Privacy Notice

This notice explains how Hael Ltd ("Hael", "we", "us") processes personal data through our website, marketing forms, free tools, and the Hael platform.

We are the data controller for personal data described here, except where we act as processor for customer users (see section 3 and the DPA).

1. Who we are

Hael Ltd — a company incorporated in England & Wales.

• Registered office: 86-90 Paul Street, London, England, EC2A 4NE
• Data Protection Officer: dpo@hael.ai

2. Scope

This notice covers personal data we process about:

• Site visitors — anyone browsing our marketing website
• Leads and prospects — people who submit forms, book demos, request reports, or use our free tools
• Customer users — authenticated users of the Hael platform, on behalf of the customer organisation that engaged us
• Correspondents — anyone who emails us, including at security@hael.ai and dpo@hael.ai

3. Roles

• For site visitors, leads, and correspondents, Hael is the data controller.
• For customer users, the customer organisation is the data controller; Hael acts as data processor on the customer's documented instructions under our Data Processing Agreement.

4. What personal data we process

| Category | Examples | | --- | --- | | Account data | Name, work email, organisation, job title, role | | Authentication data | Hashed passwords, MFA factors, session metadata, SSO identifiers | | Lead data | Name, email, company, message content, form type, page URL, submission timestamp | | Usage data | IP address, user-agent, page views, feature interactions, audit events | | Content | Data you upload to the platform (governance records, policies, evidence) — processed on behalf of your organisation | | Communications | Support tickets, security reports, feedback | | Payment data | Billing contact and invoice details; card data is processed by our payment processor, not stored by Hael |

5. Lawful bases (UK GDPR / EU GDPR Article 6)

1. Performance of a contract (Art. 6(1)(b)) — to provide the platform, respond to demo and report requests, and administer accounts.
2. Legitimate interests (Art. 6(1)(f)) — security monitoring, fraud prevention, audit logging, product analytics on aggregated usage, direct B2B outreach to relevant business contacts, and defending legal claims. We balance these against your rights and describe the balancing test on request.
3. Legal obligation (Art. 6(1)(c)) — retention required by tax, accounting, and applicable AI-governance regulation.
4. Consent (Art. 6(1)(a)) — non-essential cookies and marketing email subscriptions. You may withdraw consent at any time.

Special-category data is not intentionally processed. Do not submit special-category data through free-form fields.

6. Purposes

• Operating and securing the Hael platform
• Responding to enquiries, demo requests, and report requests
• Delivering free tools and sending the requested results
• Processing customer data on documented instructions (see DPA)
• Compliance with legal and regulatory obligations
• Product improvement using aggregated, non-identifying usage data

7. Sharing

We share personal data only with:

• Sub-processors we engage to deliver the service — see /sub-processors
• Professional advisors (legal, accounting, insurance) under confidentiality
• Authorities where required by law or lawful request
• A successor entity in the event of a corporate transaction, subject to equivalent protections

We do not sell personal data. We do not use customer data to train shared or third-party AI models.

8. International transfers

Personal data is hosted in the United Kingdom / EU (London, eu-west-2) by default. Where a sub-processor operates outside the UK/EU, we rely on:

• UK International Data Transfer Agreement (IDTA) or the UK Addendum (B1.0) to the EU SCCs, for UK transfers
• Standard Contractual Clauses (Commission Implementing Decision 2021/914) for EU transfers
• A documented Transfer Impact Assessment where required by Schrems II

9. Retention

| Category | Retention | | --- | --- | | Account data | Lifetime of the account + 30 days | | Authentication logs | 13 months | | Audit log entries | 7 years (regulatory) | | Cookie consent records | 2 years | | Lead submissions | 24 months from last contact | | Support tickets | 3 years | | Billing records | 7 years (tax law) | | Free-tool submissions | 24 months |

Customer content is retained per the customer's contract and deleted per the DPA on termination.

10. Your rights

Under the UK Data Protection Act 2018, UK GDPR, EU GDPR, and (where applicable) the California Consumer Privacy Act, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten"), where applicable
• Restrict processing
• Object to processing based on legitimate interests, including direct marketing
• Portability — receive your data in a structured, commonly used format
• Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint with a supervisory authority

Submit requests via our Privacy Request Form or email dpo@hael.ai. We respond within one month, extendable by two further months for complex requests.

11. Cookies

See our Cookie Policy. We use only strictly necessary cookies by default; analytics and marketing cookies are opt-in and honour Global Privacy Control (GPC) and Do Not Track (DNT).

12. Security

We apply the controls described on our Security page and in Annex II of our DPA, including encryption in transit and at rest, MFA, tenant isolation, tamper-evident audit logging, and independent penetration testing.

13. Automated decision-making

Hael does not make solely automated decisions with legal or similarly significant effects about site visitors, leads, or customer users.

14. Supervisory authority

You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU Data Protection Authority.

15. Changes to this notice

Material changes are announced at least 30 days in advance. Version history is published at /trust/changelog.