Privacy Policy

For the account and business information of the customer that subscribes, and for our own marketing and support, Forge9X Ltd is the data controller.

For the personal data a customer puts into Empliora about their employees and the people they care for (service users), the customer is the controller and Forge9X Ltd is a processor acting on the customer’s instructions. This policy, together with our Terms, forms our processing terms.

Account and business data: names, work email, phone, role, business details, company registration, billing records.

Employee and service-user data (entered by our customers): contact details, right to work and immigration status, share codes, visa and document expiry dates, DBS and qualifications, timesheets and location stamps taken at clock-in, pay basis, care notes and similar records needed for HR and compliance. Some of this is special-category or immigration data, so we treat it with extra care.

Technical data: log, device and usage information needed to run and secure the service.

We use personal data to provide, secure and support the service, to take payment, to send service and compliance notifications, and to meet our own legal obligations. Our lawful bases are performance of a contract, our legitimate interests in running and improving the service, and compliance with legal obligations. Where we act as processor, the customer is responsible for the lawful basis for the underlying data.

We use a small number of trusted providers to run Empliora. They process data only to provide their service to us:

• Supabase (database, authentication, file storage), hosted in the United Kingdom / EU (London region).
• Vercel (application hosting and delivery).
• Resend (sending transactional and notification emails).
• Ideal Postcodes (UK address lookup when you search for an address).
• Companies House (public company data when you verify a business).
• uCheck (DBS disclosure results, where a customer imports or connects their DBS checks).

We do not sell personal data. We only share it otherwise where the law requires it.

Your data is stored in the United Kingdom and European Union. Our database is hosted in the London region. Where any provider processes data outside the UK or EU, we rely on appropriate safeguards recognised under UK data protection law.

We keep account data for as long as you have a subscription and for a reasonable period afterwards. Employee and service-user data is kept according to the customer’s instructions and their own retention duties. After your subscription ends we will, on request, provide an export and then delete your data unless we must keep it by law.

We protect data with encryption in transit, access controls, row-level security so each business only sees its own data, and reputable infrastructure providers. No system is perfectly secure, but we take reasonable steps to protect your information and will notify you and the regulator of a reportable breach where required.

Under UK GDPR you have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. If your data was entered by your employer using Empliora, they are the controller, so please contact them first; we will help them respond. To exercise a right with us, email privacy@empliora.co.uk.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we would like the chance to help first.

We use only the cookies needed to sign you in and keep the service working securely. We do not use advertising cookies.

Forge9X Ltd is registered with the Information Commissioner’s Office (ICO), registration reference CSN6873165.

We may update this policy from time to time and will change the last-updated date above. For any privacy question, email privacy@empliora.co.uk or write to Forge9X Ltd, 140 Avon Road, Chelmsford, Essex, CM1 2LB.