Privacy policy

• WorkBuzz, we, us or our means WorkBuzz Analytics Limited of 5 Linford Forum, Rockingham Drive, Milton Keynes, MK14 6LY, UK and any of its related bodies;
• Employer or Service Provider means, in relation to you, the person or entity that has contracted with WorkBuzz to allow you to use WorkBuzz services;
• Survey respondent or invitee means the person providing information through a WorkBuzz survey or our Platform
• Services mean our technology Platform, employee or service provider surveys or consulting services, and our websites (www.workbuzz.com, www.engagementdashboard.co.uk, www.bestfranchiseawards.co.uk),
• Platform means our survey tool, dashboards and analytics modules where you may administer surveys, complete these or access the results
• Data Protection Legislation means (whilst they are in force) the Data Protection Act 1998; the EU General Data Protection Regulation (‘GDPR’); and any successor legislation to the Data Protection Act 2018 of the GDPR and any other applicable laws and regulations relating to the Processing of Personal Data and privacy.
• Personal Data, Data Controller, Data Processor, Data Subject and Process are as defined in the Data Protection Legislation

The person with responsibility for our data protection compliance is the Data Privacy Manager and they can be contacted via emailing: support@workbuzz.com.

We will act in respect of Personal Data to comply with the six principles of the GDPR, which are:

• Lawfulness, fairness and transparency;
• Purpose limitation;
• Data minimisation;
• Accuracy;
• Storage limitation;
• Integrity and confidentiality.

You have rights in respect of how your Personal Data can be Processed, which are detailed below.

We have put in place measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those of our people and other third parties who have a business need to know. They will only Process your Personal Data on our instructions and where they have agreed to treat the information confidentially and to keep it secure. We have put in place procedures to deal with any suspected data security breach and will notify you and the ICO of a suspected breach where we are legally required to do so.

WorkBuzz complies with industry best practices:

• ISO27001 certified
• RS 256-bit encryption for all data in transit and at rest
• Data stored on secure Amazon Web Services
• All laptops and computers are set up with full disk encryption by default

WorkBuzz is also Cyber Essentials certified. This means that WorkBuzz’s ICT defences have been assessed against a commodity-based cyber-attack. WorkBuzz also regularly undergoes independent penetration tests, by CREST approved testers, using the OWASP Application Security Verification Standard.

Like almost all other professional websites, we use cookies to improve your experience. A cookie is a small file that asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

A cookie in no way gives us access to your computer or any personally identifiable information about you, other than the data you choose to share with us.

For more information, please see the WorkBuzz Cookie Policy.

It is important that the personal information that we hold about you is accurate and current. Please tell us if your personal information changes during your relationship with us.

The way your data is stored and Processed will depend on the nature of it and how we have received it:

• All Personal Data directly related to performing our Services and provided by survey respondents is only Processed within the EEA.  Section B (For our Survey Respondents) provides more information, including when this data is disclosed to third parties and how long it is retained for

• Some Personal Data gathered through other sources, such as when you download an eBook or guide through our website, may be Processed outside of the EEA, provided this is adequately protected, as required by the GDPR, by trusted suppliers under the EU-US Privacy Shield and Swiss-U.S. Privacy Shield regimes. See Section C.

In order to Process Personal Data, we must have valid legal grounds to hold and manage it in accordance with Data Protection Legislation.

In relation to our clients, it is likely that our legal ground will be that we are processing personal data, for which they are the Controller, in order to perform the services under our contract with them.

In relation to our employees, our grounds for Processing their Personal Data may be both (1) under contract; and (2) our legitimate interest in holding the data (for example, the need to hold certain employee records).

Where individuals have asked to be added (or opted-in) to our database, our reason for holding their data may be based on their consent (as well as in certain circumstances on our legitimate interest).

Where our processing of Personal Data is based on the Data Subject’s consent, it may be possible for the Data Subject to withdraw that consent (and thereby our ground for holding their Personal Data). In that event, we will stop the processing of their Personal Data.

We will only share your Personal Data with third parties on the same basis: where we have valid legal grounds to do so. We may share your Personal Data where necessary to perform a contract with you, where it is in our legitimate interest to do so or when you have specifically consented to it.

Finally, there are some other valid grounds for Processing (or sharing) Personal Data:

1. where there is a legal obligation that we must;
2. where it is of vital interest that we should share the Personal data (to protect someone’s life); or
3. where it is part of a public task or official function.

We are the Data Processor of the Personal Data supplied to us by our clients, who remain the Data Controller in respect of their Personal Data. We are therefore responsible for making sure that our systems, processes and people comply with the relevant data protection laws as a Data Processor of that Personal Data.

When entering into an agreement with WorkBuzz, your employer or service provider may share with us, or upload directly to our Platform, certain demographic and Personal Data, which may, for example, include name, age, gender, email address, job title, level of seniority, department, work or service start date, and primary location.

The other data we collect about you is provided by you in the survey itself:

• Survey data: we store the survey data (questions and answers) respondents complete or submit via our Platform
• Other data you submit: we may collect your personal information or data if you submit it to us in other contexts. For example, by giving us a testimonial, by entering a contest or entering into correspondence with us.

Each time you complete a survey or use our Platform, we may collect information about you including, when and how you use the Platform; any comments or feedback you provide to us; technical information about your computer or mobile device for analysis and system administration, such as your IP address, operating system and browser type.

We may use the personal information we hold in the following ways:

• To provide your employer or service provider with reports and analysis, summarising the information gathered through our Platform and surveys.  This may include demographic analysis, based on the respondent’s survey answers or demographic information provided by you
• We will take all reasonable steps to protect respondents’ confidentiality, like merging their feedback with other employees’ – please see our Confidentiality Promise for more information
• To notify you about changes to our Platform or our Services that you use
• To deal with any enquires, correspondence or complaints you have raised or have been raised by other parties relating to your use of our Platform or Services
• To compile usage reports of our Platform or Services

• In order to Process Personal Data, we must have valid legal grounds to hold and manage it in accordance with Data Protection Legislation
• In relation to our clients, it is likely that our legal ground will be that we are Processing their Personal data in order to perform the services under our contract with them
• In relation to our employees, our grounds for Processing their Personal Data may be both (1) under contract; and (2) our legitimate interest in holding the data (for example, the need to hold certain employee records)
• Where individuals have asked to be added to our database, our reason for holding their data may be based on their consent (as well as in certain circumstances on our legitimate interest)
• Where our processing of Personal Data is based on the Data Subject’s consent, it may be possible for the Data Subject to withdraw that consent (and thereby our grounds for holding their Personal Data). In that event, we will stop the processing of their Personal Data.
• We may only share your Personal Data with third parties on the same basis: where we have valid legal grounds to do so. So, we may share your Personal Data where necessary to perform a contract with you, where it is in our legitimate interest to do so or when you have specifically consented to it.
• Finally, there are some other valid grounds for Processing (or sharing) Personal Data: (i) where there is a legal obligation that we must; (ii) where it is of vital interest that we should share the Personal data (to protect someone’s life); or (iii) where it is part of a public task or official function

We may also disclose your information:

• In the event that we sell or buy any business or assets, in which case we may disclose your Personal Data to the prospective seller or buyer of such business or assets
• If WorkBuzz Analytics Limited or substantially all of its assets are acquired by a third party, in which case Personal Data held by it about its customers will be one of the transferred assets
• If for the purposes of delivering our services, a third party is required who complies with the GPDR.  For example, if we require to print, post and capture large amounts of paper surveys outside of the UK
• If we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or in order to enforce or apply our Terms of Use or Terms of Subscription and other agreements; or to protect the rights, property, or safety of WorkBuzz Analytics Limited, our customers, or others.

In respect of all disclosures of Personal Data, we will only share the personal information which is necessary for the particular purpose for which it is provided, or where we have another legitimate interest in doing so (weighed up against your rights to have your data protected), and we will ensure that the Personal Data is appropriately protected.

Reasonable measures are taken by each WorkBuzz employee who is responsible for client relationships to adhere to the WorkBuzz retention schedule:

• After a project has finished, there may be cause to review the Personal Data which was shared as part of the project, in order to deal with any queries. For that reason, the client’s Personal Data will be stored for up to 12 months after the project has finished or the company has terminated their contract with WorkBuzz unless specifically requested. This will be audited internally every December to ensure compliance.
• If a client has signed up for continuous pulse surveys and decides to cancel their account, we will delete all Personal Data within 90 days of receiving this instruction
• Email inboxes are continually monitored by the mailbox owner with an annual review taking place in December. For that reason, data may be stored in Mailboxes for up to 12 months.

We collect and process the following data about you:

• Information you give us:
• When you contact us or subscribe to our content, such as our newsletter, we collect your contact details, including your name and email address
• We may collect your personal information or data if you submit it to us in other contexts. For example, by giving us a testimonial, by entering a contest or entering into correspondence with us.
• Personal Data may also be collected from you during the application and selection Process should we advertise any vacancies (for example via your application form and CV)

We may receive information about you if you use other websites we operate. We also work with third parties, including affiliate partners, sub-contractors, advertising networks, search engine providers and analytics providers and may receive information about you from them.

We may use the personal information we hold in the following ways:

• For marketing activities
• For recruitment purposes
• To deal with any enquires, correspondence or complaints you have raised or have been raised by other parties relating to your use of our Platform or Services

If you have opted in to receive our newsletters, other information services or marketing materials, we will use your personal information to distribute this/these to you.

If you have applied for a role with WorkBuzz, either advertised or speculatively, Personal Data will be used for HR administration and management in respect of the selection of people to work for us (including suitability, eligibility and/or fitness to work).

Data provided to WorkBuzz via any of our websites are provided in full knowledge of its future use, with explicit consent in relation to each of the proposed uses. Those who leave their details may opt-in to receive marketing updates from WorkBuzz. Until a person in our marketing database unsubscribes or requests to be forgotten, they will remain a part of it.

Upon unsubscribing, Personal Data will be retained for up to 90 days prior to deletion from our systems.

If you have shared your Personal Data in the form of a role application, WorkBuzz will keep the Personal Data of applicants who we do not employ for up to 12 months after we receive it.

Any changes we may make to our privacy policy in the future will be posted on our website, so please ensure that you are viewing the correct version. Please contact us if you have any questions, comments or requests regarding this Privacy Policy.