Privacy Policy

1. Introduction

Peepel respects your privacy and is committed to protecting personal data. This Privacy Policy explains how personal data is processed when you use the Peepel platform via our website.

Peepel provides HR and payroll-related software to organizations. In most cases, personal data processed within the platform relates to an employment or contractual relationship between you and your employer.

2. Roles and Responsibilities

For personal data processed within the Peepel platform:

• Your employer acts as the data controller, determining which personal data is processed and for what purpose
• Peepel acts as a data processor, processing personal data on behalf of the employer and according to their instructions

For limited data collected through our website (for example contact or usage data), Peepel acts as data controller.

3. Personal Data We Process

Depending on how the platform is used, the following categories of personal data may be processed:

• Identification and contact data such as name, email address, address, phone number, nationality, and date of birth
• Employment-related data such as contracts, payslips, leave and absence information
• Emergency contact and dependent information, where provided
• User account and access information
• Technical and usage data such as log files, IP address, browser type, and device information
• Cookies and similar technologies used on the website

Peepel does not determine which employment-related data is entered into the platform.

4. Purposes of Processing

Personal data is processed for the following purposes:

• Providing and operating the Peepel platform
• Enabling HR and payroll-related workflows as configured by the employer
• Managing user access and platform security
• Maintaining, improving, and supporting the platform
• Complying with legal and regulatory obligations

Marketing communications are limited and only sent where legally permitted.

5. Legal Basis

Personal data is processed based on one or more of the following legal grounds, as applicable:

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests related to providing and securing the platform
• Consent, where required

The applicable legal basis for employment-related processing is determined by the employer.

6. Data Sharing

Peepel does not sell personal data.

Personal data may be shared with:

• The employer and authorized users within the organization
• Trusted third-party service providers who support the operation of the platform, under appropriate contractual safeguards
• Authorities, where required by law

All third parties are subject to confidentiality and data protection obligations.

7. Data Security

Peepel implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or disclosure.

8. Data Retention

Personal data is retained only for as long as necessary to provide the platform or as required by law. Retention periods for employment-related data are determined by the employer.

9. Your Rights

Under applicable data protection laws, including the General Data Protection Regulation (GDPR), you may have the right to:

• Access your personal data
• Request correction or deletion
• Restrict or object to certain processing
• Request data portability

Requests relating to employment-related data should generally be directed to your employer. Peepel will support the employer where required.

10. Cookies and analytics

Our website uses only essential cookies to function correctly. To understand how Peepel is used and improve the product, we run product analytics (PostHog) by default in a fully anonymous, cookieless mode - no cookies are set, no persistent identifier is stored on your device, and session recordings are disabled. This is permitted under ePrivacy because nothing is stored on or read from your device.

On your first visit we still show a cookie banner with two clear choices: 'Accept all' (essential + full analytics with cookies and session recordings) or 'Essential only' (analytics stays in anonymous, cookieless mode). For Google Analytics we use Google Consent Mode v2, so all storage categories default to 'denied' until you accept.

Concretely, the following scripts run on the site:

• PostHog (product analytics) - hosted in the EU (eu.i.posthog.com), operated by PostHog Inc. Default mode (no consent or 'Essential only'): anonymous and cookieless - no cookies, in-memory only, no session recordings. After 'Accept all': cookies and a persistent distinct ID are set, and session recordings (with all input fields masked) are enabled. Purpose: measure pageviews, clicks and usage flows to improve the platform. Retention: up to 12 months. Processor location: EU.
• Google Analytics 4 (website statistics) - measurement ID G-SEWCLPX8NQ, operated by Google Ireland Limited. Active only after 'Accept all'. Purpose: aggregated visitor statistics. IP addresses are anonymised. Retention: 14 months.
• Cookie 'peepel-cookie-consent' (essential) - stores your cookie choice in localStorage so we don't ask again on every visit. No personal information.

You can withdraw or change your consent at any time. Click the 'Manage cookie preferences' button at the bottom of this section, or clear the 'peepel-cookie-consent' cookie in your browser. On withdrawal we immediately drop PostHog back to anonymous, cookieless mode and set Google Consent Mode back to 'denied'. We also honour your browser's Do-Not-Track setting.

11. Changes to this Privacy Policy

Peepel may update this Privacy Policy from time to time. The most recent version will always be available on our website.

12. Contact

If you have questions about this Privacy Policy or the processing of personal data, you can contact us at:

support@peepel.io