BizPilot UK Privacy Policy

1. About BizPilot

This Privacy Policy explains how NEXA DIGITAL PTY LTD trading as BizPilot, ABN 39 676 911 309, an Australian company ("BizPilot", "we", "us" or "our"), processes personal data in circumstances where United Kingdom data-protection law applies. Our address is 1/22 O'Connell Street, North Adelaide SA 5006, Australia. Our privacy contact is complaints@bizpilot.com.au.

BizPilot provides a cloud-based business operating platform including recruitment, HR, onboarding, training, rostering, time and attendance, payroll, compliance, reservations, events, Gift Cards, finance, marketing, analytics, integrations and AI functionality.

2. Applicable data-protection law

Where applicable, BizPilot processes personal data in accordance with UK data-protection legislation, including the UK GDPR and Data Protection Act 2018, in each case as applicable and amended from time to time.

3. Controller and processor roles

BizPilot's role depends upon the relevant processing activity.

Where BizPilot determines the purposes and means of processing relating to its own accounts; subscriptions; billing; security; fraud prevention; support; service analytics; marketing; legal compliance; and business administration, BizPilot may act as a controller.

Where a Customer uses BizPilot to process personal data relating to employees, contractors, applicants, customers, guests or other individuals for purposes determined by the Customer, the Customer will generally act as controller and BizPilot as processor. Where BizPilot acts as processor, processing will be governed by the applicable Data Processing Addendum or other legally appropriate contractual arrangement.

4. Categories of personal data

Depending upon Platform functionality, BizPilot may process: identity data; contact data; employment data; recruitment data; payroll data; tax information; National Insurance information; pension information; attendance data; location verification data; HR records; training records; compliance information; reservation data; event information; Gift Card information; customer data; financial data; technical data; security information; communications; and special-category data where lawfully processed.

5. Lawful bases

Where BizPilot acts as controller, our lawful basis will depend upon the processing. It may include:

Other lawful bases may apply where permitted.

6. Special-category data

Where special-category data is processed, an appropriate Article 6 lawful basis and applicable additional condition must exist. Customers remain responsible for ensuring their use of such information is lawful.

7. Purposes

Personal data may be processed to: provide BizPilot; create and manage accounts; authenticate users; administer subscriptions; provide recruitment; provide HR; operate onboarding; provide training; manage rosters; provide attendance functionality; operate payroll; provide compliance functionality; manage reservations; manage events; operate Gift Cards; process payments; provide finance functionality; provide analytics; provide AI functionality; maintain security; prevent fraud; provide support; comply with law; enforce contractual rights; and improve BizPilot.

8. Artificial Intelligence

BizPilot may provide AI-powered functionality through BizPilot Co-Pilot and related features. AI may generate recommendations, summaries, forecasts, candidate insights, rankings, compliance alerts, payroll insights, financial insights and operational suggestions. AI outputs may be inaccurate or incomplete. Customers should maintain appropriate human oversight, particularly where outputs concern employment, recruitment, payroll, financial or legal matters.

9. Automated decision-making

BizPilot should not ordinarily be configured to make significant employment decisions solely through automated AI processing without appropriate safeguards. Where solely automated decision-making produces legal or similarly significant effects and applicable law provides protections, those protections must be observed.

10. AI training

Customer Content does not become BizPilot property. Customer personal data will not be used to train unrelated general-purpose AI models unless transparently disclosed and supported by an appropriate lawful and contractual basis.

11. Service providers and subprocessors

BizPilot may use service providers for hosting; databases; security; authentication; communications; payments; AI; analytics; financial integrations; payroll integrations; monitoring; and support. Where BizPilot acts as processor, subprocessors are managed under the applicable DPA. Our current material providers are listed in our Subprocessor List.

12. International transfers

BizPilot is operated by an Australian company and may use international service providers. Where UK personal data is transferred internationally and a safeguard is required, BizPilot will use an appropriate lawful transfer mechanism. This may include applicable adequacy regulations, approved contractual safeguards, the UK International Data Transfer Agreement, an applicable UK Addendum or another legally permitted mechanism.

13. Security

BizPilot uses technical and organisational measures appropriate to the nature and risk of processing. These may include where implemented: encryption; authentication; MFA; role-based permissions; least privilege; audit logs; monitoring; backups; vulnerability management; secure development; and incident response. See our Security & Trust Centre. No online system can guarantee absolute security.

14. Personal data breaches

Where BizPilot acts as processor, BizPilot will notify the relevant controller in accordance with applicable legal and contractual obligations. Where BizPilot acts as controller, BizPilot will assess notification requirements to affected individuals and the ICO.

15. Retention

Personal data will be retained for no longer than reasonably necessary for relevant purposes, subject to legal, security, employment, payroll, contractual and record-keeping requirements.

16. Individual rights

Subject to applicable conditions and exemptions, individuals may have rights relating to: access; rectification; erasure; restriction; objection; portability; withdrawal of consent; and certain automated decision-making.

17. Exercising rights

Contact: Privacy & Complaints Officer, NEXA DIGITAL PTY LTD trading as BizPilot, 1/22 O'Connell Street, North Adelaide SA 5006, Australia. Email: complaints@bizpilot.com.au

Where BizPilot acts solely as processor, the request may be referred to the relevant Customer/controller. Identity verification may be required where appropriate.

18. Marketing

Electronic marketing will be conducted in accordance with applicable UK requirements. Marketing preferences remain separate from employment, recruitment, booking, Gift Card and contractual transactions.

19. Cookies

Where applicable law requires consent for non-essential cookies or similar technologies, they are not activated until the appropriate consent has been obtained. Users are offered Accept All, Reject Non-Essential and Manage Preferences, and can change preferences later. See our Cookie Policy.

20. Complaints

Privacy complaints can be submitted to complaints@bizpilot.com.au. Individuals may also have the right to complain to the Information Commissioner's Office (ICO).

21. Changes

This Privacy Policy may be updated from time to time. The current version and effective date will be published through the BizPilot Legal Centre.

NEXA DIGITAL PTY LTD trading as BizPilot · ABN 39 676 911 309

1/22 O'Connell Street, North Adelaide SA 5006, Australia

Privacy, complaints and legal enquiries: complaints@bizpilot.com.au