Privacy Policy

Last updated: October 15, 2026

HRSoft USA, Inc. d/b/a HRSoft (“HRSoft,” “our,” “us,” or “we”) respects individual privacy and values the confidence of its customers, our employees, our customer’s employees, our business partners and others. We collect, use and disclose personal information in a manner consistent with the laws of the countries in which we do business.

Our Data Privacy Framework Website Policy (the “DPF Website Policy”) helps you better understand why and how we collect certain personal information, the care with which we treat that information, and how we use that information. In particular, it sets forth the privacy principles we follow with respect to transfers of personal information from the European Economic Area (“EEA”), which includes the twenty-seven member states of the European Union (“EU”) plus Iceland, Liechtenstein and Norway, and from the United Kingdom and Switzerland to HRSoft in the United States. 

HRSoft last updated this DPF Website Policy as stated above. HRSoft may change or update this DPF Website Policy at any time.

HRSoft complies with the EU-U.S. Data Privacy Framework program (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK DPF Extension”), and the Swiss-U.S. Data Privacy Framework program (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. 

Consistent with our commitment to protect personal privacy, we adhere to, and HRSoft has certified to the U.S. Department of Commerce that it adheres to, the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) and the principles set forth in the UK DPF Extension (“UK DPF Extension Principles”) with regard to the processing of personal information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK DPF Extension, respectively, and the Swiss-U.S. Data Privacy Framework Program Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal information received from Switzerland in reliance on the Swiss-U.S. DPF (the Swiss-U.S. DPF Principles, together with the EU-U.S. DPF Principles and UK DPF Extension Principles, the “DPF Principles”). If there is any conflict between the terms in this DPF Policy and the DPF Principles, the relevant DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

Scope

This DPF Website Policy applies to all personal information (in any format, including electronic, paper or verbal) received by us in the United States from individual users of this website (https://www.hrsoft.com) (the “Website”) who are located in the EEA, the United Kingdom or Switzerland, to the extent such personal information is collected or processed by us through or in connection with the Website. 

Please note that this DPF Website Policy does not apply to our processing of personal information relating to individuals located in other countries. This DPF Website Policy also does not apply to our processing of personal information collected by HRSoft from its customers in order to facilitate the provision of our services, which is subject to the terms of the Master Service Agreement, Statement of Work, and any amendments or addenda thereto.

The Information We Collect

Certain information is collected automatically when you visit the Website, for the purpose of tracking site usage. This information includes your Internet Protocol (IP) address, access times, duration of visit, referring URL, browser type, device type, and domain name. We also collect internet or other electronic network activity information, such as information regarding use of our website (e.g., cookies, browsing history and/or search history). Please see our Internet Privacy Policy for further information.

In addition, certain personal information is collected for the purpose of contacting site visitors inquiring about our products and services. This personal information includes your name, company name, email address, and phone number. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

What data do we collect?

Data automatically collected by our Website	Data you provide to us
Location data (IP address; domain name)	First & Last Name
How you interact (referring URL; access date, time, duration; pages visited)	Phone number, email address
Device details (model, operating system, browser)	Company info (name, number of employees)

How do we collect your data?

Data automatically collected by our Website	Data you provide to us
When you use or view our Website, via your browser’s cookies (or similar technology).	When you: Register online or place an order for any of our products or services; Voluntarily complete a customer survey or provide feedback on any of our message boards or via email.

We may combine personal information that you provide to us with information that we collect from or about you from publicly available sources or third parties. This will include information collected in an online or offline context.

How will we use your data?

We may use any personal information provided to us through or in connection with our Website, for one of the following business or commercial purposes:

Purpose	Legal Basis (relevant to the EEA-UK Privacy Notice Supplement)
To provide, support, personalize, develop, improve and optimize our Website and the products and services that we offer, to measure the effectiveness of our advertising and notify you about changes to our products and services.	Our legitimate interest in operating our business; and/or contractual necessity.
To provide you with support and to communicate with you, including responding to requests for information submitted by you through our Website.	Our legitimate interest in operating our business; and/or contractual necessity.
To send your marketing and promotional communications about our products and services.	Our legitimate interest in operating our business; and/or consent.
To keep a record of your relationship with us.	Our legitimate interest in operating our business; and/or contractual necessity.
Ongoing operations, administrative, reporting and other processes.	Legal requirement; contractual necessity; and/or our legitimate interest in operating our business.
To audit and verify the quality and effectiveness of our services and compliance.	Our legitimate interest in operating our business; and/or legal requirement.
To maintain the safety, security and integrity of our Website, products and services, databases, technology assets and business including to detect security incidents and to protect against malicious, deceptive, fraudulent, or illegal activity.	Our legitimate interest in operating our business.
As needed, to comply with U.S., state, local, and non-U.S. laws, rules and regulations, including responding to law enforcement requests and as required by applicable law, court order or government regulations.	Legal requirement.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about the Website users is among the assets transferred.	Our legitimate interest in operating our business.
For any other purpose that has been notified in writing.	Consent or as notified.

We may process your personal information on more than one legal basis depending on the specific purpose for which we are using your personal information. 

How do we store your data?

Data automatically collected by our Website	Data you provide to us
HRSoft securely collects analytics data via protocols including TLS 1.2+, and stores your data in cloud storage located in the United States encrypted by algorithms including AES-256.	HRSoft securely collects your voluntary data via protocols including TLS 1.2+, and stores your data in cloud storage located in the United States encrypted by algorithms including AES-256.

Privacy Principles 

In processing personal information about individuals located in the EEA, United Kingdom or Switzerland through or in connection with this Website and transferred to HRSoft in the United States, HRSoft adheres to you’re the following privacy principles, which have been developed by HRSoft based on the DPF Principles. 

NOTICE: Where we collect personal information directly from individuals located in the EEA or the United Kingdom or Switzerland, through this DPF Privacy Policy, we inform the individuals about the purposes for which we collect and use personal information about them, the types of non-agent third parties to which we disclose that information, the choices and means we offer individuals for limiting the use and disclosure of personal information about them, and how to contact us. We provide notice of the foregoing via the DPF Privacy Policy when individuals are first asked to provide personal information to us, or as soon as practicable after an individual provides personal information to us, and in any event before we use or disclose the personal information for a purpose other than that for which it was originally collected.

Where we receive personal information about individuals located in the EEA, United Kingdom or Switzerland from subsidiaries, affiliates or other entities, we will use and disclose such personal information in accordance with the privacy notices provided by such entities and the choices made by the individuals to whom such personal information relates.

CHOICE: Where we collect personal information directly from individuals located in the EEA or the United Kingdom or Switzerland, we will offer individuals the opportunity to choose (opt-out) whether their personal information is (a) to be disclosed to a non-agent third party, or (b) to be used for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.

For sensitive personal information, we will give individuals located in the EEA or the United Kingdom or Switzerland the opportunity to affirmatively and explicitly (opt-in) consent to the disclosure of the sensitive personal information to a non-agent third party or the use of the sensitive personal information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual. We will provide individuals with reasonable mechanisms to exercise their choices.

DATA INTEGRITY AND PURPOSE LIMITATION: We use personal information about individuals located in the EEA or the United Kingdom or Switzerland only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. We will take reasonable steps to ensure that personal information is relevant to its intended use, accurate, complete, and current. 

ACCOUNTABILITY FOR ONWARD TRANSFERS: We generally do not transfer personal information about individuals located in the EEA or the United Kingdom or Switzerland to our agents, such as banks, credit card processors, business partners, etc. If we do (for example, because it is necessary for the provision of their service to us), we will obtain assurance from our agents that they will safeguard personal information consistent with this DPF Website Policy. Assurance may be provided by agents in the form of a contract obligating the agent to provide at least the same level of protection as required by the relevant DPF Principles. HRSoft may exchange personal information with organizations with whom we have a partnership agreement (e.g. HRSoft is listed in the app store or marketplace of a reseller or broker).

Where we have knowledge that an agent is using or disclosing personal information about individuals located in the EEA or the United Kingdom or Switzerland in a manner contrary to this DPF Website Policy, we will take reasonable steps to prevent or stop the use or disclosure. In cases of onward transfer to third parties of personal information about individuals located in the EEA, UK or Switzerland received pursuant to the EU-U.S. DPF, the UK DPF Extension, and the Swiss-U.S. DPF, HRSoft is potentially liable.

We generally do not transfer personal information to non-agent third parties, and if this policy changes in the future we will provide individuals with opt-out choice. Exceptionally, we may be required to disclose an individual’s personal information in response to a legal request by law enforcement authorities including to meet national security and law enforcement requirements.

DIRECT MARKETING:

We may use personal information about individuals located in the EEA or the United Kingdom or Switzerland to keep them informed of our products and services, if they have provided their consent to us doing so, or where we have an existing relationship with them and we wish to contact them about products and services similar to those which we already provide to them, in which they may be interested.  

If you have agreed to receive marketing, you may always opt out at a later date, and for electronic marketing communications this opt out can be actioned by clicking on the “opt-out” or “unsubscribe” link provided in such communications. You have the right at any time to stop our company from contacting you for marketing purposes or giving your data to our agents and/or partners. If you no longer wish to be contacted for marketing purposes, please contact HRSoft via the means provided in the Contact Information section below.

ACCESS AND RECOURSE: We acknowledge that individuals located in the EEA or the United Kingdom or Switzerland have the right to access their personal information. Upon request, we will grant such individuals reasonable access to personal information about them. In addition, we will take reasonable steps to permit such individuals to correct, amend, or delete information that is demonstrated to be inaccurate or incomplete, as further described in the Internet Privacy Policy. An individual wishing to limit the use or sharing of their data should contact the organization via the means provided in the Contact Information section below.

SECURITY: We will employ appropriate technical and organizational measures including physical, electronic and procedural safeguards, to protect personal information in our possession from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Such measures include pseudonymisation and encryption of personal information, imposing appropriate confidentiality obligations, ensuring the integrity and resiliency of systems, and carrying out regular testing.

ENFORCEMENT AND LIABILITY: From time to time, we will conduct compliance audits of our relevant privacy practices to verify adherence to this DPF Privacy Policy. Any employee that we determine is in violation of this DPF Privacy Policy will be subject to disciplinary action up to and including termination of employment or contract. HRSoft is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

DISPUTE RESOLUTION: In compliance with the DPF Principles, HRSoft commits to resolve complaints about the privacy of individuals located in the EEA or the United Kingdom or Switzerland, and our collection or use of any personal information about such individuals that is transferred to the United States pursuant to the DPF Principles. Individuals located in the European Economic Area, Switzerland and United Kingdom with DPF inquiries or complaints should first contact:

HRSoft

3513 Brighton Blvd, Suite 220

Denver, CO 80216

Attn: Chief Executive Officer

Alternately, inquiries can be submitted electronically to [email protected]

HRSoft has further committed to refer unresolved privacy complaints under DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgement of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2

HUMAN RESOURCES DATA WITHIN THE WORKING RELATIONSHIP

Individuals located in the EEA, UK and Switzerland whose HR data we receive within the context of the working relationship, can address questions or comments regarding the handling of that personal information directly to us via the means provided in the Contact Information below. We resolve to deal with all questions regarding this personal information and potential grievance arising from it in a timely manner.

In the event HRSoft is unable to accommodate the individual’s request regarding HR data received by us within the context of the work relationship, we further commit to working with the Data Protection Authorities (DPAs) who cover the jurisdiction the data originated from. For information on how to contact your jurisdiction’s DPA, visit https://ec.europa.eu/justice/data-protection/article-29/data-protection-authorities/index_en.htm

INTERNET PRIVACY

We use the internet, and other technologies, as tools to communicate and interact with consumers, employees, customers, business partners, and others. We recognize the importance of maintaining the privacy of personal information collected online and have created a specific Internet Privacy Policy governing the treatment of personal information collected through the Website and any other websites that we operate (the “Relevant Websites”). 

With respect to personal information that is transferred from the EEA or the United Kingdom or Switzerland to the United States, in the event of any conflict between the DPF Website Policy and the Internet Privacy Policy, the DPF Website Policy prevails to the extent of such conflict. 

DO NOT TRACK

HRSoft does not track its customers over time and across third-party websites to provide targeted advertising, and therefore does not respond to Do Not Track (DNT) signals.

CONTACT INFORMATION

Questions or comments regarding this DPF Website Policy should be submitted to us by mail to:

HRSoft

3513 Brighton Blvd, Suite 220

Denver, CO 80216

Attn: Chief Executive Officer

Alternately, inquiries can be submitted electronically to [email protected]

Phone: +1 407 475 5500

CHANGES TO THIS DPF POLICY

HRSoft is constantly trying to improve our Website and services, so this DPF Website Policy may be amended from time to time, consistent with the requirements of the DPF Principles. We will alert you to material changes by, for example, placing a notice on our Website and/or sending you an email (if you have registered your email details with us) when we are required to do so by applicable law. You can see when this DPF Policy was last updated by checking the date at the top of this page. You are responsible for periodically reviewing this DPF Website Policy.

Internet Privacy Policy

Last updated: September [●], 2026

• We understand and respect that your privacy is important to you.
• We use and disclose personal information that you provide to us via certain online resources only in ways that we tell you about.
• We use appropriate technical and organizational measures to protect personal information that you provide to us via certain online resources to prevent it from being used and shared for other purposes.
• For more details, please read our Internet Privacy Policy below or contact us.

We are committed to collecting, maintaining, and securing personal information about you in accordance with this Internet Privacy Policy, as well as applicable laws, rules and regulations. To better protect your privacy, we are providing information explaining the manner in which we process your personal information and the measures that we take to preserve the privacy and security of your personal information. 

Scope

This Internet Privacy Policy applies to personal information (as defined below) collected from online resources and communications (such as websites, email, and other online and downloadable tools) that display a link to this Internet Privacy Policy. 

If you provide personal information through other means (e.g., as an employee or seeking employment, or as a such customer in other contexts), you will receive a separate privacy notice in each such context which will govern our processing of such personal information.

Jurisdiction-specific supplements and DPF Website Policy

If you are located in the European Economic Area (“EEA”), the United Kingdom or Switzerland, or your personal data is otherwise subject to EU, UK data or Swiss protection laws, please also see (a) the EEA-UK Privacy Notice Supplement below and (b) the DPF Website Policy which applies when your personal information is transferred to HRSoft in the United States.

In the event of any conflict between this Internet Privacy Policy and the DPF Website Policy in relation to personal information about individuals located in the EEA, United Kingdom or Switzerland which has been transferred to HRSoft in the United States, the DPF Website Policy prevails to the extent of such conflict.

If you are located in California, please also see the California Privacy Notice below.

Personal information

The term “personal information” as used throughout this Internet Privacy Policy, applies to any information or set of information that identifies (directly or indirectly) or that is used by us to identify (directly or indirectly) an individual (i.e., a natural living person).

We may collect information about your computer or other electronic device when you visit our websites and use our online resources. This information may include your Internet Protocol (IP) address, domain name, browser type, data and time of your request and information provided by tracking technologies such as cookies. If you use a mobile device to access our websites and online resources, we also may collect information about your device, such as your device ID and device type, as well as usage information about your device and your use of our mobile websites and other mobile resources.

We may use other companies to deliver email communications on our behalf or to place advertisements on other websites. We do not control the tracking technologies used by these other companies.

In some cases, we may use tracking technologies in ways that identify you personally, but only after you have entered information such as a name or email address into a form or data field on our websites, or where we have registered you to use our online resources by providing a user ID and password based on information validated through other offline resources and selections, such as personal information that you have provided in response to our surveys, sections of our website that you visit frequently, or to confirm whether you have read or clicked on certain email communications we send to you so that we can make our communications more useful and interesting to you.

Cookies

Please refer to our cookies policy at https://www.hrsoft.com/cookie-policy for information about how we use cookies. 

Use of Personal Information

Generally, we collect personal information online as necessary to enable individuals to register for, customize and personalize certain of our online resources and communications. We may use personal information collected online to provide products, services and features and other resources that individuals have requested; for example, educational literature and related information about our business, email programs, tools, quizzes, questionnaires, and surveys.

We may use any personal information provided to us through or in connection with the Relevant Websites, for one of the following business or commercial purposes:

Purpose	Legal Basis (relevant to the EEA-UK Privacy Notice Supplement)
To provide, support, personalize, develop, improve and optimize the Relevant Websites and the products and services that we offer, to measure the effectiveness of our advertising and notify you about changes to our products and services.	Our legitimate interest in operating our business; and/or contractual necessity.
To provide you with support and to communicate with you, including responding to requests for information submitted by you through the Relevant Websites.	Our legitimate interest in operating our business; and/or contractual necessity.
To send you marketing and promotional communications about our products and services.	Our legitimate interest in operating our business; and/or consent.
To keep a record of your relationship with us.	Our legitimate interest in operating our business; and/or contractual necessity.
Ongoing operations, administrative, reporting and other processes.	Legal requirement; contractual necessity; and/or our legitimate interest in operating our business.
To audit and verify the quality and effectiveness of our services and compliance.	Our legitimate interest in operating our business; and/or legal requirement.
To maintain the safety, security and integrity of the Relevant Websites, products and services, databases, technology assets and business including to detect security incidents and to protect against malicious, deceptive, fraudulent, or illegal activity.	Our legitimate interest in operating our business.
As needed, to comply with U.S., state, local, and non-U.S. laws, rules and regulations, including responding to law enforcement requests and as required by applicable law, court order or government regulations.	Legal requirement.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about the users of the Relevant Websites is among the assets transferred.	Our legitimate interest in operating our business.
For any other purpose that has been notified in writing.	Consent or as notified.

We may process your personal information on more than one legal basis depending on the specific purpose for which we are using your personal information.

Consistent with the purposes identified and standards set within this Internet Privacy Policy and other applicable privacy notices that have been provided to you, in some cases we consolidate and use personal information that individuals disclose to us through various services and channels, such as the telephone, surveys, websites and other online resources and communications, in order to enhance the quality of services that we offer.

No automated decision-making, including profiling, is used when processing your personal data in connection with our websites and the online resources referred to in this Internet Privacy Policy.

Your Individual Data Protection Rights

HRSoft would like to ensure that you are fully aware of all of your data protection rights. Every individual user of this website is entitled to the following:

1. The right to be informed – You have the right to know how your personal data is being collected and used. This Internet Privacy Policy and other privacy announcements on the Website serve as your official notice.
2. The right to access – You have the right to request copies of your personal data from HRSoft. We may charge you a nominal fee for this service.
3. The right to rectification – You have the right to request that HRSoft correct any information you believe is inaccurate. You also have the right to request that HRSoft complete any information you believe is incomplete.
4. The right to erasure – Also known as the “right to be forgotten”, you have the right to request that HRSoft erase your personal data, under certain conditions.
5. The right to restrict processing – You have the right to request that HRSoft restrict the processing of your personal data, under certain conditions.
6. The right to data portability – You have the right to request that HRSoft transfer the data that we have collected to another organization, or directly to you, under certain conditions.
7. The right to object – You have the right to object to HRSoft’s processing of your personal data, under certain conditions.
8. Rights related to automated decision-making and profiling – You have the right to request not to be subject to decisions based solely on automated processing, including profiling.
9. The right to withdraw consent – If you previously gave us your consent to allow us to process your personal information for a particular purpose, but you no longer wish to consent to us doing so, you can contact us to let us know that you withdraw that consent.

If you would like to exercise any of these rights, please contact HRSoft via the means in the Contact Information section below.

Choices About Collection and Use

You have four categories of choices regarding the collection and use of personal information. These include:

• No personal information collection: You may choose not to provide any personal information online by electing not to enter any personal information into a form or data field on our websites, and by not using any personalized services provided by our online resources. However, some of our online resources are available only to individuals who provide personal information or who use personalized services.
• Limitations and options regarding uses and disclosures for other purposes: Some of our online resources may request your permission to use and disclose personal information about you in order to add you to our contact lists and to identify and offer additional services and promotions that we believe you might find interesting. You can limit the use of personal information about you by checking or un-checking options provided at the time that you enter that information or that we may offer to you in the future.
• Limitations on tracking: Our online resources that use tracking technologies, such as cookies, to remember your personal preferences and selections, enable you to choose whether you want us to use such technologies to remember you, or to provide additional services to you, by checking or un-checking options provided during registration, or at the time that you enter personal information into forms or data fields. Our online resources do not limit non-identifiable uses of tracking technologies for individual users. Individual users can control the use of certain tracking technologies, such as cookies, through most Internet browsers. If you limit or disable cookies, certain function of our websites may not work properly, including access to some of our registration-based websites.
• Email communications: You may choose to receive optional email and other communications from us by signing up for or subscribing to these communications on our websites and other online resources. If you do not wish to receive optional email communications, you may opt-out by visiting the website or other online resources where you subscribed, where available, and update your email communication selections. For electronic marketing communications, you may also opt out by clicking on the ‘opt-out’ or ‘unsubscribe’ link provided in such communications.

Access

Personal information about you will be accessible to us and our subsidiaries and to individuals and organizations that use personal information solely for and at the direction of us as necessary to fulfil the purposes set out in this Internet Privacy Policy. We use a number of service providers that provide a wide range of services including legal and financial professional advisors, our auditors, recruitment firms, consultants, IT and data security providers, data hosting providers. Uses and disclosures of personal information by external individuals and organizations acting on our behalf are governed by agreements that require personal information to be protected appropriately and such external individuals and organizations must meet our standards for data security.

We reserve the right to disclose your personal information as required by applicable law, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator, national security, for the purposes of public importance or any other legal or investigatory process involving us. Should we, or any of our affiliated entities, be the subject of a takeover, divestment or acquisition we may disclose your personal information to the new owner of the relevant business and their advisors.

Sharing of Personal Information

In general, we do not sell or disclose personal information about you except as described in this Internet Privacy Policy and other applicable privacy notices.

Security

HRSoft has implemented technical and organizational measures to help protect your personal information from unauthorized access, use, loss, destruction, or disclosure by using a variety of security technologies and procedures. However, the transmission of information and data via the Internet is not completely secure. We will take reasonable steps to protect personal information as it is transmitted from your computer to our online resources and servers, as well as to protect personal information in its possession from unauthorized access, disclosure, alteration or destruction. Any transmission of personal information or data by you to or through our websites is at your sole risk. It is your personal responsibility to secure your own copies of your passwords and related access codes for our online resources.

Data Retention

We will keep your personal information only for as long as is reasonably necessary for the purposes set out in this Internet Privacy Policy, unless a longer retention period is required by applicable law. We will not keep more personal information than we need for those purposes.

The Privacy of Children

Our websites are only intended for individuals who are at least 18 years of age. We do not knowingly encourage or solicit visitors to our websites who are under the age of 18 or knowingly collect personal information from anyone under the age of 18 without parental consent. If we learn we have collected or received personal information from an individual under the age of 18, we will delete that information.

Correcting Information

An individual who seeks access, or who seeks to correct, amend, or delete inaccurate personal information, should direct his or her inquiry to the address below. If requested to remove personal information, we will respond within a reasonable timeframe.

Contact Information

Inquiries regarding privacy or personal information can be submitted in writing to the following address:

HRSoft

3513 Brighton Blvd, Suite 220

Denver, CO 80216

Attn: Chief Executive Officer

Alternately, inquiries can be submitted electronically to [email protected]

HR Data and Our DPF Commitments

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, HRSoft commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

EEA-UK PRIVACY NOTICE SUPPLEMENT

This European Economic Area (“EEA”) and United Kingdom (“UK”) Privacy Notice Supplement (“EEA-UK Privacy Notice Supplement”) supplements the general Internet Privacy Policy set forth above with respect to our use of personal information which is subject to EEA-UK Data Protection Laws.

For the purposes of this EEA-UK Privacy Notice Supplement, “EEA-UK Data Protection Laws” mean all applicable laws and regulations relating to privacy, protection or processing of personal information in the EEA, European Union (“EU”) and UK, including the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the EU GDPR as it forms part of the laws of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union Withdrawal Act 2018 (“UK GDPR”), and including in respect of the foregoing any implementing or successor legislation and any amendments or re-enactments.

The terms “controller,” “data subject,”, “processor,” “process” and “processing” shall be interpreted in accordance with the applicable EEA-UK Data Protection Laws.

To the extent that EEA-UK Data Protection Laws apply to our processing of your personal information in connection with our websites, we will be a “controller” of your personal information. In simple terms, when applicable, this means we: (i) “control” the personal information that we collect from you or other sources; and (ii) make certain decisions on how to use and protect such personal information.

What categories of personal information do we collect?

We collect limited categories of personal information through our websites, as further set forth in the general Internet Privacy Policy above. We do not collect any special categories of personal information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data) or any information about criminal convictions and offences.

How do we use your personal information?

There is a need to process personal information for the purposes and on the legal bases set out in the general Internet Privacy Policy above. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Failure to provide personal information may mean that we cannot provide our services or products to you. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

No automated decision-making, including profiling, is used when processing your personal information.

Disclosure and transfer of personal information

To the extent your personal information is transferred to a Non-Equivalent Country (as defined below), such transfers will only be made in accordance with EEA-UK Data Protection Laws. For the purposes of this EEA-UK Privacy Notice Supplement, “Non-Equivalent Country” means a country or territory other than (i) a member state of the EEA; (ii) the UK; or (iii) a country or territory which has at the relevant time been decided by the European Commission or the Government of the UK (as applicable) in accordance with the applicable EEA-UK Data Protection Laws to ensure an adequate level of protection for personal information.

Security and retention of personal information

We take measures to ensure the security of your personal information as described in the general Internet Privacy Policy above.

Your rights

To the extent that the EEA-UK Data Protection Laws apply to our processing of your personal information in connection with our websites, you may have the following rights:

Access: You may have the right to ask for a copy of the personal information that we hold about you free of charge, however we may charge a “reasonable fee,” if we think that your request is excessive, to help us cover the costs of locating the information you have requested.

Correction: You may have the right to notify us of changes to your personal information if it is inaccurate or needs to be updated.

Deletion: If you think that we should not be holding or processing your personal information anymore, you may request that we delete it. Please note that this may not always be possible due to legal and regulatory obligations.

Restrictions on use: You may request that we stop processing your personal information (other than storing it), if: (i) you contest the accuracy of it (until the accuracy is verified); (ii) you believe the processing is against the law; (iii) you believe that we no longer need your personal information for the purposes for which it was collected, but you still need your personal information to establish or defend a legal claim; or (iv) you object to the processing, and we are verifying whether our legitimate grounds to process your personal information override your own rights.

Object: You may have the right to object to processing, including: (i) for direct marketing; (ii) for research or statistical purposes; or (iii) where processing is based on legitimate interests.

Portability: If you wish to transfer your personal information to another organisation (and certain conditions are satisfied), you may ask us to do so, and we will send it directly if we have the technical means.

Withdrawal of consent: If you previously gave us your consent (by a clear affirmative action) to allow us to process your personal information for a particular purpose, but you no longer wish to consent to us doing so, you can contact us to let us know that you withdraw that consent.

These rights are not absolute and in certain circumstances their exercise may not be possible including when personal information must be maintained to comply with applicable laws. To exercise these rights and controls, please contact [email protected]. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Contact Us

If you have any questions or concerns about this EEA-UK Privacy Notice Supplement, please contact [email protected].

Complaints

Should you wish to lodge a complaint with regards to how your personal information has been processed by us, please contact your local supervisory authority. In the UK, this is the Information Commissioner’s Office – https://ico.org.uk/global/contact-us.

CALIFORNIA PRIVACY NOTICE

This notice (the “California Privacy Notice”) supplements the Internet Privacy Policy set forth above with respect to specific rights granted under the California Consumer Privacy Act of 2018, as amended and together with implementing regulations and guidelines (the “CCPA”) to natural person California residents and provides information regarding how such California residents can exercise their rights under the CCPA. This California Privacy Notice is only relevant to you if you are a resident of California as determined in accordance with the CCPA. Information required to be disclosed to California residents under the CCPA regarding the collection of their personal information that is not set forth in this California Privacy Notice is otherwise set forth above in the Internet Privacy Policy. This California Privacy Notice applies solely to your interactions with us through our websites. If you provide personal information to use through another means (e.g., as an employee seeking employment) you will receive a separate privacy notice and that notice will govern that personal information. 

Information We Collect About You

The types of personal information we collect about you depends on the nature of your interaction with us. The categories of personal information we have collected from individuals on our websites over the last twelve (12) months include the following: 

Category	Examples	Collected
A) Identifiers	Name, contact details and address (including physical address, email address and Internet Protocol address), and other identification (including social security number, passport number and driver’s license or state identification card number).	YES
B) Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Telephone number, signature, bank account number, other financial information (including accounts and transactions with other institutions and anti-money laundering information).	YES
C) Protected classification characteristics under California or federal law	Date of birth, citizenship and birthplace.	NO
D) Commercial information	Account data and information regarding transaction history or investment experience.	NO
E) Biometric information	Imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns and voice recordings or keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contains identifying information.	NO
F) Internet or other similar network activity	Use of our websites (e.g., cookies, browsing history and/or search history), as well as information you provide to us when you correspond with us in relation to inquiries.	YES
G) Geolocation data	Physical location or movements.	NO
H) Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I) Professional or employment-related information	Current or past job history or performance evaluations.	NO
J) Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K) Inferences drawn from other personal information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO
L) Sensitive Personal Information (see further information on use of sensitive personal information below)	Social security, driver’s license, state identification card, or passport numbers; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic data; the contents of a consumer’s mail, email, and text messages unless you are the intended recipient of the communication; biometric information for the purpose of uniquely identifying a consumer; and personal information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation.	NO

We do not knowingly collect or solicit personal information from anyone under the age of 18. 

We do not knowingly collect or use sensitive personal information other than: 

• • To perform services, or provide goods, as would reasonably be expected by an average consumer who requests those goods or services;
  • As reasonably necessary and proportionate to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; 
  • As reasonably necessary and proportionate to resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for such actions; 
  • For short-term, transient use (but not in a manner that discloses such information to another third party or is used to build a profile of you or otherwise alter your experience outside of your current interaction with us);
  • To perform services on behalf of our business; 
  • To verify or maintain the quality or safety of a service or to improve, upgrade, or enhance such service or device; and

• To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

How We Use Your Personal Information

We collect personal information for the business or commercial purposes and from the sources set forth in the “Use of Personal Information” section of the Internet Privacy Policy above. We retain the categories of personal information set forth above in the “Information We Collect About You” section of this California Privacy Notice only as long as is reasonably necessary for those purposes set forth above in “Use of Personal Information” except as may be required under applicable law, court order or government regulations.

Disclosure of Information

We do not disclose for the purpose of cross-context behavioral advertising or sell (as such terms are defined in the CCPA) any of the personal information we collect about you to third parties. 

Within the last twelve (12) months, we have disclosed personal information collected in connection with our websites for a business purpose to the categories of third parties indicated in the chart below. We may also disclose your information to other parties as may be required by law or regulation, or in response to regulatory inquiries. 

Personal Information Category	Category of Third-Party Recipients
A) Identifiers	Service providers, banks, auditors, law firms, governmental agencies or pursuant to legal process, self-regulatory organizations, and consultants.
B) Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Service providers, banks, auditors, law firms, governmental agencies or pursuant to legal process, self-regulatory organizations, and consultants.
C) Protected classification characteristics under California or federal law	N/A
D) Commercial information	N/A
E) Biometric information	N/A
F) Internet or other similar network activity	Service providers, law firms, governmental agencies or pursuant to legal process, and consultants.
G) Geolocation data	N/A
H) Sensory data	N/A
I) Professional or employment-related information	N/A
J) Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	N/A
K) Inferences drawn from other personal information	N/A
L) Sensitive Personal Information	Service providers, law firms, governmental agencies or pursuant to legal process, and consultants.

Protection of Personal Information

We consider the protection of personal information to be a sound business practice, and to that end we employ appropriate organizational, physical, technical and procedural safeguards, which seek to protect your personal information in our possession or under our control to the extent possible from unauthorized access and improper use. 

Rights under the CCPA

Deletion Rights: You have the right to request that we delete any of your personal information that we retain, subject to certain exceptions, including, but not limited to, our compliance with U.S. federal, state, local and non-U.S. laws, rules and regulations. We will notify you in writing if we cannot comply with a specific request and provide an explanation of the reasons.

Disclosure and Access Rights: You have the right to request that we disclose to you certain information regarding our collection, use, disclosure and sale of personal information specific to you over the last twelve (12) months. Such information includes:

• the categories of personal information we collected about you;
• the categories of sources from which the personal information is collected;
• our business or commercial purpose for collecting such personal information;
• categories of third parties to whom we disclose the personal information;
• the specific pieces of personal information we have collected about you; and
• whether we disclosed your personal information to a third party, and if so, the categories of personal information that each recipient obtained.

Correction Right: You have the right to request that we correct any inaccuracies in the personal information that we retain, subject to certain statutory exceptions, including, but not limited to, our compliance with U.S., state, local and non-U.S. laws, rules and regulations. We will notify you in writing if we cannot comply with a specific request and provide an explanation of the reasons.

No Discrimination: We will not discriminate against you for exercising your rights under the CCPA, including by denying service, suggesting that you will receive, or charging, different rates for services or suggesting that you will receive, or providing, a different level or quality of service to you.

How to Exercise Your Rights: To exercise any of your rights under the CCPA, or to access this notice in an alternative format, please submit a request on your behalf using any of the methods set forth in the “Contact us” section below. 

Contact us

For any requests relating to the exercise of your rights under the CCPA, or questions regarding our processing of your personal information, please submit or have your authorized representative submit a request using any of the methods set forth below. 

Call us using the following toll-free number: (866) 953-8800

Email us at the following email address: [email protected]

Submit a request online using the following online form: https://www.hrsoft.com/cpra-request-form

We will contact you to confirm receipt of your request under the CCPA and request any additional information necessary to verify your request. We verify requests by matching information provided in connection with your request to information contained in our records. Depending on the sensitivity of the request and the varying levels of risk in responding to such requests (for example, the risk of responding to fraudulent or malicious requests), we may request further information in order to verify your request. You may designate an authorized agent to make a request under the CCPA on your behalf, provided that you provide a signed agreement verifying such authorized agent’s authority to make requests on your behalf, and we may verify such authorized person’s identity using the procedures above. If we request you verify your request and we do not receive your response, we will pause processing your request until such verification is received.

Please contact [email protected] with any questions about this California Privacy Notice.