary to establish, exercise or defend legal claims; and
- a buyer or successor, and its advisers, if we sell, merge or reorganise all or part of our business. We will tell you if this results in a change of controller.
9. Case content and how the AI co-pilot works
This section summarises how we handle case content on behalf of our customers. The customer, as controller, remains responsible for telling the individuals concerned how their data is used.
9.1 What case content includes
Case content can include an employee's name, role, department, start date and line manager; allegations, grievance points, background and outcomes; risk flags and detail relating to disability, pregnancy or maternity, health and trade union membership; uploaded evidence such as documents, contracts and witness statements; witness details and notes; and the transcripts of conversations with the AI co-pilot.
9.2 How the AI co-pilot uses it
- The co-pilot assists HR professionals. It does not make decisions about individuals. Decisions in a case are made by people at the customer organisation.
- When a user asks the co-pilot for help, relevant case content is sent to our AI provider, Anthropic, to generate a response. Anthropic processes it in the United States.
- Anthropic is contractually prohibited from using this content to train its models, and we have not opted in to any such use.
- Anthropic deletes inputs and outputs from its systems within 30 days. Content flagged by Anthropic's automated trust and safety systems, or which Anthropic is legally required to keep, may be retained by Anthropic for up to two years.
- Our own logs of AI activity record technical measurements only (such as volume, speed and success), not the content of messages.
9.3 Storage, retention and deletion
- The Platform application and its database are hosted in the European Economic Area, and uploaded files are stored in the EU.
- Each customer sets how long closed cases are kept after the employee's employment ends. When that period ends, after 30 days' notice to the customer and never while a case is on legal hold, the case is anonymised: files and co-pilot transcripts are deleted and only a non-identifying record (case type, dates, risk level and outcome) is kept for the customer's own reporting.
- Encrypted backups are kept for 90 days.
- Access to case content is limited to the customer's authorised users: the organisation's owner and Admins, who can see all of that organisation's cases, and other users only for the cases they are invited to. Actions on a case are recorded in an audit log.
10. International transfers
We are based in the UK, and our main hosting providers hold data in the European Economic Area (EEA). Some of our service providers are based in or may access data from countries outside the UK. Our AI, authentication, service email and backup storage providers are based in the United States. When we transfer your personal data outside the UK, we only do so to entities that offer our users the same level of data protection as that afforded by the UK Data Protection Act 2018:
- we will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or
- we will use specific contracts approved for use in the UK which give personal information the same protection it has in the UK, for example the Article 46 UK GDPR safeguard mechanisms for transferring personal data endorsed by the UK Government.
11. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes set out in this policy, including to meet legal, accounting and reporting requirements.
| Data | How long we keep it |
|---|---|
| Platform account data | For as long as the account is active and for 12 months after it is closed, unless you or your organisation ask us to erase it sooner. On erasure, content and stored files are deleted and the account is anonymised. |
| Audit logs | For as long as the account is active and for 24 months after it is closed. Entries record that actions took place but do not contain case content. |
| Billing and accounting records | Six years from the end of the financial year to which they relate. |
| Enquiries and support correspondence | 24 months after our last contact with you. |
| Early access and news list data | Until you unsubscribe or withdraw consent, or after 24 months without engagement. We then keep your email address on a suppression list. |
| Business contact data | For as long as we have a business relationship or a reasonable prospect of one, reviewed every 24 months. |
| Website and security logs | 24 months. |
| Database backups | 90 days. |
| Records of data protection requests and complaints | Six years after the request or complaint is closed. |
We may keep data for longer where we need it to deal with a legal claim or a complaint, or where the law requires it. Retention of case content is set by the customer as described in section 9.
12. Your rights
Under UK data protection law you have the following rights in relation to the personal data for which we are the controller:
- Access: to be told whether we process your personal data and to receive a copy of it.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have your data deleted in certain circumstances, for example where we no longer need it or you withdraw consent.
- Restriction: to ask us to limit how we use your data in certain circumstances, for example while we check its accuracy.
- Objection: to object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time.
- Data portability: to receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller, where we process it by automated means on the basis of consent or contract.
- Withdrawal of consent: where we rely on your consent, to withdraw it at any time.
- Automated decisions: rights in relation to significant decisions made solely by automated means (see section 13).
To exercise any of these rights, contact us at privacy@elev8edhr.co.uk. There is normally no charge. We may need to confirm your identity, or ask you to clarify your request, before we act. We will respond within one month; if a request is complex or you have made several, we may extend this by up to two further months and will tell you if so. Some rights are subject to conditions and exemptions and we will explain if one applies.
If your request relates to case content held on the Platform by one of our customers, please contact that organisation (see section 2.2).
13. Automated decision-making
We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. The AI co-pilot provides guidance and drafting support to HR professionals who remain responsible for the decisions made in any case.
14. Keeping your data secure
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encryption, access controls and secure backups, appropriate to the sensitivity of the data we handle.
15. Other information
15.1 If you do not provide personal data
You are not required by law to give us personal data. However, we need certain information to create an account and provide the Platform under our contract with you or your organisation. If you do not provide it, we may be unable to give you access.
15.2 Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 for our own purposes. If you believe we have done so, please contact us and we will delete it.
15.3 Links to other websites
Our website may link to websites operated by others. This policy does not apply to those websites, and you should read their privacy policies.
15.4 Changes to this policy
We keep this policy under review and will update it when our processing changes. The current version, with the date it was last updated, is always on our website. Where a change is significant, we will tell account holders and subscribers directly.
16. Questions and complaints
If you have a question about this policy or about how we handle your personal data, please contact us by email at privacy@elev8edhr.co.uk or by post at 139 Longmeanygate, Midgehall, Leyland, Preston, PR26 6TD.
16.1 Complaining to us
You have the right to complain to us if you think we have not complied with data protection law. You can do so by email or post using the details above. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed of progress and tell you the outcome.
16.2 Complaining to the regulator
You also have the right to complain to the Information Commission (ICO), formerly the Information Commissioner's Office. The ICO will normally expect you to have raised your complaint with us first.
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
16.3 Version control
This policy was last updated in November 2026.