Privacy Policy

The controller of personal information collected through this website is HRZENITH LTD (company number 17130651), trading as HRZenith. HRZenith is a trading name/brand of HRZENITH LTD. HRZENITH LTD is registered in England and Wales. Its registered office is 38 Marriott Road, Dudley, United Kingdom, DY2 0JX.

References to “HRZenith”, “we”, “us” and “our” in this policy mean HRZENITH LTD, trading as HRZenith.

This policy explains how we handle personal information collected through the public website, in particular the early access waitlist. It does not replace the separate Health Check privacy notice presented if you request that paid service.

When you join the early access waitlist, we collect:

• Full name (required)
• Work email (required)
• Company name (required)
• Role (required)
• Organisation type (required)
• Company size (required)
• Main interest (required)
• Optional message
• Consent confirmation (required)

Those required fields are needed so we can add you to the waitlist and provide the requested early-access registration. You are not legally required to supply this information. If you do not provide the required information, we may be unable to add you to the waitlist or provide that registration. The message/note field is optional.

We also record that the signup came from the website waitlist, and we may store technical request metadata such as a salted, hashed IP address and browser user-agent for security, rate limiting and spam prevention. We do not store your raw IP address — only a salted, one-way hash.

UK data-protection law requires us to have a lawful basis for each purpose. For the public website waitlist we currently rely on the following.

• Waitlist registration and administration. We use your waitlist details to record and administer your requested early-access registration, manage your status, and operate the programme. Lawful basis: legitimate interests. The legitimate interest is operating and administering a waitlist requested by you and managing early access to HRZenith.
• Waitlist confirmation and service communications. If email is configured, we may send a confirmation or other operational message to acknowledge or administer the registration you requested. That is not marketing. Lawful basis: legitimate interests in administering the requested registration.
• Marketing, launch and broadcast emails. We may send launch, early-access and related HRZenith marketing communications where you have opted in. Lawful basis: consent. You can withdraw consent at any time, including by using the unsubscribe link we provide. Withdrawing consent does not affect processing that was lawful before withdrawal.
• Security and abuse prevention. We may use salted hashed IP information, user-agent and other technical request metadata actually processed to protect the service, investigate abuse or spam, and maintain security. Lawful basis: legitimate interests in protecting HRZenith, visitors, systems and data from abuse and security incidents.
• Internal operations notification. Where configured, we notify authorised HRZenith personnel and operators of a new registration so they can administer the waitlist and respond. Lawful basis: legitimate interests in operating the waitlist and responding to registrations.
• Opt-out and suppression. If you unsubscribe, we stop marketing communications. We may retain sufficient suppression information to remember and honour that opt-out and to help prevent future unwanted marketing. Lawful basis: legitimate interests in respecting your choice. Unsubscribing does not by itself delete your waitlist record.

If email is configured, joining the waitlist may trigger a confirmation email to the address you provide. We may later send launch or early-access broadcasts to people who have consented and have not unsubscribed.

Those broadcasts include an unsubscribe link. Confirming unsubscribe stops further marketing communications. It marks your waitlist record as unsubscribed so we can maintain a suppression record; it does not by itself delete the database row. You can still ask us to erase your information, subject to the circumstances and any information we need to keep in order to honour an opt-out.

Waitlist information may be disclosed to the following categories of recipient, only as needed for the purposes above:

• Authorised HRZenith personnel and operators, including for internal notifications of new registrations and waitlist administration
• Hosting and infrastructure providers — currently Google Cloud — for website hosting and related infrastructure in the configured region
• Database and storage infrastructure running on that HRZenith-controlled hosting (PostgreSQL is the database technology we use; it is not a separate corporate processor)
• We use authorised email-delivery providers to send service and marketing communications. Mailtrap is our current transactional and bulk email provider, and Resend is retained as a fallback transactional provider. These providers process sender and recipient details and email-delivery metadata on our behalf.
• Professional advisers or regulatory authorities where we are legally required to disclose information, or where it is otherwise necessary and lawful

Stripe and Health Check document services are described in the separate Health Check privacy notice, not in this general website policy.

HRZenith aims to use UK-hosted infrastructure where that is configured. Relevant hosted application and database services are configured in Google Cloud’s europe-west2 (London) region.

Some service providers may process personal information outside the UK. In particular, our authorised email-delivery providers handle outbound email: Mailtrap is the current transactional and bulk provider, and Resend is retained as a fallback transactional provider. Their published documentation indicates that primary processing operations are not limited to the UK. We do not claim that all processing is UK-only.

Where a restricted transfer occurs, HRZenith uses an appropriate lawful safeguard required by UK data-protection law, such as applicable standard contractual protections, the UK International Data Transfer Addendum, or another valid transfer mechanism. Individuals may contact us at contact@hrzenith.com for further information.

We keep active waitlist information while the early-access / launch programme is active. We will delete or anonymise waitlist information no later than six months after public launch, unless another valid reason or basis applies — for example, you have become a customer and the retention rules for that customer relationship apply, or you have separately consented to continued marketing or contact.

Unsubscribe stops marketing communications. HRZenith may retain enough information to maintain a suppression record and honour an opt-out. We do not currently operate automated waitlist deletion or anonymisation in the application; the six-month policy may be fulfilled operationally until separate retention tooling is implemented.

Retention periods that apply to Health Check documents and related Health Check data are set out in the Health Check privacy notice and do not apply to waitlist records.

The public website does not use analytics, advertising or other non-essential tracking cookies, and it does not load third-party analytics or advertising scripts. Submitting the waitlist form does not set those cookies.

Essential cookies are used only for specific services: an HttpOnly session cookie if an authorised operator signs in to the admin dashboard, and Health Check payment or document-access cookies if you use those Health Check journeys. We do not operate a cookie-consent banner because we do not use non-essential tracking cookies.

The Compliance Health Check is a separate paid service. Requesting it does not add you to the early access waitlist through that request form, and the initial Health Check request form does not collect HR documents. If you use that service, the Health Check privacy notice presented during the request journey explains the information collected for it, including any later document upload, payment processing by Stripe, and Health Check retention rules. That notice supplements and governs the Health Check service as applicable.

The public website waitlist does not use automated decision-making or profiling to make significant decisions about individuals. The waitlist does not process your submissions through AI.

Under UK data-protection law you have rights in relation to your personal information. Those rights can depend on the circumstances and on the lawful basis we rely on. They are not always absolute. Depending on the situation, they include:

• the right of access
• the right to rectification
• the right to erasure
• the right to restriction of processing
• the right to data portability, where applicable
• the right to object to processing based on legitimate interests
• the right to withdraw consent where we rely on consent, without affecting processing that was lawful before withdrawal

To make a rights request, contact us at contact@hrzenith.com.

If you are unhappy with how HRZenith uses your personal information, you have the right to complain to the Information Commissioner’s Office (ICO). That right does not depend on HRZenith quoting an ICO registration number on this website. You can find out how to contact the ICO at ico.org.uk/make-a-complaint.

For privacy questions, data-protection enquiries and rights requests, contact us at contact@hrzenith.com. That is the primary address for those requests.

For general website enquiries, you may also use hello@hrzenith.com. We have not appointed a Data Protection Officer.