Skip to content
Perm
Request a demo

Back to the home page

Privacy Policy

Last updated

This policy explains how ARIA CAPITAL AND HUMAN PARTNERS S.R.L. ("Perm", "we") processes personal data as a controller: when you visit permhq.com, write to us, or use Perm as a user of one of our customers. If you are a worker or candidate whose records are kept in Perm by an employer, see section 2 first.

The controller is ARIA CAPITAL AND HUMAN PARTNERS S.R.L., 30 Constantin Daniel Rosenthal St., Apt. 5, Sector 1, Bucharest, Romania, tax code 48923183, Trade Register no. J2023019016402. You can reach us about privacy at privacy@permhq.com and about anything else at hello@permhq.com.

Perm is used by employers and recruiting agencies to keep records about their workers and candidates, such as identity and permit documents, contact details, timesheets, salaries and medical fitness results. For that data your employer (or the agency) is the controller and decides why and how it is processed. Perm only processes it on their behalf and on their instructions, as a processor under article 28 GDPR.

To find out what data is held about you, or to ask for access, correction or deletion, please contact your employer. If you write to us, we will pass your request to your employer, because we cannot act on it ourselves. Some records must be kept for a period set by law (for example payroll, timesheets and employment contracts), so they cannot always be deleted on request.

This policy does not cover how your employer uses your data. Your employer should give you its own privacy notice.

As a controller we process the following data:

  • Customer users (people our customers invite to Perm): name, work email address, role, organisation, language preference, password (stored only as a salted hash), and sign-in records (time, IP address and browser). We use this data to provide the service under our contract with your organisation (art. 6(1)(b) and (f) GDPR) and to keep accounts secure (art. 6(1)(f)).
  • Customer contacts (people who order, pay for or manage the service for a customer): name, role, email, phone and invoicing details. We use them to manage the contract, invoice and communicate about the service (art. 6(1)(b) and (f)) and to keep accounting records (art. 6(1)(c)).
  • People who write to us (for example at hello@permhq.com): name, email address and whatever you include in your message. We use them to reply and, if you are interested in Perm, to follow up on your enquiry (art. 6(1)(f)).
  • Website visitors: our website does not use cookies, analytics or trackers. Our hosting provider processes technical data (IP address, browser type, page requested, time) in server logs to deliver the site and protect it against abuse (art. 6(1)(f)). [to confirm: website hosting provider and log retention]

Where we rely on legitimate interests, those interests are running and securing our service, communicating with customers and prospects, and defending legal claims. We do not sell personal data, do not use it for advertising and do not make decisions about you based solely on automated processing.

We share personal data only with service providers that help us run Perm (hosting, backup storage and email delivery), listed on our sub-processors page, with our accountants and legal advisers under confidentiality, and with public authorities when the law requires it. Your organisation's administrators can see the users of their own organisation and their activity in the activity log.

The application and its database are hosted in the EU (Amsterdam), and encrypted backups are kept with an EU storage location. Some of our providers are established in the United States, and transactional emails are sent through a provider in the United States. Where data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses. Details are on the sub-processors page.

We keep personal data only as long as we need it:

  • User accounts: while your organisation is our customer; afterwards they are deleted together with the customer's data, within 90 days after the contract ends [to confirm].
  • Sign-in records and other activity log entries: 24 months.
  • Contracts, invoices and other accounting documents: 5 years from 1 July of the year following the financial year they belong to (Law 82/1991, art. 25).
  • Correspondence with people who are not customers: up to 2 years after our last exchange. [to confirm]
  • Website server logs: [to confirm].
  • Encrypted backups: 35 days, so deleted data disappears from them within that time.

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to data portability, within the limits set by law. Where we process data based on legitimate interests, you can object at any time. To exercise these rights, write to privacy@permhq.com. We will answer within one month.

You also have the right to complain to the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro, or to the authority in your country of residence or work.

We protect personal data with technical and organisational measures that include access by role, a tamper-evident activity log, limits on failed sign-in attempts, encrypted connections and encrypted backups. The Data Processing Agreement describes them in more detail.

The website sets no cookies. The application uses only a strictly necessary session cookie and a language preference cookie. See the Cookie Policy.

We may update this policy. The date at the top shows the latest version, and we will tell customers' administrators by email about significant changes.