The personal data we collect may include:

• Identifying information, such as your name, job title, business address, email address, IP addresses, device IDs;
• Workforce data such as role titles, organisational units, salaries, gender, location, seniority, job family;
• Details about your use of our applications so we may improve our services; and other online services and tools, including information you provide by completing our forms; or when you contact us, for example, to report an issue or to raise a query;
• Further business information necessarily processed in a project or client contractual relationship with Orgvital Ltd or voluntarily provided by you, such as instructions given, payments made, requests and projects;
• Personal data regarding your preferences where it is relevant to services that we provide;
• Attendance/visits details of your visits to our premises and attendance at events;
• Payment data, such as data necessary for processing payments and fraud prevention;
• Public information collected from publicly available resources, integrity databases and credit agencies;

We may collect personal data about you in a number of circumstances, including

• Directly from you when you provide personal information to us;
• When you or your organisation use our services;
• When you or your organisation browse, make an enquiry or otherwise interact on our website or via any digital tools that we make available;
• When you attend a seminar or another Orgvital Ltd event or sign up to receive personal data from us, including training;
• When you or your organisation offer to provide or provide services to us;
• In some circumstances, we collect personal data about you from a third-party source. For example, we may collect personal data from your organisation or, during the employment hiring process, from relevant agencies, sources and former employers.

We may use your personal data for the following purposes only ("Permitted Purposes"):

• Providing services you or your organisation may have requested;
• Managing and administering your or your organisation's business relationship with Orgvital Ltd, including processing payments, responding to you, accounting, auditing, billing and collection, support services;
• To analyse and improve our services, business operations, systems (including diagnosis of server issues and administration of our website(s)) and communications to you;
• To facilitate events and meetings;
• Protecting the security of and managing access to our premises (including security cameras), IT and communication systems, online platforms and mobile applications, websites and other systems, preventing and detecting security threats, fraud or other criminal or malicious activities;
• For insurance purposes;
• For monitoring and assessing compliance with our policies and standards;
• To comply with our legal and regulatory obligations and requests anywhere in the world, including reporting to and/or being audited by national and international regulatory bodies;
• To comply with court orders and exercises and/or defend our legal rights;
• For any purpose related and/or ancillary to any of the above or any other purpose for which your personal data was provided to us;
• For employment related reasons where relevant.

Where you have expressly given us your consent, we may process your personal data also for the following purposes:

• Communicating with you through the channels you have approved to keep you up to date on the latest developments relevant to your areas of interest about our services, industry news and other matters of mutual interest;
• Customer surveys, creating website content, marketing campaigns, market analysis or other promotional activities or events;
• Collecting information about your preferences to create a user profile to personalise the quality of our communication and interaction with you (for example, by way of newsletter tracking or website analytics);
• Employment purposes such as pre-hiring reference checks, right to work and screening purposes.

With regard to marketing-related communication, we will provide you the opportunity to opt out anytime if you do not want to receive further marketing-related communication from us. We will not use your personal data for taking any automated decisions affecting you or creating profiles other than described above.

Depending on for which of the above Permitted Purposes we use your personal data, we may process your personal data on one or more of the following legal grounds:

1. Because processing is necessary for the performance of an instruction or contract with you or your organisation;
2. To comply with our legal obligations (e.g. to keep pension records or records for tax purposes);
3. Because processing is necessary for purposes of our legitimate interest or those of any third-party recipients that receive your personal data, provided that such interests are not overridden by your interests or fundamental rights and freedoms.

In addition, the processing may be based on your consent where you have expressly given that to us.

We may share your personal data in the following circumstances:

• We may share your personal data between the Orgvital Ltd and third parties on a confidential basis where required for the purpose of providing services and for administrative, billing and other business purposes e.g. employment related;
• We may disclose your contact details on a confidential basis to third parties for the purposes of collecting your feedback on our service provision, to help us measure our performance and to improve and promote our services;
• We may share your personal data with companies providing services for credit risk reduction such as credit reference and debt collection agencies;
• We may share your personal data with any third party to whom we assign or novate any of our rights or obligations;
• We may share your personal data with courts, law enforcement authorities, regulators, lawyers or other parties where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process;

We may also instruct service providers within or outside of Orgvital Ltd, domestically or abroad, e.g. shared service centres/IT service providers including cloud service providers such as data storage platforms, to process personal data for the Permitted Purposes on our behalf and in accordance with our instructions only. Orgvital Ltd will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers.

We may also use aggregated personal data and statistics for the purpose of monitoring website usage in order to help us develop our website and to improve our services.

Otherwise, we will only disclose your personal data when you direct us or give us permission, when we are required by applicable law or regulations or judicial or official request to do so, or as required to investigate actual or suspected fraudulent or criminal activities. Orgvital Ltd does not sell any personal data.

We may require the personal data of third parties (such as name, contact details and e-signature) for the purpose of managing electronic agreements. If you provide personal data to us about someone else (such as one of your directors or employees, or someone with whom you have business dealings) you must ensure that you are entitled to disclose that personal data to us and that, without our taking any further steps, we may collect, use and disclose that personal data as described in this Privacy Notice. In particular, you must ensure the individual concerned is aware of the various matters detailed in this Privacy Notice, as those matters relate to that individual, including our identity, how to contact us, our purposes of collection, our personal data disclosure practices (including disclosure to overseas recipients), the individual's right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided (such as our inability to provide services).

We have implemented and will take appropriate technical and organisational (including administrative and physical) measures to keep your personal data confidential and secure from unauthorised access, use and disclosure in accordance with our internal policies and procedures covering the storage, transfer, disclosure of and access to personal data. Personal data may be kept on our personal data technology systems, those of our contractors or suppliers, or in paper files.

We also require our business partners, suppliers, and third parties to implement appropriate safeguards, such as contract terms and access restrictions, to protect information from unauthorised access, use, and disclosure.

We may transfer your personal data abroad if required for the Permitted Purposes as described above. This may include countries which do not provide the same level of protection as the laws of your home country (e.g. the laws within the European Economic Area or Australia).

We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by the General Data Protection Regulation (EU) 2016/679 or other relevant laws. This includes entering into the EU Standard Contractual Clauses. Where appropriate, data transfers from the UK will be covered by the UK IDTA. We will also require our agents, consultants and subcontractors and others who are outside the UK and EU and to whom we transfer your personal data to ensure a similar level of data protection.

If any of the personal data that you have provided to us changes, e.g. email address or if you become aware we have any inaccurate personal data about you, please let us know by sending an email to support@orgvital.com

Your personal data will be deleted when it is no longer reasonably required for the Permitted Purposes or you withdraw your consent (where applicable) and we are not legally required or otherwise permitted to continue storing such data. We will, in particular, retain your personal data where required for Orgvital Ltd to assert or defend against legal claims until the end of the relevant retention period or until the claims in question have been settled.

Depending upon your location you have certain data privacy rights. These include rights to access data, to correct inaccurate data, to object to or request restriction of processing, to request deletion of data, to request that we transfer your data to another provider, to not have automated decisions made which may adversely impact you, to opt-out of marketing or to withdraw consent.

If you wish to do any of the above, please send an email to support@orgvital.com. We may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorised disclosure of data.

We will consider any requests or complaints which we receive and provide you with a response in a timely manner. If you are not satisfied with our response, you may take your complaint to the Information Commissioner's Office (ICO) for which you also have a right.

Orgvital Ltd services are not intended for use by anyone under the age of 18 and does not target its service to children. We do not knowingly collect personal information from children under 18 years of age. If you are under 18, please do not use our services and do not provide any personal information to us.

If you are a parent or guardian and believe that your child under the age of 18 has provided us with personal information without your consent, please contact us at support@orgvital.com, and we will take steps to remove that information from our servers.

We reserve the right to update and change this Privacy Notice from time to time in order to reflect any changes to the way in which we process your personal data or changing legal requirements. In case of any such changes, we will post the changed Privacy Notice on our website or publish it otherwise. The changes will take effect as soon as they are posted on this website.

If you would like to contact us with any queries or comments, please send an email to support@orgvital.com or a letter to the registered address above for the attention of the Data Protection Officer.