Privacy Policy

Privacy Policy · hrgoat.ai

hr goat Privacy Policy

Version 2026-10-16. Effective 14 September 2026.

This policy explains what we do with personal data.

Read this first. There are two different situations and they are governed differently.

1. Data we decide about (we are the controller). Your name and email when you open an account, your billing contact, your support tickets, our website analytics, sales enquiries. This policy covers that, and we are responsible for it.

2. Employee data inside a customer's workspace (we are the processor). If your employer uses hr goat, the personal data in that workspace belongs to your employer. They decide what goes in, why, and for how long. We only act on their instructions. This policy does not govern that data. Your employer's own privacy notice does. If you are an employee and want to access, correct or delete your records, contact your employer, not us. Our obligations to them are set out in the Data Processing Addendum.

If you are ever unsure which bucket something falls into, email legal@hrgoat.ai and we will tell you.

1. Who we are

hr goat is a product of Kepler Experience Limited, a company registered in England and Wales (company number 13618974), registered office 80-83 Long Lane, London EC1A 9ET, United Kingdom.

For the purposes of the UK GDPR and the Data Protection Act 2018, Kepler Experience Limited is the controller of the personal data described in section 3.

ICO registration reference: ZC248088. Our entry on the Information Commissioner's public register of fee payers can be viewed at https://ico.org.uk/ESDWebPages/Entry/ZC248088.

Data Protection Officer. We have appointed a Data Protection Officer, contactable at dpo@hrgoat.ai. You may raise any question about how we handle personal data with them directly, and they act independently in doing so.

General data protection contact: legal@hrgoat.ai.

For South African data subjects, the responsible party is Kepler Experience Limited. Our South African subsidiary, Kepler Experience (Pty) Ltd (registration number 2022/662394/07), is registered with the Information Regulator under registration number 2026-066673. The registered Information Officer is Darren Michael Lang, contactable at legal@hrgoat.ai.

2. Scope

This policy applies to:

• visitors to hrgoat.ai and its subdomains
• people who contact us about sales, support or billing
• account holders and administrators of hr goat workspaces
• applicants and workers of Kepler Experience Limited (section 11)
• users of the hr goat mobile apps
• users of a messaging channel, such as WhatsApp, switched on by their employer

It does not apply to personal data we process on behalf of a customer inside their workspace. See the note at the top.

3. What we collect and why

3.1 Account and workspace data

3.2 Billing data

We never see or store full card numbers. Card data is captured and held by our payment processor. See section 7.

3.3 Usage and technical data

Our legitimate interest is running a secure, reliable, improving service. We have assessed this against your interests and consider it proportionate. You can object: see section 9.

3.4 Support data

What you tell us when you contact sos@hrgoat.ai, including ticket content and any attachments. Purpose: to help you. Lawful basis: contract, or legitimate interests where you are not yet a customer.

3.5 Sales and marketing data

3.6 What we do not collect

We do not knowingly collect special category data about you in your capacity as an account holder. Do not send us health data, biometric data, or similar in a support ticket. If you need to discuss something sensitive, email legal@hrgoat.ai and we will arrange a secure route.

3.7 Mobile apps and WhatsApp

If you turn on fingerprint or face unlock, your phone does the check. We never receive or store biometric data. The app asks for camera, photo or file access only when a feature needs it, and you can withdraw it in your phone settings. Notification previews and WhatsApp messages never contain sensitive information, including health and equity data.

4. What we do not do with your data

Stated plainly, because it matters in this market:

• We do not sell personal data. Not to anyone, ever, under any definition of "sell" including the broad US definitions.
• We do not share your data with advertisers, contest sponsors or marketing partners.
• We do not use customer data to train AI models. Not ours, not anyone's. Neither do our AI sub-processors. This is contractual, not just a policy.
• We do not run behavioural advertising or retargeting on the basis of what you do inside the product.
• We do not read customer workspace content except where strictly necessary to provide support you have requested, to investigate a security incident, or where law requires it. Access is logged.

5. AI features and automated decision-making

5.1 hr goat includes AI features that generate summaries, answers, recommendations and scores. These operate on data inside a customer's workspace, where the customer is the controller.

5.2 We do not make automated decisions producing legal or similarly significant effects about you. The service is designed so that a human must review and take responsibility for any such decision, and our terms require our customers to operate it that way.

5.3 If you are an employee and you believe a decision about you was made solely by automated means, you have rights under Article 22 of the UK GDPR and section 71 of POPIA. Raise it with your employer, who is the controller. We will support them in responding.

5.4 AI features run on Google Vertex AI, inside the same Google Cloud environment that hosts the rest of hr goat. Data does not leave that environment to reach a model, and there is no separate AI provider.

5.5 How AI processing works technically, including the no-training commitment and what happens if we change model, is set out in the Data Processing Addendum and the Sub-processor List.

6. Where your data is held

6.1 hr goat runs on Google Cloud Platform. Production data is hosted in the europe-west1 region (St Ghislain, Belgium), within the European Economic Area.

6.2 All engineering, product and support personnel with access to production systems are employed by Kepler Experience (Pty) Ltd, our wholly owned South African subsidiary, in Johannesburg. They access the Belgian hosting environment remotely, under contractual confidentiality obligations, role-based access control, least privilege, multi-factor authentication and access logging. Company officers in the United Kingdom may access administrative interfaces; the UK benefits from an EU adequacy decision, so that access is not a restricted transfer.

6.3 International transfers. Production data is held in the EEA (Belgium). The transfers that occur are:

(a) UK to EEA. Where personal data originates in the UK, it is transferred to our Belgian hosting region. The UK Government has made adequacy regulations in respect of the EEA under section 17A of the Data Protection Act 2018, so this transfer requires no additional safeguard.

(b) Within the EEA. Where personal data originates in the EEA, it stays in the EEA. This is not a restricted transfer.

(c) South African personal information. Personal information from South Africa is hosted in Belgium and is therefore transferred outside the Republic. These transfers are made in accordance with section 72 of POPIA, on the basis that the recipient is subject to a binding agreement providing an adequate level of protection, being the Google Cloud Data Processing Addendum together with the European Union Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum.

(d) Access from South Africa. Our engineering, product and support teams operate from South Africa and access production systems remotely. South Africa is not the subject of a UK or EU adequacy decision, so this transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses for EEA-origin data, supported by a transfer risk assessment.

(e) Supplementary measures. For all transfers we apply encryption in transit and at rest, role-based access control, least privilege, multi-factor authentication and access logging.

6.4 Our sub-processors and their locations are listed at /legal/sub-processors.

7. Who we share data with

We share personal data only with:

7.1 Sub-processors and service providers who help us run the service, under written contracts requiring them to process only on our instructions, keep it confidential and apply appropriate security. The current list, with each provider's role and location, is at /legal/sub-processors.

7.2 Professional advisers including lawyers, accountants and auditors, where necessary and under confidentiality.

7.3 Authorities, where we are legally required to. We will tell you unless legally prohibited from doing so, and we will challenge requests we consider overbroad or unlawful.

7.4 A buyer or successor, if we are involved in a merger, acquisition or sale of assets. We will give you notice, and the buyer will be bound by this policy or an equivalent one.

We do not share personal data with anyone else without your instruction or consent.

8. How long we keep it

Where we no longer need data we delete it or irreversibly anonymise it.

9. Your rights

Where we are the controller, you have the right to:

• access the personal data we hold about you, and get a copy
• rectification of data that is inaccurate or incomplete
• erasure, in certain circumstances
• restriction of processing, in certain circumstances
• portability of data you gave us, in a machine-readable format
• object to processing based on legitimate interests, including profiling
• object to direct marketing at any time, absolutely
• withdraw consent where we rely on it, without affecting processing already carried out

Under POPIA, South African data subjects additionally have the right to object to processing, to request correction or deletion, and to submit a complaint to the Information Regulator.

How to exercise them. Email legal@hrgoat.ai. We will respond within one month. If the request is complex we may extend by two further months and will tell you why. We may need to verify your identity first. There is no charge unless the request is manifestly unfounded or excessive.

If you are an employee of an hr goat customer, direct your request to your employer. They are the controller. If you send it to us, we will forward it to them and tell you we have done so.

If we refuse a request, in whole or in part, we will tell you why, and we will tell you about both your right to complain to us as the controller under section 164A of the Data Protection Act 2018 and your right to complain to the Information Commissioner under section 165. This dual signposting is required by the UK GDPR as amended by the Data (Use and Access) Act 2025.

Complaints. You can complain to us at legal@hrgoat.ai. You can also complain to a supervisory authority:

• UK: Information Commissioner's Office, ico.org.uk, 0303 123 1113
• South Africa: Information Regulator, inforegulator.org.za
• EEA: your local data protection authority

We would rather you came to us first, but you do not have to.

10. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS 1.2 or above) and at rest (AES-256)
• role-based access control and least privilege
• multi-factor authentication for all staff with production access
• logging and monitoring of access to production systems
• segregated environments for development, testing and production
• regular vulnerability scanning and periodic penetration testing
• documented incident response procedures with defined escalation
• background checks and confidentiality obligations for personnel with data access
• supplier due diligence before any sub-processor is engaged

Full technical and organisational measures are set out in Schedule 5 of the Agreement, which the Data Processing Addendum applies at its clause 6.2.

No system is perfectly secure. We do not guarantee absolute security, and neither can anyone who tells you otherwise.

Breach notification. If a personal data breach occurs affecting data for which we are the controller, we will notify the ICO within 72 hours where required under Article 33 UK GDPR, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights. Where we are a processor, we notify the customer without undue delay, as set out in the DPA.

11. Job applicants and our own people

If you apply for a role at Kepler Experience Limited, we process your application data to assess it. Lawful basis: legitimate interests, and taking steps at your request before entering a contract. We keep unsuccessful applications for 12 months, then delete them, unless you agree to us keeping them longer.

Our own workers' data is handled under our internal employee privacy notice, available from legal@hrgoat.ai.

12. Children

hr goat is a workplace tool. You must be 18 or over to hold an account.

We do not knowingly collect personal data from anyone under 18 in their capacity as an account holder. If we learn we have, we delete it.

Separately, a customer may lawfully hold records about workers under 18 inside their workspace, for example apprentices. In that case the customer is the controller and is responsible for the lawful basis, any necessary parental consent, and appropriate safeguards. Our obligations are set out in the DPA.

13. Cookies

We use cookies and similar technologies. See the Cookie Policy. Non-essential cookies are set only with your consent, which you can change at any time through the cookie preferences link in the site footer.

14. Links to other sites

Our site links to other sites. This policy does not apply to them. Read theirs.

15. Changes to this policy

We may update this policy. For material changes we will give 30 days' notice by email to account holders and by notice on the website. Continued use after the effective date means you accept the updated policy.

Every version is archived at hrgoat.ai/legal/privacy with the change log below.

16. Contact

Kepler Experience Limited, 80-83 Long Lane, London EC1A 9ET, United Kingdom.

Change log