Privacy Policy | Invisors

1. About Invisors

Invisors, LLC (hereinafter collectively referred to as the “Invisors,” “we,” “us” or “our”) takes data protection seriously and are committed to safeguarding all data in our possession and ensuring the privacy of our customers. We will only use information provided to us for specified and lawful purposes as provided under the UK and EU General Data Protection Regulations and will handle this information both respectfully and responsibility.

Invisors shall take reasonable steps to protect the Information from loss, misuse and unauthorized access, disclosure, alteration and destruction. Invisors has put in place appropriate physical, electronic and managerial procedures to safeguard and secure the Information from loss, misuse, unauthorized access or disclosure, alteration or destruction. Invisors holds an SOC2 Type II certification which is renewed annually. Invisors cannot guarantee the security of Information on or transmitted via the Internet.

Invisors shall only process Personal Information in a way that is compatible with and relevant for the purpose for which it was collected or authorized by the individual. To the extent necessary for those purposes, Invisors shall take reasonable steps to ensure that Personal Information is accurate, complete, current and reliable for its intended use.

This privacy notice provides details about how your personal information is collected, shared and used by us. To learn more about Invisors, visit www.invisors.com. If you have any questions about this privacy notice or the practices described herein, you may contact security@invisors.com.

2. GDPR

We have revised our Privacy Notice to comply with the UK GDPR (now referred to as ‘GDPR’) ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.

3. Information covered by this Privacy Notice

This privacy notice covers personal information, including any information we collect, use and share from you, as described further below. This privacy notice applies to all Invisors websites, our products, and services (collectively, the “Services”).

When you purchase a Service from us, your personal information will be collected, used, and shared consistent with the provisions of this privacy notice.

4. Definitions

The Privacy Notice of Invisors is based on the terms used by the UK legislator for the adoption of the General Data Protection Regulation (GDPR). We use the following terms:

Personal data - Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject - Data subject is any identified or identifiable natural person, whose personal data are processed by the controller responsible for the processing. Within this data protection policy, the terms; “you” and “data subject” are used freely and interchangeably.
Processing - Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller - Controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Processor - Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient - Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
Sub Processor - Sub Processor is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the processor, are authorized to process personal data.
Consent - Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

5. Information we collect from you

The information that is processed by Invisors falls into two distinct categories:

• Client, supplier and prospect contact information, including enquiries submitted via the www.invisors.com website. Invisors are a data controller in this situation.
• Data processed on behalf of our customers. Invisors are a data processor in this situation. We collect this data for the purposes described under “How We Use Your Information”.
• Personnel information in relation to Invisors company employees. Invisors are a data controller in this situation.

5.1 Data collected via our website

For each visitor to our web page, our web server may use a tracking code or collect information that your browser sends whenever you visit our Web page. This information is aggregated to provide us with usage statistics and reports on Website visits. Data relating to your online activity on our websites including the following:

• IP address
• browser type and version
• geographic location
• pages you view
• how you got to our Services and any links you click on to leave our Services
• your interactions with any videos we offer
• issues you encounter requiring our support or assistance
• any device or other method of communication you use to interact with the Services

We store this data we collect in a variety of places within our infrastructure, including system log files, back-end databases and analytics systems. Further information is available on our Cookie Policy.

On the “Contact Us” section of our Website, we collect Personal Information that includes name, email address, and phone number. We use this information to contact you for employment or sales opportunities. When you provide us with your contact information, you consent to allow us to contact you for those purposes. This information is not shared with other organizations. The system used to collect this contact information is hosted in the United States.

5.2 Data processed on behalf of our customers

Invisors is a specialized professional services firm focused exclusively on deployment, support, and advisory services for Customers that subscribe to the Workday application (www.workday.com). In the course of providing these services, Invisors processes data, including Personal Information and HR Information, on behalf of its customers. Our purpose in processing this covered data is solely for the purpose of loading the data into the Workday application or testing outbound data files from the Workday application on behalf of our Customers. In this context, Invisors acts as a data processor and does not control the data. Invisors processes Customer Data under the explicit direction of its Customers and has no direct control or ownership of the personal data it processes. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct his or her query to the Invisors Customer (the data controller). If the Customer requests Invisors to remove the personal data to comply with data protection regulations, Invisors will respond to their request within 30 business days.

The types of personal data processed includes:

• Contact Information (name, email address, phone number, usernames, password)
• Location Data (postal address)
• Preference Data (profile/account settings such as language preference)
• Employment Data (title, past/present employers, resume/CV, educational history, professional training, performance or talent data, etc.)
• Special Categories of Data (information revealing racial or ethnic origin, trade union membership, sexual orientation)
• Other (payroll data, benefits data, system access data, compensation data, organizational/supervisory data, tax information, direct deposit data, worker documents)

6. Employee Data

Invisors needs to keep and process information about our employees for normal employment purposes. We act as a Data Controller in this capacity. The information that we hold and process will be used for our management and administrative use only. We will keep and use it to enable us to run the business and manage our relationship with employees effectively, lawfully and appropriately, during the recruitment process, whilst employed by Invisors and at the time employment ends. This includes information to enable us to comply with the employment contract, any legal requirements, and for Invisors to protect our legal position in the event of any legal proceedings. If employees do not provide this data, we may in some circumstances be unable to comply with our obligations and we will inform you of the implications of that decision.

The sort of information we hold includes:

Application form and references
Right to Work evidence such as a copy of a passport and / or birth certificate
Contract of employment and any amendments to it
Correspondence about the employee
Salary information, bank details, contact and emergency contact details, records of holiday, sickness and other absences
Information required for equality monitoring policy, training records, appraisals and where appropriate disciplinary, grievances and any other formal action.

7. How we use your information

We use the information we collect, both on its own and combined with any other information we collect about you, for the following purposes:

To provide the requested Services to you in line with the contract we have with the Data Controller;
To provide you with useful content;
To ensure the proper functioning of our Services
To offer and improve our Services;
To provide you with requested information or technical support
To facilitate your movement through our websites or your use of our Services;
To diagnose problems with our Services;
In connection with our security and compliance programs;
To administer our websites;
To communicate with you;
To target prospective customers with our products or services (such targeting is only performed with your permission where your consent is required by applicable law);
To assist us in offering you a personalized experience or otherwise tailor our Services to you; and
As otherwise described in this privacy notice.

We also use the information we receive in aggregated and anonymized formats to produce reports on trends and statistics, such as mobile search trends, email open rates by industry, campaign best practices or the number of users that have been exposed to, or clicked on, our websites or evaluated or purchased our products and services.

8. Sharing of information

Invisors does not transfer any Personal Data we collect directly to third parties or other partners. This data is used for communication with our contacts and kept internally within Invisors.

Upon explicit direction from our Customers, we will transfer Customer Personal Data to service providers that support the Customer. These service providers may include cloud service providers, such as Workday, or other service providers such as benefits administration partners. All of these transfers are processed within the scope of our Workday deployment services for our Customers.

In the context of an onward transfer Invisors has responsibility for the processing of personal information it receives under the GDPR and subsequently transfers to a third party acting as an agent on its behalf. Invisors shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Invisors LLC is under the requirement to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Invisors LLC will notify Customer of such request unless prohibited by law.

9. Tracking technologies and online advertising

We use cookies, web beacons, pixels, tags, scripts and other similar technologies in the course of our business. Information about the technologies we use, why we use them (for example, in connection with online advertising), and how you can control them can be found in our Cookie Policy.

10. Choice/opt-out

10.1 Email

You always have the opportunity to opt out of our marketing communications with you or change your preferences by following a link in the footer of all non-transactional email messages from us or by emailing us at security@invisors.com.

10.2 Phone
We may contact you by telephone, with your consent where applicable, for marketing purposes. In the UK, we will check the Telephone Preference Service (TPS), Corporate Telephone Preference Service (CTPS) and our internal CRM system before making calls. If your number appears as blocked on either list, we will not call you. If you do not want to receive marketing calls, please contact customer support and we will update our records.

10.3 Cookies
Our websites use cookies – small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences, store information for things like shopping baskets, and provide anonymized tracking data to third party applications like Google Analytics. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site and on others. The most effective way to do this is to disable cookies in your browser. We suggest consulting the Help section of your browser or taking a look at the www.internetcookies.com website which offers guidance for all modern browsers. Further details are also available in our Cookie Policy.

11. Retention of personal information

We retain your personal information to provide services to you and as otherwise necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We will retain your personal information for no more than seven years following the later of (i) the date on which you terminate your use of the Services or (ii) May 25, 2018, unless we are otherwise required by law or regulation to retain your personal information for longer.

Following this period, information related to referral source, service requested, assessment findings and geographical location will be pseudonymized (i.e. amended to be unidentifiable) for statistical purposes. On occasion reports may be completely anonymized for training purposes. All other data will be securely destroyed in accordance with GDPR requirements.

12. Legal basis for processing your information

Depending on what information we collect from you and how we collect it, we rely on various grounds for doing processing your information under the GDPR, including the following reasons:

Under the instruction of a controller in line with a contract with them
Comply with a legal obligation
Protect the employees or another individuals' vital interests
Carry out a task in the public interest, or in exercising official authority vested in the employer
To respond to a question or job application that has been sent to us through the website
To respond to service tickets which have been submitted or provide updates on the services being supplied
To communicate services which we think will be of interest

13. Your rights

Under the General Data Protection Regulation (GDPR) you have a number of rights with regards to your personal data. You have the right to request from Invisors access to and rectification of the data as well as for it to be erased and to restrict processing of the data in certain circumstances.

If your have provided consent for the processing of your data you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before consent has been withdrawn.

You also have the right to lodge a complaint with your local supervisory authority if you feel that Invisors has not complied with GDPR requirements regarding your personal data.

We set out below an outline of those rights and how to exercise those rights. Please note that we will require you to verify your identity before responding to any requests to exercise your rights by providing details only known to the account holder. To exercise any of your rights, please email security@invisors.com. Please note that for each of the rights below we may have valid legal reasons to refuse your request, in such instances we will let you know if that is the case.

13.1 Informed
You have the right to be informed about the collection and use of your personal information.

13.2 Access
You have the right to know whether we process personal information about you, and if we do, to access data we hold about you and certain information about how we use it and who we share it with.

13.3 Portability

You have the right to receive a subset of the personal information you provide us if we process it on the legal bases of our contract with you or with your consent in a structured, commonly used and machine-readable format and a right to request that we transfer such personal information to another party. If you wish for us to transfer the personal information to another party, please ensure you detail that party and note that we can only do so where it is technically feasible. We are not responsible for the security of the personal information or its processing once received by the third party.

13.4 Rectification

You have the right to require us to correct any personal information held about you that is inaccurate and have incomplete data completed. Where you request correction, please explain in detail why you believe the personal information we hold about you to be inaccurate or incomplete so that we can assess whether a correction is required. Please note that while we assess whether the personal information we hold about you is inaccurate or incomplete, you may exercise your right to restrict our processing of the applicable data as described below.

13.5 Erasure
You may request that we erase the personal information we hold about you in the following circumstances:

• where you believe it is no longer necessary for us to hold the personal information;
• we are processing it on the basis of your consent, and you wish to withdraw your consent;
• we are processing your data on the basis of our legitimate interest and you object to such processing;
• you no longer wish us to use your data to send you marketing; or
• you believe we are unlawfully processing your data.

Please provide as much detail as possible on your reasons for the request to assist us in determining whether you have a valid basis for erasure.

13.6 Restriction of processing to storage only
You have a right to require us to stop processing the personal information we hold about you other than for storage purposes in the following circumstances:

• You believe the personal information is not accurate for the period it takes for us to verify whether the data is accurate;
• We wish to erase the personal information as the processing we are doing is unlawful, but you want us to simply restrict the use of that data;
• We no longer need the personal information for the purposes of the processing, but you require us to retain the data for the establishment, exercise, or defense of legal claims; or
• You have objected to us processing personal information we hold about you on the basis of our legitimate interest and you wish us to stop processing the personal information while we determine whether there is an overriding interest in us retaining such personal information.

13.7 Objection

You have the right to object to our processing of data about you and we will consider your request. Please provide us with detail as to your reasoning so that we can assess whether there is a compelling overriding interest in us continuing to process such data or we need to process it in relation to legal claims.

You also have the right, at any time, to object to our processing of data about you in order to send you marketing, including where we build profiles for such purposes and we will stop processing the data for that purpose.
Where you have provided your consent to us processing your personal data, you can withdraw your consent at any time by emailing security@invisors.com.

Where you have provided your consent to us processing your personal data, you can withdraw your consent at any time by emailing security@invisors.com.

13.8 Not to be subject to automated processing
You have the right not to be subject to decisions based solely on automated processing, including profiling.

14. Children

Our website and services are not directed to persons under 18. We do not knowingly collect personal information from children under 18. If a parent or guardian becomes aware that his or her child has provided us with personal information without such parent or guardian’s consent, he or she should contact us. If we become aware that a child under 18 has provided us with personal information, we will delete such information from our files.

15. Contact

Individuals with inquiries or complaints regarding our Privacy Notice should first contact Invisors LLC at:

Invisors, LLC
Attention: Will Hardy
1201 Peachtree Street NE, Suite 1500, Atlanta, GA 30361
Phone: 404.384.7947
Email: security@invisors.com

16. Compliance with Data Privacy Frameworks

Invisors complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Invisors has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Invisors has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/

17. Complaints

Per our agreement with the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework, Invisors LLC is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Additionally, under certain conditions, individuals may be able to invoke binding arbitration as well.

Invisors LLC has committed to cooperate with EU data protection authorities (DPAs), concerning both human resources data and non-human resources data transferred from the EU. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the EU DPAs for more information or to file a complaint. The services of EU DPAs are provided at no cost to you.

Invisors LLC has further committed to cooperate with the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved Swiss Data Privacy complaints, including concerning both human resources data and non-human resources data transferred from Switzerland. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact the FDPIC for more information or to file a complaint
https://www.edoeb.admin.ch/edoeb/en/home/meldeportale.html

Invisors LLC has further committed to comply with the UK Extension to the EU-U.S. Data Privacy Framework with regards to both human resources data and non-human resources data received from the UK and has committed to cooperate and comply with the UK Information Commissioner’s Office (ICO) with regard to personal data received from the UK.

18. Notification of changes

We reserve the right to modify this privacy notice at any time, so please review it frequently. If we decide to change this privacy notice in any material way, we will notify you here. Your continued use of any Services constitutes acceptance to any such changes.

Last modified November, 2023