Privacy Notice

Harri Technologies (UK) Limited

Regency House, 33 Wood Street, Barnet, Hertfordshire, England, EN5 4BE

You can contact Harri at DPO@harri.com.

Website Visitors

We only collect and process information about our website visitors when they consent to our use of cookies. If you consent, then we will record your computer’s IP address, unique mobile device identifier, browser type, ISP or carrier name, and the URL of the last webpage you visited before visiting our website. This information gives us insights on how our users use our site and our services. We use this information to ensure that our service continues to appeal to our users and to monitor overall usage trends, metrics, page views, etc.

Legal basis: consent. See our Cookie Notice for more information on the retention periods.

Cookies, Analytics and Tracking

We use essential, performance, marketing, and analytics cookies to collect your usage, device, and location information (determined through your IP address) when you interact with the Services. We will only use essential cookies without your consent.

We will only use the following cookies and pixels with your consent:

• Google Analytics
• Google Tag Manager
• DoubleClick
• Meta Pixel

We will use the data obtained from these cookies and pixels for benchmarking purposes and for internal analytics. We maintain and use this data in deidentified form.

Legal basis: consent.

See our Cookie Notice for more information on the retention periods.

If You Contact US:

If you contact our customer support team, we will collect and use your name, work email address, work phone number, job title, the name of the company that you work for and information about how we can help you. We use this information to answer your query or schedule your demo and to provide additional information regarding the solution(s) you are interested in.

Legal basis: our legal basis for processing your data initially is consent, as you choose to send us a message. Our legal basis for contacting you further regarding our solutions is legitimate interest.

Data retention period: if you don’t go forward with a solution, we will keep your data for 120 days in our ticket system and then archive it. If your company engages with Harri, then we will retain your information for as long as you work for that company.

If Your Company Partners with US:

If the company partners with Harri, we will use your name, work email address, work phone number, job title, the name of the company that you work for to contact you and to facilitate the business relationship between Harri and the company.

Legal basis: our legal basis using your personal data is legitimate interest.

Data retention period: we will retain your information for as long as you work for that company.

If You Use Our AI Chatbot

If you use our AI chatbot, we will collect and use the information that you provide to us.

We will only collect your IP address, location and any device identifiers if you consent to our use of cookies. If you don’t consent to our use of cookies, then we won’t collect this data.

Legal basis: our legal basis is your consent, both for using the chatbot and agreeing to our cookies.

Data retention period: we will keep this information for 120 days in our systems and then archive it.

Marketing Emails

We send marketing emails to work email addresses of people in organisations that would be interested in using our platform.

You can also sign up to receive our marketing emails on our website.

You are free to unsubscribe at any time and we always have an ‘unsubscribe’ link in each email.

If you consent to our tracking and marketing cookies, these emails will analyse whether a predefined action took place by a recipient, such as opening our emails and other engagement metrics such as timestamps, delivery status, click rate (of links within an email), bounce rate, and reply rate. We also use these metrics to better adapt and distribute our emails, as well as to identify top engaged email recipients. We will only use these cookies with your consent.

Legal basis: consent if you sign up for our marketing emails on our website. We use legitimate interest to conduct business to business marketing.

Retention period: we will keep your email on our marketing list until you unsubscribe. We will then keep your email on a suppression list for five years so that we don’t contact you again by mistake. Having a suppression list is a legitimate interest.

Harri Profile – Job Applicants

Creating a Harri profile

If you wish to apply for a job on our website, then you will need to create a Harri profile and enter your personal data. Harri is the controller for your Harri profile. You can use your Harri profile to apply for jobs for companies that use Harri.

When you create a Harri profile, we will collect your:

• name
• email address
• phone number
• photograph, if you wish
• employment details (employer, position, duties, dates)
• references, if you wish
• education (institution, location, qualification, dates)
• any additional information you choose to include in your Harri profile

We use this information to create and manage your account and authenticate you.

You can choose to be added to our Talent Community. Being part of our Talent Community allows us to send you jobs that you might be interested in, and it also makes your profile searchable and contactable by employers who can invite you to apply for positions.

If you don’t want to receive emails from Harri, please click the ‘unsubscribe’ link at the bottom of each email.

Legal basis: your consent. You consent to create a Harri profile and consent to join the Talent Community.

Retention period: we will keep your Harri profile active until you request that we delete your profile. We will delete your profile within two days of receiving your request.

Using your Harri profile to apply for a job or engaging with job boards

If you apply for a job, we will share the personal data in your Harri profile with the employer. The employer then becomes the controller for your data and Harri becomes the processor. As the controller for the recruitment process, the employer will have access to your application and will be able to use it to assess your suitability as a candidate with them. For example, the employer can use Harri to schedule interviews, make recruitment notes and to ask you specific questions during the recruitment process. The processing of your information by each employer is subject to the employer’s privacy notice.

If you are hired by an employer, they may use Harri to manage their workforce. Please see your employer’s privacy notice for more information about how they do this.

Data deletion requests:

Harri can delete your Harri profile. We can’t delete your data that is held by an employer. If you ask us to delete your data, we will forward your request to the employer.

Subject access requests:

We can provide you with the data in your Harri profile. We can’t provide you with any data that is held by an employer such as recruitment or employment data. If you ask us for this information, we will forward your request to the employer.

Legal basis: our legal basis sharing your Harri profile with an employer is your consent when you apply for a job with that employer.

Data retention period: if you have applied for a job using your Harri profile and/or you are employed by an employer that uses the Harri platform to manage their workforce, Harri is the processor for that personal data. The employer decides the retention periods for the personal data that is held by them in the Harri platform and all data is retained in accordance with the employer’s privacy notice.

Social Media

Interacting with us on social media

We maintain social media pages on Facebook, X, LinkedIn, Instagram and YouTube (our “Social Media Pages”). When you visit or interact with these pages, we and the relevant social media platform may process personal data about you. Our respective responsibilities depend on the platform, the features used and the processing involved.

Managing our Social Media Pages

When you interact with our Social Media Pages, we may receive your name, username, profile photograph and any information you provide through comments, messages, reactions, reviews or shared content. The information available to us depends on your interactions and the platform’s settings.

We use this information to manage our pages, respond to enquiries, moderate contributions, communicate with users, understand engagement with our content and analyse how our content is perceived and improve our public relations efforts.

Information you publish on publicly accessible pages may be visible to other users and may be copied or shared by them. Public availability does not remove the legal protections applying to your personal data.

Legal basis: We rely on our legitimate interests in maintaining our social media presence, responding to enquiries and improving our communications.

Page Insights and audience statistics

Social media platforms may provide us with audience statistics and engagement reports, sometimes called “Page Insights”. Depending on the platform and features used, these may include aggregated information about audience demographics, approximate locations, devices, reach, reactions, comments, shares, clicks and video views.

Although the reports we receive may be aggregated or anonymous, the platform will process personal data to produce them. This may include information about visits and interactions, online identifiers and information collected through cookies or similar technologies.

For certain Insights activities, we and the platform may act as joint controllers for the processing used to generate these reports. Receiving only aggregated or anonymous reports does not, by itself, exclude our responsibility for that underlying processing.

Where we are joint controllers, our arrangement with the platform allocates responsibilities for matters such as providing privacy information and responding to individuals’ rights requests. You may exercise your rights against either joint controller, regardless of that allocation. You may contact us at DPO@harri.com.

Legal basis: we will receive this information if you consent to our use of social media trackers.

Advertising and marketing

We may publish promotional content on our Social Media Pages. Where we use platform advertising tools to select audiences, personalise advertisements or measure campaign performance, this may involve additional personal data processing and joint controller responsibilities. Neither we nor the social media platform will use your personal data if you do not consent to our use of social media cookies or pixels.

Liking, following or commenting on our pages does not, by itself, mean that you consent to receive promotional private messages or to every use of your information for advertising.

Where we send promotional direct messages, we comply with the applicable electronic marketing rules, including obtaining consent where required.

You have the right to object at any time to our processing of your personal data for direct marketing, including profiling related to that marketing.

Legal basis: your consent.

Cookies and similar tracking technologies

Social media platforms may use cookies, pixels, local storage, advertising identifiers or other technologies when you visit our Social Media Pages or use their applications. These technologies may support platform functionality, audience measurement, personalised advertising or tracking across services.

Where applicable law requires consent for storing information on, or accessing information from, your device, that consent must be obtained before the relevant activity takes place. A subsequent aggregated report does not remove any consent requirement applying to the underlying tracking.

Legal basis: your consent.

Processing undertaken independently by social media platforms

Platforms also process personal data for purposes they determine independently, including operating their services and, where applicable, advertising. Our responsibility for jointly determined processing does not extend automatically to every processing activity undertaken by a platform.

For information about each platform’s processing, retention, disclosures, international transfers and privacy controls, please see:

• Facebook’s Privacy Policy
• X’s Privacy Policy
• LinkedIn’s Privacy Policy
• Instagram’s Privacy Policy
• YouTube and Google’s Privacy Policy

Retention and your rights

[How long does Harri retains social media messages, identifiable engagement information, exported reports and advertising audience data, or the criteria used to determine those periods]

You can contact us about our processing or request removal of content from pages we manage at DPO@harri.com. Our ability to remove content is limited to the content and functions within our control; copies shared by others or retained by the platform may require a separate request to them.

Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object to the processing.

Service or product providers:

We will share your personal data with service providers that assist us with the following: IT support; website hosting; cloud storage; data analysis; customer service; email delivery; marketing; external auditors; payment processing; benefits administration; and similar services.

Legal basis: legitimate interest

Law enforcement, courts or regulators:

We share personal information where we are legally required to do so, such as in response to court orders, subpoenas, governmental/regulatory bodies, law enforcement or legal process, including for national security purposes.

Legal basis: legal obligation or the legitimate interests of a third party

For legal purposes:

We may share your information with our legal advisors or auditors to establish, protect, or exercise our legal rights or as required to enforce our terms of service or other contracts or to defend against legal claims or demands. We also share this information with third parties as necessary to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person; to comply with the requirements of any applicable law; or to comply with our legal obligations.

Legal basis: legitimate interest or legal obligation

Corporate reorganisation or sale:

In a business transfer, customer information is typically one of the business assets that are transferred. If we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any portion of our business, assets or stock, we will share personal data with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We will also share personal information with third parties if we undergo bankruptcy or liquidation during such proceedings.

Legal basis: legitimate interest

We share your personal data between our offices in the USA, UK, Palestine and India in order provide the software service and for administrative reasons. The USA, Palestine and India are non-adequate countries for data transfers and we use the UK’s International Data Transfer Agreement (IDTA) as our transfer safeguard.

For the EU, we use the Commission’s Standard Contractual Clauses.

Legal basis: we share your data between our entities using the legal basis of legitimate interest as the sharing is for administrative and business purposes.

Harri does not use any automated decision making in the creation of your Harri profile.

However, an employer might use automated decision-making in their recruitment questions. Please read their Privacy Notice for more information on their recruitment process.

The security of your personal data is important to us and we strive to implement and maintain reasonable, commercially acceptable security procedures and practices appropriate to the nature of the information we store, in order to protect it from unauthorized access, destruction, use, modification, or disclosure.

We will only collect the information of people who are aged 14 and older. If we learn that we have collected the information of someone who us under the age of 14, we will delete that data. Please contact our DPO if you think that we have the data of someone who is under the age of 14.

You have the following rights in relation to the personal data we hold about you:

•Your right of access

If you ask us, we’ll confirm whether we’re processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.

•Your right to rectification

If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we’ve shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

•Your right to erasure

You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we’ve shared your personal data with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

•Your right to restrict processing

You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

•Your right to data portability

You have the right, in certain circumstances, to obtain personal data you’ve provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

•Your right to object

You can ask us to stop processing your personal data, and we will do so, if we are:

orelying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or

oprocessing your personal data for direct marketing purposes.

•Your right to withdraw consent

If we rely on your consent as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.

•Your right to lodge a complaint with the Information Commissioner in the UK or the Supervisory Authority in your country

If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the IC or another Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach the IC or another Supervisory Authority so please contact us in the first instance.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due.

The IC can be contacted at:

Information Commissioner

Wycliffe House

Water Lane

Wilmslow

Cheshire

Sk9 5af

Telephone: 0303 123 1113

Fax: 01625 524510

Our EU representative is Kristy Gouldsmith from Spencer West and she can be contacted at EUrep@harri.com.

We post the updated notice with a revised last-updated date. Where a material change requires additional notice or consent, we provide that notice or obtain consent before applying the change as required by law. We review this notice at least annually. Continued use does not replace affirmative consent where required.