How we use your personal data This notice explains how hyperexponential collects and uses personal data. It is a layered notice: the first section applies to everyone and explains who we are, your rights, how to contact us and how to complain. The later sections explain the specific ways we use personal data depending on your relationship with us, whether you are a website visitor, a customer or prospective customer, a job applicant, a supplier or contractor, or a user of our platform.
In this notice, “we”, “us” and “our” refer to Hyperexponential Ltd together with Hyperexponential Inc and Hyperexponential sp. z o.o., unless stated otherwise.
Part 1: Information that applies to everyone
Who we are
Hyperexponential Ltd is the controller responsible for your personal data in most circumstances. Where we act together with our group companies, we are joint or separate controllers depending on the activity. Where we process personal data on behalf of our customers through our platform, we act as a processor and the customer is the controller. This is explained further in the platform users section below.
We are committed to protecting your personal data and take the security of your information very seriously. We have technical and organisational measures in place to protect your personal data, including access controls, encryption of data in transit and at rest, single sign-on and multi-factor authentication, and audit logging.
Our data protection officer and representatives
You can contact our data protection team about anything in this notice or about how we use your personal data using the details in the contact section below.
Your rights
Under data protection law, you have certain rights over the personal data we hold about you:
The right of access.
The right to rectification.
The right to erasure (the right to be forgotten).
The right to restrict processing.
The right to data portability.
The right to object, including to direct marketing.
Rights relating to automated decision-making and profiling.
Where we rely on your consent to process your data, you can withdraw that consent at any time. Where we rely on our legitimate interests, you have the right to object, and we will stop processing unless we have compelling legitimate grounds to continue or we need to process your data in connection with legal claims. If you would like to exercise any of your rights, please contact us using the details in the contact section below.
How to complain
If you are unhappy with how we have handled your personal data, you can complain to us directly and we will look into it. Please contact us using the details in the contact section below, setting out your concern, and we will acknowledge your complaint and respond to you within the timeframes set by law. We will keep you informed of progress and tell you the outcome, and we will explain your right to escalate the matter if you remain dissatisfied.
You also have the right to complain to the Information Commissioner’s Office, which is the UK data protection regulator, at ico.org.uk. We would, however, appreciate the opportunity to address your concerns before you approach the regulator, so we would encourage you to contact us first.
Sharing, storage and international transfers
Sometimes we share your information with other organisations, who may use it only for the purposes we allow and under written agreements as required by law. Depending on the activity, this may include other companies within our group, service providers who help us run our business, and professional advisers, regulators and government agencies where appropriate. We may also disclose your personal information where we sell any part of our business or assets, or where we are legally obliged to do so. We do not share your information with third parties for their own commercial purposes without your permission.
Some of our service providers are located outside the UK and the European Economic Area, including in the United States. Where your personal data is transferred to a country that does not provide the same level of protection, we put appropriate safeguards in place. Depending on the provider, we rely on an adequacy decision, the UK extension to the EU-US Data Privacy Framework, or standard contractual clauses together with a transfer risk assessment. You can ask us for further information about these safeguards using the contact details below.
Security and retention
Your information is securely stored. We implement technical and organisational measures to ensure that any information we hold about you is secure and protected against unauthorised access, disclosure, alteration or destruction.
We retain your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. When we no longer need your data, it is securely deleted or anonymised. The retention periods for particular activities are set out in the relevant sections below.
Part 2: Website visitors, customers and prospective customers
The information we collect and where it comes from
We collect personal data about website visitors and about customers and prospective customers. Depending on how you interact with us, this may include:
Identity and contact data, such as your name, job title, business email address and mobile number.
Professional information, such as your employer, professional role, LinkedIn profile and notes on how our products may be relevant to your organisation.
Location data, such as the country or region you are based in.
Technical and usage data, such as your IP address, cookie data and information about how you use our website.
Engagement data, such as records of webinars and events you attend, call recordings, and your communications and account history with us.
Most of this information comes directly from you. We also obtain personal data from business contact data providers (such as Cognism), data enrichment services drawing on third-party databases and publicly available information (such as Clay), and professional networking platforms where individuals have made information publicly available (such as LinkedIn Sales Navigator). We also use website analytics and visitor-identification tools that help us understand which organisations visit our website.
If you submit your details through a form on our website, we may add to the information you provide using the enrichment services described above, so that we hold accurate and complete professional contact information. We also use these services to keep our records up to date, including where you change role or employer.
How we use your personal data
We use your personal data for the following purposes:
Identifying and contacting potential business customers, and progressing sales activity
Categories of personal data: Name, business email, job title, mobile number, LinkedIn profile, location, and professional information relevant to your organisation
Lawful basis: Legitimate interests (identifying and reaching B2B prospects who may benefit from our products)
Retention: For as long as you remain a relevant business contact, after which records are reviewed and removed
Managing our ongoing relationship with customers, including account and contact records and the secure deal room used during sales transactions
Categories of personal data: Name, business email, job title, account and contact history, and access logs
Lawful basis: Legitimate interests, and steps taken at your request prior to entering into a contract
Retention: For the duration of the customer relationship and a reasonable period afterwards
Inviting you to, and following up on, webinars and live events
Categories of personal data: Name, email, job title and company
Lawful basis: Legitimate interests; consent where required for marketing communications
Retention: For as long as needed to manage the event and related follow-up
Sending you marketing communications by email and WhatsApp, and segmenting our audiences to make those communications relevant
Categories of personal data: Name, email, job title, mobile number, LinkedIn profile, location and professional information
Lawful basis: Legitimate interests (B2B direct marketing); consent where required under PECR
Retention: Until you opt out or are no longer a relevant contact
Producing business insight and analysis to improve our sales and customer success activity, which may include call recordings and usage data
Categories of personal data: Name, business contact details, professional information, customer usage data and call recordings
Lawful basis: Legitimate interests; consent for call recording where required
Retention: Retained for as long as needed for the relevant analysis
Sending gifts to customers and prospects
Categories of personal data: Name, office address and home address (where provided)
Lawful basis: Legitimate interests
Retention: Deleted once the gift has been sent
Operating our website and its core functionality, and analysing how the website is used
Categories of personal data: IP address and cookie data
Lawful basis: Legitimate interests, and strictly necessary cookies (exempt from consent under PECR); consent for non- essential cookies
Retention: In line with the lifespan of the relevant cookies
Identifying organisations that visit our website for business development purposes
Categories of personal data: Name, professional role, employer, business contact details and on-site behavioural information
Lawful basis: Legitimate interests
Retention: Reviewed and removed when no longer relevant
We do not make decisions that produce legal or similarly significant effects about you using solely automated means.
Call Recording
We record some of our external calls with customers and prospective customers using a conversation intelligence tool. You will be told at the start of any recorded call, either through a consent page shared when the call is arranged or through an announcement when the call begins.
We use recordings and transcripts to keep an accurate record of our conversations, to follow up on the matters discussed, to train and coach our teams, and to produce analysis that helps us improve how we sell and support our customers. We rely on our legitimate interests for this, or on your consent where you have given it through the consent page.
Recordings and transcripts are retained for as long as needed for these purposes and are then deleted. If you would prefer not to be recorded, you can tell us at the start of the call, and you can object to this processing at any time using the contact details below.
Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies, which allow the website to function, are used without consent as permitted under the Privacy and Electronic Communications Regulations. Non-essential cookies, including those used for analytics and tracking, are only set where you have given your consent. You can manage your preferences at any time through our consent banner.
Marketing communications and your choices
When we collect your personal data, we will, where required, ask how you would like to hear from us about our products and services. Our marketing emails include an unsubscribe option, and you can change your mind at any time by using that option or by contacting us using the details below.
Part 3: Job applicants and candidates
This section applies if you apply for a role with us or are considered for one. We are the controller for the personal data we process about you during recruitment.
The information we collect and where it comes from
We collect personal data directly from you when you apply, and from others involved in the recruitment process. Depending on the role, this may include:
Identity and contact data, such as your name and contact details.
Application data, such as the information on your CV, covering letter, interview notes, assessment notes and technical assessment results.
Right to work data, such as passport, visa and nationality information, which we are legally required to check.
Background check data, such as employment references, professional qualification checks, adverse financial history checks and, where relevant to the role, criminal record checks.
Interview recordings, where interviews are recorded.
We may receive personal data about you from recruitment agencies and talent partners, from your named referees, and from background-check and screening providers.
How we use your personal data
Assessing your application and managing the recruitment process, including CV review, interviews and assessments
Categories of personal data: Name, contact details, CV and application information, interview and assessment notes, technical assessment results
Lawful basis: Legitimate interests (assessing candidates for our roles); steps taken at your request prior to entering into a contract
Retention: For the duration of the recruitment process and a limited period afterwards
Keeping your details on file for future opportunities where you agree
Categories of personal data: Name, contact details and application information
Lawful basis: Consent
Retention: Until you withdraw consent or the agreed period ends
Carrying out right to work checks
Categories of personal data: Passport, visa and nationality information
Lawful basis: Legal obligation
Retention: As required by immigration law
Carrying out pre-employment background and reference checks for successful candidates
Categories of personal data: Employment references, qualification checks, adverse financial history checks, and criminal record checks where relevant to the role
Lawful basis: Legitimate interests and, where applicable, legal obligation; for criminal record data, a condition under the Data Protection Act 2018
Retention: For a limited period after the check is completed
Recording interviews to support fair and consistent assessment
Categories of personal data: Interview recordings
Lawful basis: Legitimate interests, with clear notice given before recording
Retention: For a limited period after the recruitment decision
Where we use tools that help us filter or shortlist applications, a person always reviews the outcome before any decision is made about your application. We do not make recruitment decisions that produce legal or similarly significant effects about you using solely automated means. If you would like to understand more about how these tools are used, please contact us.
Part 4: Suppliers, contractors and vendors
This section applies if you are, or work for, a supplier, contractor or vendor to hyperexponential, or a prospective one. We are the controller for the personal data we process about you in that context. Where you are a sole trader or an individual contractor, this data is your own personal data; where you are a contact at a supplier organisation, it is data about you in your professional capacity.
The information we collect and where it comes from
We collect personal data directly from you and from the organisation you work for during onboarding and throughout our relationship. This may include:
Identity and contact data, such as your name, job title, business email address and telephone number.
Payment data, such as bank details needed to pay invoices.
Relationship data, such as invoice and contract details and records of our dealings with you.
Due diligence data, gathered when we assess and onboard suppliers.
How we use your personal data
Onboarding suppliers and contractors and carrying out supplier due diligence
Categories of personal data: Name, contact details, job title, bank details, and due diligence information
Lawful basis: Legitimate interests (managing suppliers and risk); performance of a contract
Retention: For the duration of the relationship and six years afterwards
Managing our ongoing relationship, processing invoices and making payments
Categories of personal data: Name, contact details, bank details, invoice and contact details
Lawful basis: Performance of a contract; legal obligation
Retention: For the duration of the relationship and six years afterwards
Meeting statutory accounting, tax and audit obligations
Categories of personal data: Financial records containing personal data
Lawful basis: Legal obligation
Retention: Six years plus the current financial year, in line with tax law
We share supplier data with our finance, legal and procurement teams and the systems they use to manage procurement and payments, with our bank, and with tax authorities and auditors where required. Some of these systems are hosted in the United States, and our US colleagues may have access to our procurement system. Transfers are covered by the safeguards described in Part 1.
Part 5: Platform users
This section applies if you use the hyperexponential platform, typically as an employee of one of our customers. It is important to understand the difference between two kinds of processing.
For most of what happens inside the platform, our customer decides what personal data is uploaded and how it is used. In those cases our customer is the controller and we act as a processor, handling the data on the customer’s instructions and under our contract with them. If you are a platform user and you have questions about how your employer uses personal data in the platform, or about data that has been uploaded into it, you should contact your employer, who is the controller for that data.
For a limited set of activities we are the controller, because we decide how and why the data is used. These are the activities described in this section, and they cover things such as setting up and securing your account and understanding how the platform is used so that we can improve it.
The information we collect
When we act as controller for platform users, we process:
Account data, such as your name, email address and log-in details.
Usage and telemetry data, such as records of how you interact with the platform, including page views, navigation and activity within the product.
How we use your personal data
Setting up and managing your platform account
Categories of personal data: Name, email address and log-in details
Lawful basis: Legitimate interests (providing and administering the platform to our customers and their users)
Retention: For as long as your account is active
Keeping the platform secure and maintaining access and audit logs
Categories of personal data: Account data and access logs
Lawful basis: Legitimate interests (security of the platform)
Retention: For as long as needed for security and audit purposes
Analysing how the platform is used so that we can improve it
Categories of personal data: Usage and behavioural telemetry, such as page views, clicks, navigation events and session activity
Lawful basis: Legitimate interests (improving our products)
Retention: Retained for as long as needed for product analytics
To provide, secure and analyse the platform we use service providers including cloud hosting and analytics providers, some of which are located in the United States. Transfers are covered by the safeguards described in Part 1. Where our customers upload personal data into the platform, and where our AI features process information that a customer chooses to input, we act as a processor and the customer’s own privacy information will explain how that data is used.
Contact details
If you have any questions about this notice, if you would like to exercise your rights, or if you wish to make a complaint about how we process your personal data, please contact us at:
hyperexponential
Email: legal@hyperexponential.com
