1. Who we are
Haystack HQ is operated by Joe Bungey trading as Haystack HQ ("Haystack", "we", "us" or "our").
For the personal information described in this Privacy Notice, Haystack generally acts as the data controller, meaning we decide why and how that information is used.
Business address: 1 Hardwick Close, Brislington, Bristol, BS4 4NL
Data protection contact: privacy@haystackhq.io
We are registered with the UK Information Commissioner’s Office ("ICO").
2. What this Privacy Notice covers
This Privacy Notice explains how we collect and use personal information relating to:
- visitors to our website;
- prospective customers and business contacts;
- customers and their authorised users;
- people who contact us for support or other enquiries; and
- individuals whose information we process for our own business administration.
Haystack also provides software that processes information on behalf of our customers.
Where a customer uses a Haystack product such as Hitch to process information relating to its candidates, clients, employees or other individuals, the customer will generally be the data controller and Haystack will act as its data processor.
That processing is governed by our Data Processing Schedule and the relevant agreement with the customer. If you have a question about information held about you by one of our customers, you should normally contact that customer directly.
3. Personal information we collect
Depending on how you interact with Haystack, we may collect:
Contact and identity information, such as your name, business email address, telephone number, job title and organisation.
Customer and account information, such as the Haystack services your organisation uses, authorised users, account configuration and support history.
Commercial information, such as enquiries, proposals, contracts, subscriptions and billing records.
Payment information. Payments may be processed by third-party payment providers such as Stripe. Haystack does not need to store complete card or bank-account credentials itself.
Communications, including emails, support requests, feedback and other correspondence with us.
Website and technical information, such as IP address, browser/device information, pages accessed, timestamps, diagnostic information and security logs where this information is generated by our website or infrastructure.
Sales and prospect information, such as information about organisations and business contacts with whom we have, or may have, a legitimate business relationship.
4. How we use personal information
We may use personal information to:
- provide and administer Haystack services;
- create and manage customer relationships and accounts;
- process subscriptions and payments;
- respond to enquiries and provide customer support;
- communicate about services a customer uses;
- develop, maintain, secure and troubleshoot our services;
- maintain appropriate business and financial records;
- manage prospective customer relationships;
- prevent fraud, misuse and security incidents;
- establish, exercise or defend legal rights;
- comply with legal, regulatory and tax obligations; and
- send relevant business-to-business communications about Haystack where permitted by law.
We do not sell personal information.
5. Our lawful bases
Under UK data protection law, we rely on different lawful bases depending on the circumstances.
These may include:
Contract — where processing is necessary to enter into or perform a contract with you.
Legitimate interests — where processing is reasonably necessary to operate, secure and develop Haystack, administer customer and prospective customer relationships, and conduct proportionate business-to-business marketing, provided those interests are not overridden by your rights.
Legal obligation — where we need to process information to comply with a legal or regulatory requirement.
Consent — where we specifically ask for consent and consent is the appropriate lawful basis. Where we rely on consent, it can be withdrawn.
7. International transfers
Some of our service providers may process personal information outside the United Kingdom.
Where UK data protection law treats this as a restricted international transfer, we will use an appropriate safeguard where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful transfer mechanism.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements.
Retention periods vary according to the type of information and our relationship with you.
Information processed by Haystack on behalf of a customer is subject to the retention arrangements applicable to that service and our Data Processing Schedule.
For example, Hitch has product-specific operational retention arrangements described in the Hitch Product Schedule.
9. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures are proportionate to the nature of the information and risks involved and may include access controls, authentication, encryption in transit, infrastructure security, logging, monitoring and secure development practices.
No internet-based system can be guaranteed to be completely secure.
10. Artificial intelligence
Haystack does not sell personal information or use customer message content to train general-purpose artificial intelligence models.
Individual Haystack products may in future include optional AI-assisted functionality. Where this materially changes how personal information is processed, we will provide appropriate information and update relevant privacy or processing documentation where required.
11. Marketing
We may contact business contacts about Haystack products and services where permitted by applicable law.
You can ask us to stop sending marketing communications at any time by using an unsubscribe mechanism where provided or by contacting us at privacy@haystackhq.io.
We may still send necessary service, security, billing or contractual communications to customers.
12. Your rights
Depending on the circumstances, UK data protection law may give you rights to:
- request access to your personal information;
- ask us to correct inaccurate information;
- ask us to erase information;
- restrict how information is processed;
- object to certain processing;
- receive certain information in a portable format; and
- withdraw consent where processing is based on consent.
These rights are not absolute and may depend on the circumstances.
To exercise a right relating to information for which Haystack is the controller, contact privacy@haystackhq.io.
If Haystack is processing information solely on behalf of one of our customers, we may direct your request to that customer because they are the controller responsible for determining how your information is used.
13. Complaints
If you have concerns about how Haystack handles personal information, please contact us first at privacy@haystackhq.io so that we can investigate.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.
14. Changes to this Privacy Notice
We may update this Privacy Notice as Haystack, our services or applicable legal requirements develop.
The current version will be published on this page with its effective date.