Privacy Policy

This notice explains how Gavernor (“we”, “us”) collects and uses personal data when you use our website and employer platform, and your rights under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Gavernor is the data controller for the personal data described below. Registered address and company number: [to be confirmed]. For any privacy question or to exercise your rights, contact us at support@gavernor.com.

2. The personal data we collect

When you contact us

• Enquiry & demo forms: your name, work email, phone, company, postcode/site address, and the details you provide.
• Investor / register-interest form: your name, email, phone, company and message.

When you hold an account

• Employers: contact name, email, phone, company name, address, postcode and VAT status.
• Workers (via the platform): name, contact details, trade, location/postcode, certifications, ratings, attendance/check-in records and payment details. Bank details are never exposed to the employer web portal.

When you browse

• Privacy-friendly, aggregate analytics: page visited, referrer, approximate country/region/city derived at the network edge, and browser type. We do not store your IP address and do not use advertising or cross-site tracking. See our Cookies & storage notice.

3. Why we use it, and our lawful basis

• Responding to your enquiry / providing the service — performance of a contract, and our legitimate interests in operating the platform.
• Marketing contact (where you have ticked the box) — your consent, which you can withdraw at any time.
• Running bookings, attendance and timesheets — performance of a contract and legitimate interests in delivering the workforce service.
• Security, fraud prevention and aggregate analytics — our legitimate interests in keeping the platform safe and improving it.
• Legal and accounting obligations — compliance with a legal obligation.

4. Who we share it with

We use carefully selected processors under written data-processing agreements, including:

• Hosting & database: Vercel and Supabase.
• Anti-spam: Cloudflare Turnstile.
• Transactional email: Resend.
• Address/postcode lookup: postcodes.io and OpenStreetMap (Nominatim).

We do not sell your personal data. [Confirm processor list and regions.]

5. International transfers

Some processors may handle data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or an adequacy decision. [Confirm the mechanism for each processor.]

6. How long we keep it

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. [Confirm retention periods for enquiries, accounts and analytics.]

7. Your rights

You have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. To exercise any right, email support@gavernor.com; we will respond within one month.

8. Complaints

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. We’d appreciate the chance to resolve it first.

9. Changes

We may update this notice; the “last updated” date above shows when. Material changes will be highlighted.