Privacy Policy
How Simpson Soft UK Limited collects, uses and protects personal data in connection with Workframe, and the rights you have.
This Privacy Policy explains how we collect, use, share and protect personal data when you visit workframe.online, sign up for Workframe, use it as part of your organisation, or contact us. It also explains your rights and how to exercise them.
In short: we collect only what we need to run Workframe, bill for it and support you. We never sell personal data, we do not use advertising cookies, we only use our one optional website cookie if you agree to it, and we do not use your organisation’s Workframe records to train AI models. Your employer decides what goes into its Workspace, so questions about those records usually go to them first.
1. Who we are
Workframe is provided by Simpson Soft UK Limited (“Simpson Soft”, “we”, “us”, “our”). Simpson Soft UK Limited is a private limited company registered in England and Wales (company number 05571839). Registered office: Vjh Accountancy, The Zinc Building, Broadshires Way, Carterton, Oxfordshire, OX18 1AD, United Kingdom.
For any privacy question or request, email support@workframe.online. We have not appointed a data protection officer because the law does not require one for our activities; privacy matters are handled directly by our directors.
2. When we are controller and when we are processor
- We are the controller for personal data we decide how to use: website visits, account sign-up and sign-in, billing, security, service emails we send in our own name, support requests and how we run our business.
- We are a processor for the records an organisation keeps in its Workspace, such as staff details, working patterns, leave requests, holidays and work log entries. The organisation (usually your employer) is the controller of that data and decides what is recorded and who can see it. We process it on the organisation’s instructions under our Data Processing Agreement.
If you use Workframe at work and have a question about the records your organisation keeps about you, please contact your organisation first. If you contact us, we will pass your request to them and help them respond.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity | Name, work email address, hashed password, email verification status, profile picture if you sign in with Google | You, or Google if you choose Google sign-in |
| Workspace membership | Organisation name, your role (owner, administrator, manager or staff), team, invitation details | You or your organisation’s administrators |
| Workspace records (processor data) | Working patterns, leave allowances and requests, approval decisions, holidays, work log entries and notes, audit history of changes | You, your colleagues and your organisation |
| Billing | Billing contact name, email and address, VAT number, plan, seat count, invoices, payment status. Card details are collected and held by Stripe, not by us | You and Stripe |
| Security and technical | IP address, browser and device information, session records, sign-in times, security and audit events, error logs | Collected automatically when you use Workframe |
| Product usage | Key milestones for a Workspace, such as creating a workspace, inviting the first colleague, the first leave request or work entry, starting or cancelling a subscription | Collected automatically when you use Workframe |
| Communications | Emails and support requests you send us, and our replies | You |
| How you found us | Only if you accept our optional website cookie: the website or campaign that sent you, the first page you visited and when | Your browser, with your consent |
We do not intentionally collect special category data. Organisations can record sickness absence, which may reveal that someone was unwell. We ask organisations not to record medical details or diagnoses in Workframe.
Demo. Our live demo uses made-up people and companies. We do not ask who you are. Anything you type into a demo workspace is deleted within two days. We count how many demos are started and how many lead to a trial, without identifying you.
4. How we use personal data and our lawful bases
Where we are the controller, we rely on the following lawful bases under the UK GDPR and, where it applies, the EU GDPR:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and manage your account, verify your email, sign you in and keep you signed in | Account and identity; security and technical | Contract with you, or our legitimate interest in providing Workframe to your organisation |
| Provide Workframe, including invitations, approval and leave notifications and calendar feeds | Account; membership; workspace records | Contract; and for workspace records, your organisation’s instructions |
| Take payment, manage subscriptions, issue invoices and keep accounting records | Billing | Contract; legal obligation (tax and accounting) |
| Keep Workframe secure, prevent fraud and abuse, investigate incidents and keep audit trails | Security and technical; account | Legitimate interests in protecting our service, our customers and their data |
| Understand how Workspaces adopt Workframe and improve the product | Product usage (at Workspace level) | Legitimate interests in improving our service |
| Respond to support requests and feedback | Communications; account | Legitimate interests in helping our customers; contract |
| Understand which websites, listings and campaigns bring new Workspaces | How you found us | Your consent, which you can withdraw at any time with Cookie settings on our website |
| Send essential service messages, such as security alerts, billing notices and changes to our terms | Account; billing | Contract; legal obligation; legitimate interests |
| Comply with the law, respond to lawful requests and establish or defend legal claims | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. You can ask us for details of that assessment.
We do not use personal data for advertising, we do not sell or rent personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Signing in with Google
If you choose “Continue with Google”, Google shares your name, email address, profile picture and a unique account identifier with us. We use this only to create and sign in to your Workframe account. We do not request access to your Gmail, Google Drive, Calendar or contacts.
Workframe’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. Emails we send
We send service emails that are needed to use Workframe: verification codes, password resets, invitations, leave request and approval notifications, billing notices and important changes to the service or these policies. Workspace administrators and Users can manage notification preferences in Settings, but we will still send essential account, security and billing messages.
We do not currently send marketing emails. If we start, we will send them only where the law allows, and every marketing email will include a simple way to unsubscribe.
8. International transfers
Workframe’s database and application servers are located in the United States, and some of our providers operate in other countries. When personal data is transferred from the UK or the European Economic Area to a country without an adequacy decision, we use recognised safeguards: the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with appropriate additional measures such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards.
9. How long we keep personal data
| Data | Retention |
|---|---|
| Account and sign-in details | For as long as your account exists. You can ask us to delete your account at any time. |
| Workspace records (processor data) | Controlled by your organisation. Deleted immediately if an owner deletes the Workspace, and otherwise within 90 days after the subscription or trial ends, as set out in our Terms. |
| Database backups | Up to 30 days, after which they are overwritten. |
| Billing and transaction records | Six years after the end of the financial year they relate to, as required by UK tax law. |
| Support correspondence | Up to three years after the request is closed. |
| Security logs and session records | Session records until the session ends or expires; request and error logs up to 30 days; audit events for the life of the Workspace. |
| Workspace deletion records | Up to six years, to show that a deletion took place. |
| How you found us | In your browser for up to 30 days. If you start a trial, stored with your Workspace and deleted with it. |
We may keep data for longer where needed to comply with the law, resolve disputes or defend legal claims. When data is no longer needed, we delete or anonymise it.
10. How we protect personal data
We use appropriate technical and organisational measures, including encryption in transit (TLS) and at rest, database row-level security that keeps each organisation’s data separate, role-based permissions, server-side validation of every action, hashed passwords and calendar tokens, email verification, audit logs for sensitive changes and restricted, logged administrative access. More detail is on our Security page and in our Data Processing Agreement.
No system is completely secure. If a personal data breach affects you, we will tell you and the relevant authorities where the law requires us to do so.
11. Your rights
Under UK and EU data protection law you have the right to:
- be informed about how we use your personal data;
- access your personal data and receive a copy;
- have inaccurate or incomplete data corrected;
- have your data erased in certain circumstances;
- restrict our processing in certain circumstances;
- receive your data in a portable format, or have it transferred to another provider;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you.
To exercise a right, email support@workframe.online. We may need to verify your identity. We will respond within one month, which may be extended by two further months for complex requests, and we will tell you if that applies. Where we hold the data as a processor, we will pass your request to your organisation and support it.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113), or to the data protection authority in the EU country where you live or work.
12. Additional information for United States residents
Some US state laws, such as the California Consumer Privacy Act, give residents rights over their personal information. Most personal information in Workframe is handled by us as a service provider or processor for the organisation that uses Workframe, and requests about it should go to that organisation.
For personal information we handle on our own behalf, the categories we collect, their sources and purposes are described in sections 3 and 4, and the categories of recipients in section 7. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give a right to limit its use. Subject to applicable law, you may ask to know, access, correct or delete your personal information, and you may use an authorised agent. We will not discriminate against you for exercising these rights. Send requests to support@workframe.online.
13. Children
Workframe is a business service and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy to reflect changes to Workframe, our providers or the law. We will update the effective date at the top of this page and, for significant changes, notify Workspace owners by email or in the app before the changes take effect.
16. Contact us
Email support@workframe.online, or write to Simpson Soft UK Limited, Vjh Accountancy, The Zinc Building, Broadshires Way, Carterton, Oxfordshire, OX18 1AD, United Kingdom.