Privacy Notice

In this Privacy notice, a reference to:

‘WorkBuzz’, ‘we’, ‘us’ or ‘our’ means WorkBuzz Analytics Limited of 5 Linford Forum, Rockingham Drive, Milton Keynes, MK14 6LY, UK and any of its related bodies.
Employer or Service Provider means, in relation to you, the person or entity that has contracted with WorkBuzz to allow you to use WorkBuzz services.
Survey respondent, invitee or contributor means the person providing information through a WorkBuzz survey, Dialogue Loop or our Platform.
Services mean our technology Platform, employee or service provider surveys or consulting services, and our website www.workbuzz.com.
Platform means our survey, feedback or listening tools, dashboards and analytics modules where you administer surveys or Dialogue Loops, participate in these or access the results.
Data Protection Legislation refers to the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and any successor legislation or amendments to the Data Protection Act 2018 or UK GDPR, along with any other applicable laws and regulations concerning the processing of personal data and privacy in the UK
Personal data, Data Controller, Data Processor, Data Subject and Process are as defined in the Data Protection Legislation
WorkBuzz Dialogue definitions are:
- Contributors – invited individuals who can provide feedback through a loop without creating an account.
- Loop – is a video based question from a leader asking for contributions on a topic enabling them to respond via video, audio or text (anonymity can be turned on by loop).
- Loop Creator – is an assigned leader with an account who can create and manage loops and view insights from said loops.

The person with responsibility for our data protection compliance is the Data Privacy Manager Ian Barrow, and they can be contacted via emailing: support@workbuzz.com.

With respect to personal data, we will comply with the six principles of the UK GDPR, which are:

Lawfulness, fairness and transparency;
Purpose limitation;
Data minimisation;
Accuracy;
Storage limittion;
Integrity and confidentiality.

You have rights in respect of how your personal data can be processed, which are detailed below.

Data and Information security

We have put in place measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those of our employees and other third parties who have a business need to know.

We and any authorised third party, will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure. We have put in place processes and procedures to deal with any suspected data security breach and will notify all relevant parties and the ICO of a suspected breach where we are legally required to do so.

WorkBuzz adheres with industry best practices:

Roles & responsibilities – we have a documented and clear view on who are the Data Controllers and our responsibilities as Data Processor, including our legal, contractual, and operational duties when handling personal data.
Risk management & Privacy Impact Assessments (PIA) – we identify, assess and mitigate risks through our Risk Register and we carry out DPIA’s.
Privacy controls – we have implemented a mix of technical and organisational measures to effectively manage data collection, classification, encryption, access, retention, and secure disposal—reducing the risk of unauthorised access or misuse.
Data subject rights management – we have processes in place to handle requests for data access, correction, deletion (right to be forgotten), portability, and consent withdrawal, with embedded audit trails.
Continuous monitoring & improvement – we have regular internal and external audits and management compliance reviews every 2 months.
Third-party & supply chain management – we have Data Processing Agreements (DPAs) in place and third-party due diligence, to ensure that suppliers meet our privacy requirements and standards.
Incident response & breach management – we have a response plan in place designed to detect, investigate, and respond to privacy breaches.
Employee training & awareness – all colleagues receive information security training on induction, annually and ad hoc as policy and procedures change.

In addition, all data stored on secure Amazon Web Services, RS 256-bit encryption for all data in transit and at rest and all laptops and computers are set up with full disk encryption by default

We are also proud to hold some globally recognised accreditations:

ISO27001:2022 certified
ISO42001:2023 certified
Cyber Essentials certified

WorkBuzz also regularly undergoes independent penetration tests, by CREST approved testers, using the OWASP Application Security Verification Standard.

Your rights

Under certain circumstances, you have the right by law to:

Request access to your personal data. This enables you to ask to receive a copy of the personal data that we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you.
Request deletion of your personal data.
Object to processing of your personal data, where we are relying on our legitimate interest and there is something about your particular situation which makes you want to object to processing on these grounds. You also have the right to object to where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal data.
Request the transfer of your personal data to another party.

Collection, use and disclosure of personal data

We collect and Process data for the following reasons:

Personal data collected and created in relation to our employee or service provider survey and listening services;
Personal data relating to people who have asked to receive our newsletters and other information services or marketing materials; and
Personal data relating to our people, which means those people working for our company, or providing services to us, including employees, consultants, temporary or casual workers and contractors.

All our employees are required to abide by our Privacy Notice when handling personal data and will be provided with appropriate data protection training on an ongoing basis. Any breach of data protection will be taken extremely seriously and may result in disciplinary action. Our Compliance Manager will provide advice and guidance to our employees on data protection issues, as is required.

Links from our website

Our websites may, from time to time, contain links to and from the websites of third parties that we permit to make such links. If you follow a link to any of these websites, please note that these websites have their own Privacy Policies and that we do not accept any responsibility or liability for these policies. We recommend that you check these policies before you submit any personal data to these websites.

Cookies

Like almost all other professional websites, we use cookies to improve your experience. A cookie is a small file that asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.

Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

A cookie in no way gives us access to your computer or any personally identifiable information about you, other than the data you choose to share with us.

For more information, please see the WorkBuzz Cookie Policy or if you are using WorkBuzz Dialogue, the WorkBuzz Dialogue Cookie Policy.

Where we store your personal data and how this is processed

The way your data is stored and Processed will depend on the nature of it and how we have received it:

All personal data directly related to performing our services and provided by survey respondents is only processed within the UK and EEA. Section B (For our Survey Respondents or WorkBuzz Dialogue Loop contributors) provides more information, including when this data is disclosed to third parties and how long it is retained for.

Some personal data gathered through other sources, such as when you download an eBook or guide, through our website, may be processed outside of the UK and EEA, provided this is adequately protected, as required by UK and EU GDPR, by trusted suppliers under the UK and EU Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs). See Section C.

The grounds on which we hold personal data

In order to process personal data, we must have valid legal grounds to hold and manage it in accordance with Data Protection Legislation.

In relation to our clients, it is likely that our legal ground will be that we are processing personal data, for which they are the Controller, in order to perform the services under our contract with them.

In relation to our employees, our grounds for processing their personal data may be both (1) under contract; and (2) our legitimate interest in holding the data (for example, the need to hold certain employee records).

Where individuals have asked to be added (or opted-in) to our database, our reason for holding their data may be based on their consent (as well as in certain circumstances on our legitimate interest).

Where our processing of personal data is based on the data subject’s consent, it may be possible for the data subject to withdraw that consent (and thereby our grounds for holding their personal data). In that event, we will stop the processing of their personal data.

We will only share your personal data with third parties on the same basis i.e. where we have valid legal grounds to do so. We may share your personal data where necessary to perform a contract with you, where it is in our legitimate interest to do so or when you have specifically consented to it.

Finally, there are some other valid grounds for Processing (or sharing) Personal Data:

where there is a legal obligation that we must;
where it is of vital interest that we should share the Personal data (to protect someone’s life); or
where it is part of a public task or official function.

Section B: For our survey respondents or WorkBuzz Dialogue Loop contributors

WorkBuzz are the Data Processor of the personal data supplied to us by our clients or provided to us by Dialogue Loop contributors, who remain the Data Controller in respect of their personal data. We are therefore responsible for making sure that our systems, processes and people comply with the relevant data protection laws as a Data Processor of that personal data.

Collection

When entering into an agreement with WorkBuzz, your employer or service provider may share with us, or upload directly to our platform, certain demographic and personal data, which may, for example, include, but is not limited to, name, age, gender, email address, job title, level of seniority, department, work or service start date, and primary location.

The other data we collect about you, is provided by you in the survey itself:

Data: we store the survey data (questions and answers) respondents complete or submit via our platform or the data submitted via a WorkBuzz Dialogue Loop.
Other data you submit: we may collect your personal information or data if you submit it to us in other contexts. For example, by giving us a testimonial, by entering a contest or entering into correspondence with us.

Each time you complete a survey or use our platform or respond to a WorkBuzz Dialogue Loop, we may collect information about you including, when and how you use the platform; any comments or feedback you provide to us; technical information about your computer or mobile device for analysis and system administration, such as your IP address, operating system and browser type.

Use

We may use the personal information we hold in the following ways:

To provide your employer or service provider with reports and analysis, summarising the information gathered through our platform, surveys and Dialogue Loops. This may include demographic analysis, based on the respondent’s survey answers or demographic information provided by you.
For surveys, we will take all reasonable steps to protect respondents’ confidentiality, like merging their feedback with other employees’ to create aggregated data and ensuring that no individual can be identified from that data – please see our Confidentiality Promise for more information.
For contributors who choose to participate in a WorkBuzz Dialogue Loop and choose to respond anonymously, we will take all reasonable steps to protect contributors’ confidentiality.
To notify you about changes to our platform or our services that you use
To deal with any enquires, correspondence or complaints you have raised or have been raised by other parties relating to your use of our platform or services
To compile usage reports of our platform or services

The Grounds on which we Process Personal Data

In order to process personal data, WorkBuzz must have valid legal grounds to hold and manage the data in accordance with Data Protection Legislation.

In relation to our clients, it is likely that our legal ground will be that we are processing their personal data in order to perform the services under our contract with them.
In relation to our employees, our grounds for processing their personal data may be both:
- under contract; and
- our legitimate interest in holding the data (for example, the need to hold certain employee records)
Where individuals have asked to be added to our database, our reason for holding their data may be based on their consent (as well as in certain circumstances on our legitimate interest).
Where our processing of personal data is based on the data subject’s consent, it may be possible for the data subject to withdraw that consent (and thereby our grounds for holding their personal data). In that event, we will stop the processing of their personal data.
We may only share any personal data with third parties on the same basis i.e. where we have valid legal grounds to do so. So, we may share your personal data where necessary to perform a contract with you, where it is in our legitimate interest to do so or when you have specifically consented to it.
Finally, there are some other valid grounds for processing (or sharing) personal data
- where there is legal obligation that we must;
- where it is of vital interest that we should share the personal data (to prrotect someone's life); or
- where it is part of a public task or official function

Disclosure

We may share your personal information to other third parties inside the EEA to fulfil the contract we have with you.

We may also disclose your information:

In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets
If WorkBuzz Analytics Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets
If for the purposes of delivering our services, a third party is required to comply with the UK GPDR. For example, if we require to print, post and capture large amounts of paper surveys outside of the UK
If we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or in order to enforce or apply our Terms of Use or Terms of Subscription and other agreements; or to protect the rights, property, or safety of WorkBuzz Analytics Limited, our customers, or others.

In respect of all disclosures of personal data, we will only share the personal information which is necessary for the particular purpose for which it is provided, or where we have another legitimate interest in doing so (weighed up against your rights to have your data protected), and we will ensure that the personal data is appropriately protected.

3^rd party providers	3^rd party policies
Amazon Web Services (AWS)	WorkBuzz websites are hosted on Amazon Web Services (AWS) in Dublin and London. Amazon confirms that all AWS services can be used in compliance with the General Data Protection Regulation (GDPR). (Amazon, n.d.)
Anthropic	Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems. For full details on how they collect, use, disclose, and process personal data please visit their Privacy Policy
bakergoodchild	Where large numbers of paper surveys are required, we will work with bakergoodchild to print, distribute and data capture paper surveys. For projects outside of the UK, we reserve the right to work with local partners after carrying out information security due diligence.
Datadog	Datadog provides WorkBuzz with infrastructure monitoring so our engineering teams can maintain, optimise and secure our cloud environments. Datadog is confirmed as compliant with General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). Please see their Privacy Policy for more details.
Deepl Translate	Free text responses provided by survey respondents can be translated into a number of languages by our translation service (“Free Text Translator”). Deepl Translate data centres is held in their data centre in Sweden.
FireText	WorkBuzz may use FireText to support projects that require an SMS campaign to distribute survey links or similar. “In order to fully comply with EU GDPR, FireText shall […] Keep all personal information (including employee information) secure, regardless of its format or category, or the process or activities which use it, so as to prevent accidental or unauthorised loss, theft or breach.” (FireText, n.d.)
Google Cloud	Google Cloud provides WorkBuzz with a hosting platform and complies with European, UK, EU-US and Swiss-US regulations and frameworks. For full details, please visit their Privacy & Terms.
Google Translate	Free text responses provided by survey respondents can be translated into a number of languages by our translation service (“Free Text Translator”). We specify that Google Translate holds data in their EEA data centres
MailJet	We use Mail Jet to send our survey email invitations, using their European servers. “We are proud to announce our complete implementation of all GDPR’s rigid requirements as of December 2017.” (Mailjet, 2018)
Microsoft	Provides Office 365 and email, which we will use when corresponding with you.
Vidyard	WorkBuzz uses Vidyard to send personalised video messages. Please refer to their Privacy Policy.
Sendgrid	We use Sendgrid to send out email invites to WorkBuzz Dialogue contributors and is simply a processing engine rather than a permanent storage provider, message bodies are only temporarily held (up to 72 hours) until delivery is confirmed and this is done via AWS within the US. Sendgrid is certified for GDPR, CCPA, and the EU-US Data Privacy Framework (DPF).
HeyGen	WorkBuzz use HeyGen to generate avatars and all servers are based in the US on AWS. HeyGen follows industry-standard SOC 2 practices and is certified for GDPR, CCPA, and the EU-US Data Privacy Framework (DPF). The creation of avatars does not use any personal data.
Langfuse	WorkBuzz use Langfuse to trace, evaluate, and monitor the performance and latency of our AI. Langfuse host their data in the Langfuse Cloud which is hosted on AWS in Dublin, Ireland.
PostHog	PostHog is an all-in-one product analytics and user behaviour tool that helps the WorkBuzz teams understand exactly how users interact with their apps and websites. Hosted on AWS servers in Frankfurt, Germany.
Clearfeed	WorkBuzz use ClearFeed as an internal ticketing system. ClearFeed is certified for GDPR,SOC 2 Type II and HIPAA.

Retention

Reasonable measures are taken by each WorkBuzz employee who is responsible for client relationships to adhere to the WorkBuzz retention schedule:

Employee research data

After a project has finished, there may be cause to review the personal data which was shared as part of the project, in order to deal with any queries. For that reason, the client’s personal data will be stored for up to 12 months after the project has finished or the company has terminated their contract with WorkBuzz unless specifically requested. This will be audited internally every December to ensure compliance.
If a client has signed up for continuous pulse surveys and decides to cancel their account, we will delete all personal data within 90 days of receiving this instruction
Email inboxes are continually monitored by the mailbox owner with an annual review taking place in December. For that reason, data may be stored in Mailboxes for up to 12 months.

WorkBuzz Dialogue data

Voice and video recordings are securely stored for up to eighteen (18) months. After this period, the original audio and video files are permanently deleted from our storage systems. The associated database entries are pseudo-anonymised, and only derived data (such as transcriptions, summaries, and results) is retained.
Transcriptions, summaries, and results are retained for the duration of the contract thereafter.
Text feedback is stored indefinitely unless you request its deletion.
Product usage analytics (including IP addresses) are retained for up to twelve (12) months for security and analytics purposes.

Collection

We collect and process the following data about you:

Information you give us:
When you contact us or subscribe to our content, such as our newsletter, we collect your contact details, including your name and email address.
We may collect your personal information or data if you submit it to us in other contexts. For example, by giving us a testimonial, by entering a contest or entering into correspondence with us.
Personal data may also be collected from you during the application and selection process should we advertise any vacancies (for example via your application form and CV).

We may receive information about you if you use other websites we operate. We also work with third parties, including affiliate partners, sub-contractors, advertising networks, search engine providers and analytics providers and may receive information about you from them.

Use

We may use the personal information we hold in the following ways:

For marketing activities;
For recruitment purposes; or
To deal with any enquires, correspondence or complaints you have raised or have been raised by other parties relating to your use of our platform or services.

If you have opted in to receive our newsletters, other information services or marketing materials, we will use your personal information to distribute this/these to you.

If you have applied for a role with WorkBuzz, either advertised or speculatively, personal data will be used for HR administration and management in respect of the selection of people to work for us (including suitability, eligibility and/or fitness to work).

Disclosure

Services in the EU. Amazon Web Services maintains ISO 27001, SOC 2 Type II, and several other certifications to demonstrate the rigor of their hosting and infrastructure management program.”

GoDaddy	We use GoDaddy to host our websites. “We will only share information about you that is necessary for the third party to provide the requested service. These companies are prohibited from retaining, sharing, storing or using your personally identifiable information for any secondary purposes.” (GoDaddy, n.d.)
Planhat	Planhat is our Client Relationship Management system. They adhere to GDPR compliant procedures and process data according to EU Data Protection Laws. For more information, visit their Legal page.
Crowe LLP	Our Accountants for all WorkBuzz related accounting information. Subject to the ICAEW Code of Ethics and authorised and regulated by the Financial Conduct Authority. Crowe U.K. LLP comply with the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework.
HubSpot	We use HubSpot as our CRM system. “The HubSpot platform is hosted in trusted third-party data centre providers in the EU, and the data stored by HubSpot is stored in the EU. HubSpot partners with the world’s leading data centre providers in order to provide our services to you. Currently, the primary HubSpot infrastructure is hosted with Amazon Web Services in the EU. Amazon Web Services maintains ISO 27001, SOC 2 Type II, and several other certifications to demonstrate the rigor of their hosting and infrastructure management program.” (HubSpot, n.d.)
Zendesk	We use Zendesk as our customer support ticketing system. We provide our customers compliance with high security standards, such as encryption of data in motion over public networks, auditing standards (SOC 2, ISO 27001, ISO 27018), Distributed Denial of Service (“DDoS”) mitigations, and a Support team that is on-call 24/7. For more information, please see Zendesk’s privacy policy, here.

Retention

Data provided to WorkBuzz via any of our websites are provided in full knowledge of its future use, with explicit consent in relation to each of the proposed uses. Those who leave their details may opt-in to receive marketing updates from WorkBuzz. Until a person in our marketing database unsubscribes or requests to be forgotten, they will remain a part of it.

Upon unsubscribing, personal data will be retained for up to 90 days prior to deletion from our systems.

If you have shared your personal data in the form of a role application, WorkBuzz will keep the personal data of applicants who we do not employ for up to 12 months after we receive it.

WorkBuzz Privacy Notice

In this Privacy notice, a reference to:

Data and Information security

Our Compliance

GDPR - General Data Protection Regulation

ISO/IEC 42001

ISO/IEC 27001

CCPA - California Consumer Privacy Act

Cyber Essentials

Your rights

Collection, use and disclosure of personal data

Links from our website

Cookies

Changes to your personal data

Where we store your personal data and how this is processed

The grounds on which we hold personal data

Section B: For our survey respondents or WorkBuzz Dialogue Loop contributors

Collection

Use

The Grounds on which we Process Personal Data

Disclosure

Retention

Section C: For our non-survey respondents

Collection

Use

Disclosure

Retention

Changes to this privacy notice