Privacy Policy | Employee Rocks

01Who we are

This website is operated by Employee Rocks (“we”, “us”, “our”). For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), Employee Rocks is the data controller of the personal data described in this policy. You can reach us about anything privacy-related, or exercise any of your rights, by emailing olga@employee.rocks.

02Scope of this policy

This policy applies to personal data we collect through our website and related landing pages, and through the channels we use to communicate with prospects, clients and subscribers. It does not cover third-party websites we link to, which have their own privacy practices.

03What personal data we collect

3.1 Data you give us

Contact and enquiry data — your name, email address, company, role and the content of any message you send us, for example when you email us or get in touch through the website.
Discovery Experiences updates — your name and email address, and a record of your consent (the wording you agreed to and when), if you ask to be kept posted about Discovery Experiences.
Survey responses — your answers when you take part in one of our research surveys (such as Verification Tax 2026). Surveys are anonymous by default; if you choose to leave your email address, we use it only to send you the results. Along with your answers, we also record which link brought you to the survey (for example, a LinkedIn post or our newsletter).

3.2 Data we collect automatically

Server log data — like most websites, our hosting provider automatically records basic technical data such as IP address, browser type and the pages requested in server logs. This is used only to keep the website secure and running; we do not use it for analytics or tracking.

We do not intentionally collect special categories of data (such as health, religion or political opinions) through the website, and we ask that you do not send us such data in free-text fields.

04Why we use your data and our legal basis

Under the GDPR we only process personal data where we have a lawful basis to do so:

To respond to your enquiries and provide our services — based on taking steps at your request prior to entering a contract, or our legitimate interest in responding to you.
To send you Discovery Experiences updates — based on your consent, which you give by ticking the box on the sign-up form. You can withdraw it at any time by emailing us or using the unsubscribe link in any update.
To run our research surveys and share the results — based on your consent, which you give by submitting the survey. You can withdraw it at any time by emailing us; this does not affect results already published in aggregate.
To keep our website secure and meet legal obligations — based on our legitimate interests and compliance with applicable law.

05Cookies and similar technologies

Our website uses only strictly necessary cookies that are required for it to function. We do not use analytics, advertising or other tracking cookies, so no cookie consent banner is required. If we introduce such cookies in future, we will ask for your consent first and update this policy.

06Third-party services we use

We rely on trusted service providers. Each acts on our instructions under a data processing agreement and may only process personal data as needed to provide its service:

Service & provider	Purpose	Safeguards / more info
Website hosting — Cloudflare (Cloudflare, Inc., USA)	Hosting and delivering the website, including the server logs described above, and sending us a notification when you sign up for Discovery Experiences updates.	Data processing agreement in place. Transfers to the US rely on Cloudflare’s certification under the EU‑US Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback.
Email — Fastmail	Operation of our contact email, where Discovery Experiences sign-ups are received.	Data processing agreement in place. Appropriate safeguards apply to any cross-border transfer.
Surveys — Tally (Tally BV, Belgium)	Hosting our research survey forms and storing the responses.	Data processing agreement in place. Responses are stored in the EU.

We will update this table if we introduce another processor (for example an analytics or newsletter tool).

07Sharing and disclosure

We do not sell your personal data. Beyond the processors listed above, we may disclose personal data to professional advisers (such as lawyers or accountants), to authorities where required by law, or to a successor entity in the context of a merger, acquisition or reorganisation. Any such recipient is bound to protect your data appropriately.

08International data transfers

Our service provider may process or store personal data in a country other than your own, including outside the European Economic Area (EEA). Where personal data is transferred to such a country, we rely on appropriate safeguards — such as a European Commission adequacy decision or Standard Contractual Clauses, together with any additional measures required — so that your data continues to be protected. You can request more information about these safeguards using the contact details below.

09How long we keep your data

Enquiry and contact data — for as long as needed to handle your request and, where relevant, for the duration of our business relationship, then for a reasonable period afterwards.
Discovery Experiences updates — until you unsubscribe or the programme ends. We keep the record of your consent for as long as we need to be able to show it was given.
Survey responses — until the research is complete and its report is published, then deleted or fully anonymised. Email addresses left for the report are deleted once it has been sent.
Server log data — kept by our hosting provider for a limited period for security and operational purposes.

We may keep certain data longer where required to comply with legal, accounting or reporting obligations.

10Your rights

If you are in the EU, the UK or another region with comparable data protection law, you have the following rights in relation to your personal data:

Your right	What it means
Access	Ask whether we hold personal data about you and receive a copy of it.
Rectification	Ask us to correct inaccurate or incomplete data.
Erasure	Ask us to delete your data where there is no overriding reason to keep it.
Restriction	Ask us to limit how we use your data in certain circumstances.
Portability	Receive data you provided to us in a structured, machine-readable format.
Objection	Object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent	Where we rely on consent, withdraw it at any time without affecting prior lawful processing.
Lodge a complaint	Complain to a data protection authority — see the section below.

To exercise any of these rights, email us at olga@employee.rocks. We will respond within the timeframe required by applicable law (one month under the GDPR).

11Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, and we choose service providers who do the same. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

12Children

Our website and services are intended for business audiences and are not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

13Links to other websites

Our website may contain links to third-party websites and embedded content (for example videos or social media). We have no control over, and are not responsible for, the content or privacy practices of those third parties. We encourage you to read their privacy policies.

14Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top and, where appropriate, notify you. Please review this page periodically.

15Contact and complaints

Questions, requests or concerns about this policy or your data? Email us at olga@employee.rocks.

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.