ClearHR Privacy Notice

Last updated: 1 October 2026

hireful limited (“hireful”, “we”, “our” or “us”) operates ClearHR. We respect your privacy and are committed to protecting your personal data. This Privacy Notice explains how we collect, use and share personal data in connection with ClearHR, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended).

This is a standalone notice for ClearHR. It is separate from the hireful Ltd Privacy Notice, which covers hireful’s other services.

1. What this Privacy Notice covers

This Privacy Notice applies to:

• the ClearHR website at www.clearhr.co.uk;
• the ClearHR products and services operated by hireful, listed in section 2; and
• personal data that hireful processes for its own purposes in connection with ClearHR – for example, website enquiries, customer account administration, billing, customer support and managing the service.

ClearHR is used by organisations (our “customers”) to manage workplace cases and to run reporting and feedback channels. When a customer uses ClearHR to record and manage information about its employees, workers, reporters, cases or investigations, the customer decides why and how that information is used. In that situation the customer will normally be the data controller and hireful will normally act as its data processor (see sections 3 and 4).

This means:

• if you are an employee, worker, reporter, witness or other person whose information is held in a customer’s ClearHR account, the organisation that uses ClearHR is normally responsible for that information;
• that organisation should have its own employee, worker, whistleblowing or privacy notice explaining how it uses your information – please refer to it, or contact that organisation directly; and
• this notice explains our role as the provider of the service, but it does not replace the customer’s own privacy information or obligations.

This notice does not apply to other hireful products or services, including the hireful Applicant Tracking System (ATS), recruitment advertising or recruitment agency services. Those services are covered by separate privacy notices, available at www.hireful.com/privacy-policy.

2. About ClearHR and hireful

ClearHR is a product line operated by hireful limited, a company registered in England and Wales under company number 03825406, whose registered office is at 15-17 Strixton Manor Business Centre, Strixton, Northamptonshire, NN29 7PA, UK. hireful limited is registered with the Information Commission (formerly the Information Commissioner’s Office, or ICO) under registration number Z8069187.

The ClearHR product family currently includes:

• clearCase – a case-management product that helps organisations manage employee and workplace matters such as grievances; bullying and harassment; whistleblowing; flexible-working requests; reasonable adjustments; disciplinary matters; redundancy; long-term absence and return to work; performance and capability; safeguarding; and wellbeing-related records.
• clearVoice – a reporting and feedback product that allows organisations to create channels through which employees and other authorised users can raise concerns or provide feedback, including whistleblowing and other speak-up channels. Depending on how the customer configures it, users may be able to communicate anonymously or through an email relay.

Where we add further products to the ClearHR family, we will list them in this section. Unless we say otherwise, this notice will apply to them in the same way.

3. When we act as data controller

hireful is the data controller when it processes personal data for its own purposes in connection with ClearHR. This includes:

• responding to enquiries, demo requests and other contact made through the ClearHR website or by email or telephone;
• setting up and administering customer accounts and contracts;
• billing, invoicing and managing payments;
• providing customer support and managing our relationship with customers;
• managing, securing and improving the ClearHR website and service, including using technical and security information to protect the service;
• sending marketing communications about ClearHR, where permitted by law; and
• meeting our own legal, regulatory and financial obligations.

4. When we act as data processor

When a customer uses clearCase, clearVoice or another ClearHR product to record, manage or investigate employee and workplace matters, hireful acts as a data processor. In this role we:

• process personal data only on the customer’s documented instructions and under the ClearHR data processing agreement, which forms part of the terms each customer accepts when it signs its contract with us;
• do not use that information for our own purposes;
• implement appropriate security measures; and
• support the customer in meeting its own obligations under the UK GDPR.

Where the customer acts as controller, the customer is responsible for:

• deciding what information is recorded in ClearHR and why;
• identifying the lawful basis (and, where relevant, the condition for processing special category or criminal offence data) for its workplace case, whistleblowing, grievance or other employee-related processing;
• deciding how long that information is kept;
• giving affected individuals appropriate privacy information; and
• responding to requests from individuals to exercise their data protection rights.

Some information is processed in more than one role:

• Authorised user accounts. We are the controller of information about a customer’s authorised users (such as their name, email address, role and login details) when we use it to set up and administer accounts, provide support and keep the service secure. Where that information forms part of the customer’s records in ClearHR – for example, showing which case manager is assigned to a case – we process it as a processor on the customer’s behalf.
• Customer support. We are the controller of support requests and our communications with customer contacts. If resolving a support request requires us to access information held in a customer’s ClearHR account, we do so as a processor, on the customer’s instructions.
• Technical, security and audit-log information. Audit logs held within a customer’s ClearHR account (for example, records of who viewed or changed a case and when) are processed by us as a processor. We are the controller of technical and security information that we use to operate, monitor and protect the ClearHR service as a whole.

Summary of roles

5. Personal Data We Process

5.1 Personal data we process as controller

We may collect the following categories of personal data for our own purposes:

• Identity data (name, job title)
• Contact data (email address, telephone number, postal address)
• Organisation data (the organisation you work for and your role in relation to ClearHR, for example as a customer administrator or purchasing contact)
• Customer administration and billing data (contract details, invoicing and payment information)
• Customer support data (the content of support requests and our communications with you)
• Technical data (IP address, browser type, device information)
• Usage data (information on how you use the ClearHR website and service)
• Your marketing preferences

We may obtain this personal data from:

• You (for example, through a website form, email, telephone call or meeting)
• Your organisation (for example, when it nominates you as an account administrator or billing contact)
• Our websites and software applications
• Events, such as conferences, exhibitions and webinars
• LinkedIn
• The public domain

5.2 Personal data processed within ClearHR on behalf of customers

When customers use ClearHR, they decide what information is recorded. Depending on the product used, how the customer has configured it and the matter concerned, this may include:

• Names and contact details of employees, workers, reporters, witnesses, investigators, case managers and other people involved in a matter
• Employment and workplace information (for example job title, department, manager, location and working arrangements)
• Authorised user account information (for example name, email address, role and permissions)
• Case information (for example the type of matter, its status, dates, actions and outcomes)
• Reports, complaints, concerns, feedback and allegations
• Communications between reporters, employers, investigators and case managers
• Supporting documents and evidence uploaded to a case or report
• Notes and case records
• Information submitted through anonymous reporting channels (see section 6)
• Technical, security and audit-log information (for example records of who accessed or changed information and when)

This information is normally provided by the customer, its authorised users, or by the people who submit reports or feedback through the service.

5.3 Special category and other sensitive information

Because of the nature of workplace cases and speak-up channels, information recorded in clearCase or clearVoice may sometimes include special category personal data or other highly sensitive information. Depending on the matter, this could include, for example, information about a person’s health (such as in reasonable adjustment, long-term absence or wellbeing matters), information relating to protected characteristics raised in a grievance or harassment complaint, or information about alleged wrongdoing, including possible criminal conduct.

ClearHR does not require every type of sensitive information to be provided, and not every case or report will contain it. What is recorded depends on the matter and on the customer and the individuals using the service. Where a customer processes this information, the customer is responsible for having an appropriate lawful basis and condition for processing.

We do not intend to collect special category data for our own purposes in connection with ClearHR. Access to customer content within ClearHR is limited to authorised hireful staff in specific roles, such as support and engineering. These staff may access case and report information where this is needed to maintain the service, troubleshoot problems or respond to support requests. When they do so, we act as a processor, in line with our data processing agreement with the customer.

6. Anonymous and Confidential Reporting

clearVoice can be configured to allow people to raise concerns or provide feedback anonymously, or to communicate through an email relay. It is important to understand what anonymity means in practice.

Information you choose to provide. If you use an anonymous channel, you decide what to include in your report or messages. Anything you write or upload – including names, dates, descriptions of events or documents – may make it possible for the organisation to work out who you are, even if you do not give your name.

Technical information. ClearHR does not record or store your IP address, device or browser details or session data when you submit or follow up an anonymous report, and does not link this type of information to your report.

Following up your report. When you submit an anonymous report, you will be given a 12-digit PIN. You can use this PIN to return to your report, read replies and add further information. Please keep your PIN safe and do not share it, as anyone who has it may be able to access your report.

Email relay. Where a customer enables an email relay, messages are passed between you and the organisation through ClearHR. To do this, the service needs to process your email address, but your email address is not shown to the organisation. Relay emails are sent using our email communications sub-processor (see section 9).

What the customer can see. The customer organisation can see the content of the reports and messages submitted to its channels, and the date and time each one was submitted. It cannot see any other information about you from ClearHR.

What hireful may process. As the provider of the service, we process reports, messages and, where an email relay is used, your email address, to operate, support and protect ClearHR, acting on the customer’s instructions. Access to report content is limited to authorised hireful support and engineering staff, where needed to maintain the service, troubleshoot problems or respond to support requests (see section 5.3).

The level of anonymity available depends on how the customer has configured its channel and on the information you choose to provide. If you are unsure, please read the privacy or whistleblowing information provided by the organisation that operates the channel before submitting a report.

7. How We Use Your Personal Data

We process personal data lawfully, fairly and transparently. Where we act as controller, we use personal data primarily for the following purposes:

• Responding to enquiries, demo requests, complaints and feedback
• Setting up, administering and managing customer accounts and contracts
• Billing, invoicing and managing payments
• Providing customer support and training
• Operating, maintaining, securing and improving the ClearHR website and service
• Monitoring for, preventing and investigating security incidents, fraud and misuse
• Sending relevant marketing communications about ClearHR, such as newsletters and product updates
• Providing information to regulatory authorities or statutory bodies, and our legal or other professional advisers including insurers
• Retaining a record of our dealings
• Establishing quality, training and compliance with our obligations and best practice
• Backing up information on our computer systems

Where we act as processor, we use personal data only to provide ClearHR to the customer in line with its documented instructions.

Use of AI and automated decision-making

ClearHR uses Anthropic Claude, an artificial intelligence (AI) tool, to help users summarise cases, suggest categories and draft responses. Claude is accessed only through Amazon Web Services (AWS) Bedrock, so information processed by these features stays within AWS, which is already one of our sub-processors (see section 9), and is processed in the UK (AWS London region).

Where these features process information held in a customer’s ClearHR account, we act as a processor on the customer’s behalf. Customer content is not used to train AI models. Customers can switch the AI features off.

Important: No automated decision-making occurs. AI outputs are there to support the customer’s users, and all decisions about cases, reports and the people involved are made by people.

8. Legal Basis for Processing

This section explains the legal bases we rely on where hireful is the controller. Where we act as processor, the customer is responsible for identifying the legal basis for its processing and should explain this in its own privacy information.

• Contractual Necessity: Processing necessary to enter into or perform a contract with you, or to take steps at your request before entering into one.
• Legitimate Interests (customer contacts): Our contracts are with customer organisations. We process the personal data of the individuals who act on a customer’s behalf – such as account administrators, authorised users and billing contacts – on the basis of our legitimate interests in setting up, providing, supporting and billing for the ClearHR service.
• Legal Obligation: Compliance with legal obligations, such as financial reporting and record-keeping.
• Legitimate Interests: Responding to enquiries, managing our customer relationships, internal administrative purposes, keeping the ClearHR website and service secure, preventing fraud and misuse, and improving our services. We may also send marketing communications about ClearHR to existing customer contacts on the basis of legitimate interests, where the law allows this without consent. Every marketing message includes a way to unsubscribe. Where we rely on legitimate interests, we balance our interests against your rights and freedoms.
• Consent: We may process your personal data on the basis that you have consented to us doing so for a specific purpose, for example:
  • sending marketing communications, where consent is required (for example, where you opt in through a form on our website)
  • using cookies and similar technologies where required (see section 15).

Where we rely on consent, you can withdraw it at any time by contacting us using the details in section 18.

9. Data Sharing, Service Providers and Sub-processors

Your personal data may be shared with:

• Third-party service providers that help us operate ClearHR and run our business (for example, cloud hosting, data storage, email communications, CRM, customer support, accounting, website hosting and analytics providers)
• Legal or regulatory authorities, where required by law
• Our legal and other professional advisers, including insurers, where necessary

Information held in a customer’s ClearHR account is made available to that customer and its authorised users, in line with the access settings the customer chooses. We do not sell personal data.

ClearHR sub-processors

When acting as a processor, we use the following sub-processors to provide ClearHR:

Amazon Web Services EMEA SARL (AWS) Purpose: Infrastructure, hosting, data storage, AI services (Anthropic Claude via AWS Bedrock) Location: Within the EEA (hosting and data storage); UK – London region (AI services)

MongoDB, Limited Purpose: Data storage Location: Within the EEA

Plus Five Five, Inc. Purpose: Email communications Location: United States Mechanism for international data transfer: UK Addendum to the EU Standard Contractual Clauses

We will give customers at least 30 days’ written notice by email before adding or replacing a sub-processor. Customers have the right to object to the change, in line with our data processing agreement.

Service providers for our own business purposes

Where we act as controller, we also use the following service providers in connection with ClearHR:

HubSpot Purpose: Customer relationship management (CRM) and customer support desk Location: Germany, EEA

Xero Purpose: Accounting and invoicing Location: May include countries outside the UK, such as New Zealand Mechanism for international data transfer: Transfers only to countries recognised as providing adequate protection for UK personal data (such as New Zealand), or under appropriate safeguards such as standard contractual clauses or equivalent approved terms

Google Ireland Limited Purpose: Data analytics, only where you have agreed to analytics cookies (see section 15) Location: United States Mechanism for international data transfer: International Data Transfer Agreement

10. International Data Transfers

ClearHR data is hosted and stored within the EEA, and the AI features described in section 7 process information within the UK. The UK recognises the EEA as providing an adequate level of protection for personal data.

Some personal data may be transferred to the United States in connection with email communications and, where you have agreed to analytics cookies, website analytics (see section 9). Where personal data is transferred outside the UK to a country that is not recognised as providing an adequate level of protection, we put appropriate safeguards in place, such as the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement.

Some of the service providers we use for our own business purposes (see section 9) may process personal data outside the UK. Where they do, we rely on appropriate safeguards, as set out in section 9.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

Where we are controller:

• Website enquiry and prospective customer data: Retained until you ask us to delete it, withdraw your consent or opt out
• Customer account, contract and billing data: Retained for 6 years after the end of the customer’s contract, for legal and financial compliance
• Customer support data: Retained for 24 months
• Technical and security data used to protect the service: Retained for 6 months
• Marketing data: Retained until you withdraw your consent or opt out

Where we are processor:

The customer decides how long information held in its ClearHR account is kept, and is responsible for deleting records in line with its own retention policies.

At the end of a customer’s contract, we return or export the customer’s data on request. We then delete it 30 days after the contract ends, in line with our agreement with the customer. Backup copies are kept for up to 30 days before being permanently deleted.

If you want to know how long an organisation keeps information about a case or report involving you, please contact that organisation.

12. Your Data Protection Rights

You have the following rights under UK data protection laws:

• Right to Access: Request copies of your personal data.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data, subject to legal exceptions.
• Right to Restrict Processing: Limit processing of your data under specific circumstances.
• Right to Object: Object to data processing based on legitimate interests, and to direct marketing at any time.
• Right to Data Portability: Receive your data in a structured, commonly used format, where applicable.
• Rights related to automated decision-making: Although no automated decision-making takes place within ClearHR, you have the right to ensure human involvement.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time.

Some of these rights are not absolute and may be limited by law, for example where providing information would reveal personal data about someone else.

How to exercise your rights

• If your request relates to personal data we hold as controller (for example, a website enquiry or customer account information), contact us using the details in section 18. We aim to respond within one month.
• If your request relates to information held in a customer’s ClearHR account (for example, a case, grievance, investigation, report or feedback), please contact the organisation that uses ClearHR, as it is responsible for that information. If you contact us instead, we will pass your request to the relevant customer where we can identify it, and help the customer to respond, as set out in our data processing agreement.

13. Data Protection Impact Assessments (DPIAs)

We conduct DPIAs for high-risk data processing activities that we carry out as controller. These assessments help identify and mitigate potential data protection risks. We have carried out a DPIA for ClearHR.

Where a customer uses ClearHR for processing that is likely to result in a high risk to individuals – which may include whistleblowing, investigations or processing of sensitive information – the customer is responsible for carrying out its own DPIA. We provide reasonable assistance in line with our data processing agreement.

14. Security

We are ISO 27001:2022 and Cyber Essentials certified, and ClearHR is within the scope of these certifications. We maintain appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration or destruction. Our third-party providers are required to maintain appropriate standards.

15. Cookies and Website Technologies

The ClearHR website uses a small number of cookies and similar technologies:

• Essential: needed for the website to work properly, for example to remember your cookie choices. These cannot be turned off.
• Analytics: Google Analytics, which helps us understand which pages are read and roughly where visitors came from. We look at this information in totals rather than individually. These cookies are only set if you agree to them.
• Advertising: we do not use advertising cookies, and our cookie banner does not offer them. If this changes, we will update this notice and ask for your consent first.

You can change your choices at any time using the cookie settings on our website. We will ask you again after 180 days.

For full details of the cookies we use, including their names and how long they last, please see our Cookie Policy at www.clearhr.co.uk/cookie-policy.html.

The Cookie Policy covers the ClearHR website only. It does not apply to the clearCase and clearVoice applications.

Within the applications, including clearVoice reporting pages, we only use cookies and similar technologies that are strictly necessary to provide the service securely, for example to keep authorised users signed in. We do not use analytics or advertising cookies within the applications. If this changes, we will update this notice and ask for consent where the law requires it.

16. Changes to This Privacy Notice

We may update this notice periodically to reflect legal, technological or business changes, including when we add new products to the ClearHR family. Please review this page regularly for updates. The date at the top of this notice shows when it was last updated.

17. Complaints

If you have concerns about how we use your personal data, please contact us first using the details in section 18 so that we can try to resolve them.

You also have the right to lodge a complaint with the Information Commission, the UK’s data protection regulator (formerly the Information Commissioner’s Office, or ICO):

• Website: www.ico.org.uk
• Helpline: 0303 123 1113
• Postal address: Information Commission’s Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL

If your concern relates to information held in a customer’s ClearHR account, you may wish to raise it with that organisation first.

18. Contact Us

For questions, requests or complaints about this notice or our data practices in connection with ClearHR, please contact our Data Protection Officer:

• Email: steve@hireful.co.uk
• Postal Address: 15-17 Strixton Manor Business Centre, Strixton, Northamptonshire, NN29 7PA, UK