Scope
This policy explains how OsmicSoft Ltd handles personal data when you visit osmicpeople.com, subscribe to OsmicPeople, or use a customer workspace.
Data we collect on the website
Contact and account details you give us (name, work email, company, employee count), billing details handled by Stripe (we receive a customer reference and payment status, never full card numbers), and basic technical logs (IP address, browser, pages viewed) used for security and to keep the site working.
Data inside customer workspaces
Employers use OsmicPeople to manage their employees' records. For that data the employer is the controller and OsmicSoft is a processor acting on the employer's instructions. Employees should direct requests about their data to their employer.
Why we process data
To provide and bill the Service (contract), to secure it and prevent abuse (legitimate interests), to send service messages such as invitations, payment receipts and security alerts (contract), and, only if you opt in, product updates (consent).
Sub-processors
We use a small number of providers to run the Service: hosting and storage infrastructure, Stripe for payments, and an email delivery provider for transactional mail. A current list is available on request.
Retention
Website enquiries are kept for up to 24 months. Workspace data is kept for the life of the subscription and deleted within 90 days of termination unless you ask for earlier deletion or the law requires longer retention. Payment records are kept for the period required by tax law.
Your rights
However you contact us, we respond within one month (or the shorter period your law sets) and never charge for a reasonable request. Write to support@osmicpeople.com. Depending on where you live:
United Kingdom and European Economic Area
Under the UK GDPR and the EU GDPR you can ask for access to, correction or deletion of your personal data, restrict or object to processing, ask for portability, and withdraw consent at any time (as easily as you gave it). You can complain to the Information Commissioner's Office (UK) or your local data protection authority (EEA).
United States
We do not sell personal information and do not share it for cross-context behavioural advertising. Residents of California and other states with privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) can ask to know, access, correct or delete their personal information, and opt out of any sale, sharing or targeted advertising. We honour Global Privacy Control browser signals as an opt-out and tell you when we have. We will not discriminate against you for using these rights. You can use an authorised agent.
Canada, Brazil, India, the UAE, Australia and elsewhere
You have the rights your local law gives you — for example under PIPEDA and Quebec's Law 25, Brazil's LGPD, India's Digital Personal Data Protection Act, the UAE's Personal Data Protection Law and Australia's Privacy Act — including access, correction and, where applicable, deletion and withdrawing consent. Where the rules are unclear we apply the strictest: optional cookies stay off until you agree.
Security
The Security page describes the technical and organisational measures in place. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.
International transfers
Where data leaves the UK, we rely on adequacy regulations or standard contractual clauses with the recipient.
Contact
support@osmicpeople.com · OsmicSoft Ltd, United Kingdom.