Privacy Notice

The controller responsible for processing your personal data, for the activities where RevoHR acts as a controller (see Section 2), is:

Under the GDPR, a data controller is the party that determines the purposes and means of processing personal data, the "why" and the "how". A data processor processes personal data on behalf of, and only on the documented instructions of, a controller. The two roles carry different responsibilities, and it matters for your rights: you exercise your rights against the controller, and where we act only as a processor we act for another organisation that is the controller.

RevoHR takes both roles, depending on the activity:

This notice covers in full the processing for which we are the controller (Sections 3-4). Section 5 explains, at a high level, the personal data we process as a processor on behalf of our clients. If you are a worker or employee whose data is managed by your employer through RevoHR, your employer is the controller of that data: please refer to your employer's own privacy notice and address rights requests to them. We will support your employer in responding, as required by Art. 28 GDPR.

In connection with our website, our business-development and prospecting activities, and the administration of platform accounts, we process the following categories of personal data:

a) Website visitors and prospects

• Contact and enquiry data: name, work email, company name, phone number, and the free-text content of any message you send us through a contact, demo-request or waitlist form. Provided directly by you; providing it is voluntary, but it is necessary for us to respond to your enquiry.
• Technical and usage data: IP address, device and browser information, and interaction data collected through cookies and similar technologies when you visit our website (see Section 9). Collected automatically.
• Prospecting data: professional contact details of potential business customers, obtained from you or from public professional sources, used for B2B outreach.

b) Platform account users (operators)

• Identity and account data: name and email address of the individuals who log in to operate the platform (roles such as HR administrator and platform administrator), together with their assigned role and permissions.
• Authentication and security data: login credentials (passwords are never stored in readable form, but they are kept as one-way cryptographic hashes), password-reset tokens (also stored hashed), and last-login information.
• Account activity and security logs: records of certain actions performed in the application and related security/audit information, which may include identifiers such as user ID and, where applicable, technical data (e.g. IP address).

The following table sets out, for our controller-role processing, the purpose of each activity, the personal data involved, the legal basis under Art. 6 GDPR, and how long we keep the data.

We do not make decisions that produce legal or similarly significant effects about website visitors, prospects or account users based solely on automated processing (Art. 22 GDPR). See Section 10 on our use of AI.

When a client company uses RevoHR to manage its workforce, that company is the controller of its workers' personal data and decides why and how the data is processed. We act as its processor, processing the data only on the client's documented instructions and under a data-processing agreement that meets the requirements of Art. 28 GDPR. The legal basis for this processing is determined by the client, not by us.

On our clients' behalf, the platform may process the following categories of worker personal data:

• Identity and contact: first and last name, phone number (used as the worker's WhatsApp identity), email.
• Demographic: date of birth, gender, nationality and preferred language.
• National identifier: national ID number, including the Romanian CNP, which encodes date of birth and sex and is subject to specific safeguards under Romanian law.
• Address and emergency contact: home address, and the name and phone number of a worker's emergency contact.
• Employment: job title, department, role, manager, and hire / termination dates.
• Worker documents: employment contracts, ID-card scans and certificates.
• Attendance and location: check-in / check-out records including GPS location, working hours and overtime.
• Training and communications: responses to training questions (and AI-assisted analysis of them), and WhatsApp conversation content, including messages, images and voice notes.
• Special-category data (Art. 9 GDPR): medical-leave information and medical certificates (health data); facial photographs; and free-text or voice content that may incidentally reveal special-category data. This data is processed on the client's instructions and legal basis, which for employment-related health data is typically Art. 9(2)(b) or (h) GDPR combined with an Art. 6 basis.

Retention of worker data is determined by the client controller. We retain it for the duration of our service agreement and delete or return it on the client's instruction or on termination, subject to any legal retention obligations. If you are a worker, please direct access, correction, deletion and other rights requests to your employer; we will assist the employer as required under Art. 28(3) GDPR.

We use carefully selected service providers ("processors" / "sub-processors") to operate RevoHR. They process personal data only on our instructions (or, for worker data, on our clients' instructions passed on to them) under GDPR-compliant agreements. The main categories are:

We also operate internal search components (Qdrant, and a legacy ChromaDB store) hosted within our own cloud environment; these are not independent third parties. Where a company document contains worker data, that data may also be held within this search store.

Some of our sub-processors (in particular Meta, OpenAI and SendGrid, and depending on the configured cloud region, certain Microsoft Azure services) may process personal data outside the European Economic Area (EEA), including in the United States.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards under Chapter V GDPR, namely:

• European Commission adequacy decisions (Art. 45 GDPR), including the EU, U.S. Data Privacy Framework where the recipient is certified; and/or
• Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by additional technical and organisational measures where necessary.

You can request further information about the specific transfer mechanism applied to a given provider, and a copy of the relevant safeguards, by contacting us at contact@better-me.tech.

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15 GDPR): obtain confirmation of whether your data is processed and receive a copy.
• Rectification (Art. 16 GDPR): have inaccurate or incomplete data corrected without undue delay.
• Erasure (Art. 17 GDPR): request deletion of your data where legally permissible.
• Restriction (Art. 18 GDPR): request temporary restriction of processing under certain conditions.
• Data portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format.
• Object (Art. 21 GDPR): object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3) GDPR): at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint (Art. 77 GDPR): file a complaint with the competent supervisory authority.

To exercise your rights, please contact us at contact@better-me.tech. We will respond within one month (extendable by a further two months for complex or numerous requests). Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. If your data is processed by RevoHR as a processor on behalf of your employer, please address your request to your employer as the controller.

You also have the right to lodge a complaint with the Romanian supervisory authority:

Our website uses cookies and similar technologies. We use strictly necessary cookies to make the site work; these do not require consent. Any functional, analytics or marketing cookies are only set with your consent, which you can give or refuse and later change at any time through the cookie-preference settings on our website.

The specific, up-to-date list of cookies, their providers and their lifespans is available in the cookie-preference centre on our website. See also our Cookie Policy.

We use automated processing technologies, including artificial intelligence (AI), mainly within the RevoHR application. In this context we generally act as a processor on behalf of our clients; the client controller determines the purpose and legal basis. The main uses are:

In line with the EU AI Act (Regulation (EU) 2024/1689), workers who interact with the AI assistant are informed that they are communicating with an automated system. Where an automated decision would produce legal effects or similarly significantly affect a person (Art. 22 GDPR), that person has the right to obtain human intervention, express their point of view, and contest the decision; in the processor context these rights are handled by the client controller. In our controller-role processing, we do not carry out such solely-automated decision-making.

We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect personal data against unauthorised access, loss, destruction or alteration. These include encryption of data in transit (TLS), one-way hashing of operator passwords, role-based access controls, strict separation of each client's data within the multi-tenant application, and access to stored documents only through short-lived, restricted links rather than public URLs. Our infrastructure is hosted on Microsoft Azure. These measures are regularly reviewed and adapted to the state of the art.

Our website and our SaaS accounts are intended for businesses and their professional users, and are not directed at children (in Romania, the age of digital consent is 16). Where worker data processed on behalf of a client controller may relate to persons below the applicable age threshold, ensuring a valid legal basis is the responsibility of the client controller as the employer.

We reserve the right to update this notice to reflect changes in legislation or in our practices. The current version is always available on our website. We will notify you of material changes in an appropriate manner.

If you have any questions about the processing of your personal data or wish to exercise your rights, you can reach us at: