Privacy Policy

Henora ("Henora", "we", "us", or "our") provides a commercial business management and operations platform (the "Platform") that is licensed to and used by businesses, organisations and other authorised customers (each a "Customer").

The Platform enables Customers to manage and operate aspects of their businesses, including employee and user accounts, communications, sales, purchases, inventory, suppliers, customers, financial records, attendance, leave, announcements, reporting, approvals and related business activities.

This Privacy Policy explains how Henora collects, uses, stores, protects and otherwise processes personal information in connection with the Platform, our websites, customer relationships, support services and related business activities.

Because the Platform is provided to independent businesses, the organisation that provides you with access to the Platform may also have its own privacy policy and data protection responsibilities. Where your personal information is processed within a Customer's Platform account on the Customer's instructions, that Customer will generally determine the purposes for which the information is processed, while Henora provides and operates the technology on the Customer's behalf.

Henora's role depends on the nature and purpose of the processing activity.

Where a Customer uses the Platform to process information relating to its employees, customers, suppliers, business contacts or other individuals, the Customer will generally act as the data controller or equivalent responsible organisation, and Henora will generally act as a data processor, service provider or equivalent technology provider processing information on the Customer's behalf.

The Customer is responsible for determining the purposes for which its business data is collected and used, selecting appropriate information to enter into the Platform, providing required privacy notices to individuals, establishing appropriate lawful bases where required, and responding to individual data rights requests relating to its own processing activities.

Henora may separately act as a data controller where it processes information for its own legitimate business purposes, including managing Customer relationships, maintaining accounts, providing customer support, protecting the security of the Platform, preventing abuse, maintaining records, processing payments and invoices, complying with legal obligations, and communicating with Customers about the Platform.

The exact allocation of responsibilities may also be governed by the applicable commercial agreement, Data Processing Agreement ("DPA"), service agreement or other contractual documentation between Henora and the Customer.

Customers are responsible for the information they choose to enter into the Platform. This may include personal information relating to employees, customers, suppliers, contractors, business contacts and other individuals.

Henora does not require Customers to enter more personal information than is reasonably necessary for the relevant business function. Customers should exercise appropriate judgement when entering information and should not use the Platform to process sensitive or special-category information unless such processing is necessary, lawful, appropriately protected and permitted under the applicable agreement and law.

Customers are responsible for ensuring that the information they enter into the Platform has been collected and is processed in accordance with applicable privacy and data protection laws.

Where applicable law requires a lawful basis for processing personal information, the relevant basis may depend on the particular processing activity and the relationship between Henora, the Customer and the individual.

Depending on the circumstances, processing may be based on performance of a contract, compliance with a legal obligation, legitimate interests, consent, protection of vital interests, or another lawful basis recognised by applicable data protection legislation.

Where Henora processes information on behalf of a Customer, the Customer is generally responsible for determining the appropriate lawful basis for its processing activities. Henora processes that information in accordance with the Customer's documented instructions and applicable contractual obligations.

Access to the Platform is controlled through user accounts, authentication mechanisms and role-based permissions. Customers are responsible for assigning appropriate permissions to their personnel and reviewing access rights periodically.

Users must keep their authentication credentials confidential and must not share passwords or access credentials with unauthorised individuals.

Passwords are stored using password hashing mechanisms designed so that passwords are not stored in readable plaintext form. Henora personnel do not ordinarily have access to users' plaintext passwords.

Henora may record authentication and security events, including successful and unsuccessful login attempts, account changes and other activity necessary to protect the Platform.

Business information entered into a Customer's Platform environment remains subject to the Customer's rights, instructions and contractual arrangements with Henora.

Henora does not sell Customer business records or personal information contained within the Platform to third parties for their independent advertising or marketing purposes.

Henora may access Customer data where reasonably necessary to provide support, maintain the Platform, investigate security incidents, comply with legal obligations, enforce contractual terms, or otherwise perform services agreed with the Customer.

Henora may disclose personal information only where reasonably necessary for legitimate business, contractual, security or legal purposes.

Depending on the services provided, information may be disclosed to carefully selected service providers that support Platform infrastructure, hosting, communications, email delivery, security, monitoring, payment processing, customer support or other essential business functions.

Where third-party service providers process personal information on Henora's behalf, Henora seeks to require appropriate confidentiality, security and data protection obligations consistent with the nature of the services provided.

Henora may also disclose information where required by law, regulation, court order, governmental authority or where necessary to establish, exercise or defend legal rights.

Henora may engage third-party service providers and subprocessors to support the operation of the Platform. These providers may process limited categories of information necessary to perform their contracted functions.

Henora seeks to select service providers that provide appropriate technical and organisational safeguards and requires them to process information only for authorised purposes.

Where required by applicable law or contractual arrangements, Henora will provide Customers with information regarding relevant subprocessors and applicable changes to subprocessors.

Henora and its service providers may operate from or use infrastructure located in countries other than the country in which a Customer or user is located.

Where applicable data protection law restricts the transfer of personal information to another country, Henora will seek to implement an appropriate lawful transfer mechanism and safeguards required by the applicable legislation.

Such safeguards may include transfers to jurisdictions recognised as providing an adequate level of protection or the use of appropriate contractual or other legally recognised safeguards.

Customers should contact Henora if they require additional information regarding the location of processing or applicable international transfer mechanisms.

Henora maintains technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, destruction or loss.

Depending on the nature and risk of the processing, security measures may include access controls, role-based permissions, authentication controls, password hashing, logging and monitoring, secure software development practices, backups, infrastructure security and other appropriate safeguards.

No electronic system or transmission over the Internet can be guaranteed to be completely secure. Accordingly, while Henora takes reasonable and appropriate measures to protect information, absolute security cannot be guaranteed.

Henora maintains processes intended to identify, assess, investigate and respond to suspected security incidents involving personal information.

Where Henora acts as a processor or service provider and becomes aware of a personal data breach affecting Customer data, Henora will notify the relevant Customer in accordance with applicable law and the applicable contractual or data processing agreement requirements.

Customers remain responsible for determining whether and when notification to affected individuals, regulators or other authorities is required in relation to their own processing activities, except to the extent applicable law or contract requires Henora to provide such notification.

Henora retains information only for as long as reasonably necessary for the purpose for which it was collected, to provide contracted services, maintain legitimate business records, satisfy legal or regulatory obligations, resolve disputes, enforce agreements, maintain security, and protect legitimate business interests.

Customer data may be retained for the duration of the Customer's subscription or agreement and for a limited period thereafter where necessary for backup, recovery, legal, security or legitimate business purposes.

Specific retention periods may vary depending on the type of information, the Customer's instructions, applicable law, contractual requirements and the nature of the relevant processing activity.

When a Customer terminates its use of the Platform, Customer data will be handled in accordance with the applicable commercial agreement, DPA and Henora's applicable retention and deletion procedures.

Subject to legal, regulatory, security, backup and other legitimate retention requirements, Henora will take reasonable steps to delete or return Customer data when required by the applicable agreement or lawful instruction.

Backup copies may remain for a limited period in accordance with normal backup and disaster recovery procedures before being securely overwritten or deleted.

To protect personal information, Henora may need to verify the identity or authority of an individual submitting a privacy request before providing access, making changes or disclosing information.

Verification information will be used only to the extent reasonably necessary to authenticate the request and protect against unauthorised disclosure.

The Platform is primarily intended for ordinary business and operational information. Customers should not enter sensitive or special-category personal information unless the processing is necessary, lawful, appropriately protected and supported by the applicable Customer agreement and data protection requirements.

Where applicable law imposes additional requirements on sensitive or special-category information, the relevant Customer is responsible for ensuring that those requirements are satisfied.

The Platform may use cookies, sessions and similar technologies necessary to authenticate users, maintain sessions, protect accounts, remember preferences and operate essential Platform functions.

Where non-essential cookies or similar technologies are used, Henora will provide information and obtain consent where required by applicable law.

Henora may send service-related communications concerning accounts, security, system availability, maintenance, technical changes, billing, contractual matters and other matters necessary to administer the Platform.

Where permitted by applicable law, Henora may also send business or product communications. Recipients will be provided with appropriate choices where applicable.

Certain jurisdictions provide additional privacy rights to individuals. Where applicable law grants individuals additional rights, Henora will process applicable requests in accordance with those legal requirements.

For example, certain California privacy laws provide qualifying residents with rights concerning access, deletion, correction, limitation and disclosure of personal information. The applicability of such rights depends on the nature of the organisation, its activities, the individual and applicable legal thresholds.

Henora does not sell personal information in the ordinary commercial sense of selling personal information to third parties for their independent marketing purposes.

Where required by applicable law, Henora may enter into a Data Processing Agreement or equivalent data protection terms with Customers.

Such agreements may establish additional requirements concerning processing instructions, confidentiality, security, subprocessors, international transfers, data subject requests, breach notification, audits, deletion and return of information.

Where a valid contractual data protection agreement contains specific requirements that differ from this Privacy Policy, the applicable contractual terms may govern the relevant processing relationship to the extent permitted by law.

Henora may update the Platform and this Privacy Policy from time to time to reflect changes in the Platform, technology, business practices, legal requirements or applicable privacy standards.

The "Last updated" date displayed at the beginning of this Privacy Policy indicates when the policy was most recently revised.

Where changes are material and applicable law requires notification, Henora will take appropriate steps to notify affected Customers or users.

Individuals who have concerns about the processing of their personal information should first contact the organisation that provided their Platform account or, where the matter concerns Henora's own processing activities, contact Henora using the details below.

Where applicable law provides a right to lodge a complaint with a data protection or privacy supervisory authority, individuals may exercise that right with the competent authority in their jurisdiction.

This Privacy Policy is intended to describe Henora's general privacy practices across its commercial Platform. Specific legal rights, obligations and requirements may vary depending on the jurisdiction in which Henora, a Customer or an individual is located and the nature of the processing activity.

Nothing in this Privacy Policy is intended to remove or restrict any mandatory privacy or data protection rights that cannot lawfully be excluded or restricted.