Privacy Policy

1.Who We Are

Build Your Vision Ltd ("Build Your Vision", "we", "us", "our") is a company registered in England and Wales under company number 12595924, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We provide People Hub, a cloud-based people operations and HR management platform, at byvpeoplehub.com.

This Privacy Policy explains how we collect, use, share, and protect personal data in connection with the Service. It should be read alongside our Terms and Conditions and, where applicable, the Data Processing Agreement between Build Your Vision and its business customers.

Data protection contact: info@buildyourvision.co.uk.

2.Scope and the Two Roles We Play

This policy covers two different relationships, and it matters which one applies to you:

As data controller: We are the controller of personal data relating to our direct customers — the founders, business owners, and account administrators who sign up for People Hub, browse our website, or contact our sales and support teams. Section 3 onwards explains how we handle this data.

As data processor: Where a Customer (an employer using People Hub) uploads or enters data about its own employees — such as personal details, medical forms, risk assessments, absence records, and performance reviews ("Employee Data") — we process that data only on the Customer's instructions, as their data processor. The Customer is the data controller for that data and is responsible for its own privacy notices to its employees. If you are an employee whose employer uses People Hub and you have questions about your data, please contact your employer in the first instance; our role and obligations as processor are set out in Section 9 and in our Data Processing Agreement.

3.Personal Data We Collect (as Controller)

We collect the following categories of personal data about Customer account administrators, prospective customers, and website visitors:

• Identity and contact data: name, job title, company name, email address, telephone number.
• Account data: login credentials, account preferences, Subscription tier and billing history.
• Payment data: billing address and payment details, processed via our payment provider (we do not store full card numbers ourselves).
• Communications: records of correspondence, support requests, and account manager calls or meetings.
• Usage data: how you interact with the Service, including log-in times, pages viewed, and feature usage, collected via cookies and similar technologies.
• Marketing preferences: your choices about receiving marketing communications from us.

4.How We Use This Data and Our Legal Basis

We use personal data for the following purposes, relying on the legal bases indicated:

• To create and administer your account, and provide the Service you have subscribed to — necessary for performance of our contract with you.
• To process payments and manage billing — necessary for performance of our contract, and to comply with legal obligations (e.g. tax records).
• To provide customer support, onboarding, and account management — performance of our contract and our legitimate interest in providing a good service.
• To send you service-related communications (e.g. updates to these terms, security notices) — necessary for performance of our contract and legal obligations.
• To send you marketing communications about People Hub — based on your consent, or our legitimate interest where permitted by law; you can opt out at any time.
• To improve the Service, understand usage patterns, and for internal analytics and reporting — our legitimate interest in developing and improving our product.
• To detect, investigate, and prevent fraud, misuse, or security incidents — our legitimate interest in protecting the Service and our customers, and legal obligations.

5.Cookies

We use cookies and similar technologies to operate the Service (e.g. keeping you logged in), understand usage (analytics), and, where you consent, for marketing purposes. You can control cookies through your browser settings and, where provided, our cookie preference tool. The specific cookies we use, their providers and durations are listed in our Cookie Policy.

6.Who We Share Data With

We share personal data with:

• Sub-processors and service providers who support the Service, such as cloud hosting (e.g. our infrastructure providers), payment processing, email delivery, and customer support tooling — each bound by contractual data protection obligations.
• Professional advisers, including lawyers, accountants, and insurers, where necessary.
• Regulators, law enforcement, or other third parties where required by law, or to establish, exercise, or defend legal claims.
• A buyer or successor entity in the event of a merger, acquisition, or sale of some or all of our business or assets, subject to appropriate safeguards.

We do not sell personal data to third parties.

7.International Transfers

Our sub-processors may store or process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses as adapted for UK use, as applicable. Our key sub-processors and their locations are: Convex (database and file storage) — EU (Ireland); Vercel (website and application hosting) — EU (Dublin, Ireland), with pages delivered through Vercel's global network; and Resend (email delivery) — [sending region · to be confirmed]. The full list is in Annex 3 of our Data Processing Agreement.

8.How Long We Keep Data

We retain personal data for as long as necessary to provide the Service and for a reasonable period afterwards to meet legal, accounting, or reporting requirements, resolve disputes, and enforce our agreements. Account and billing records are typically retained for [6 years · to be confirmed] after account closure to meet UK tax and accounting obligations. Marketing data is retained until you opt out or, if unused, for [24 months · to be confirmed]. Specific retention periods for Employee Data processed on behalf of Customers are set out in Section 9 and the Data Processing Agreement.

9.Employee Data We Process on Behalf of Customers

9.1Where a Customer uses People Hub to manage its own employees, we process the resulting Employee Data strictly as a processor, on the Customer's documented instructions, and only for the purpose of providing the Service.

9.2This may include special category data such as health information in medical forms and risk assessments, and, where entered by the Customer, information relevant to disciplinary, grievance, or capability processes. We apply appropriate technical and organisational measures to protect this data, including encryption in transit and at rest, access controls, and audit logging.

9.3We do not use Employee Data for our own marketing purposes, and access by our staff is limited to what is necessary to provide support or maintain the Service.

9.4On termination of a Customer's Subscription, Employee Data is made available for export for a defined period and then deleted or anonymised in accordance with the Terms and Conditions and Data Processing Agreement, save where we are required to retain it by law.

9.5If you are an employee of a Customer and wish to exercise your data protection rights (e.g. access, correction, deletion) in relation to your Employee Data, please contact your employer directly, as they control that data. We will support our Customers in responding to such requests as required under the Data Processing Agreement.

10.Your Rights

Subject to certain conditions and exemptions under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data in certain circumstances;
• Object to or request restriction of certain processing;
• Request a portable copy of data you have provided to us;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority.

To exercise these rights in relation to data where we act as controller (see Section 2), contact us using the details in Section 1. We may need to verify your identity and may not always be able to fulfil a request, for example where we have an overriding legal obligation to retain data.

11.Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption, access controls, staff training, and regular security review. No system is completely secure, and we cannot guarantee absolute security, but we will notify affected customers and, where required, the ICO without undue delay in the event of a personal data breach affecting their data, in accordance with our legal obligations.

12.Children

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children.

13.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on our website with a revised "Last updated" date, and where changes are material, we will provide additional notice (e.g. by email or in-app notice).

14.Contact Us

If you have questions about this Privacy Policy or how we handle personal data, please contact:

Build Your Vision Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: info@buildyourvision.co.uk
Website: byvpeoplehub.com

You also have the right to contact the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.