Privacy Policy

2. Which parts of this policy apply to you?

Different sections of this policy may apply depending on your relationship with Avellio.

Recruitment

This section applies if you are a job candidate, temporary worker, contractor, referee, recruitment client, hiring manager or another person involved in our recruitment services. See section 4.

Software and applications

This section applies if you enquire about, purchase, administer or use software developed or operated by Avellio. See section 5.

Avellio Connect

The Avellio Connect section applies if you use the platform or communicate with a business that manages its messages through Avellio Connect. See section 6.

Website and general enquiries

The general sections apply when you visit our website, contact Avellio, subscribe to communications or otherwise deal with Avellio Ltd. See section 7.

3. Our role under data-protection law

Avellio’s role depends on the service and the reason personal information is being processed.

When Avellio is the controller

Avellio is the data controller when we determine why and how personal information is processed.

This generally includes personal information relating to:

• Recruitment candidates and temporary workers.
• Recruitment clients and hiring managers.
• Avellio’s own employees, contractors and suppliers.
• Businesses purchasing or enquiring about Avellio software.
• Account owners, administrators and authorised application users.
• Billing, customer support and service communications.
• Visitors to the Avellio website.
• Security, fraud prevention and legal compliance.

When Avellio is the processor

Avellio may act as a data processor when a business customer uses one of our applications to process information about its own customers, employees, applicants or other contacts.

In these circumstances, the business customer determines why the information is processed. Avellio processes it on the customer’s documented instructions to provide and secure the relevant application.

For example, when Alderwood Estate Agents uses Avellio Connect to manage customer conversations, Alderwood remains the controller of its customers’, vendors’, purchasers’, landlords’, tenants’ and applicants’ information. Avellio processes that information on Alderwood’s behalf.

4. Recruitment information

Information we may collect

When providing recruitment services, we may collect:

• Names, addresses, email addresses and telephone numbers.
• CVs, employment history and education information.
• Qualifications, skills and professional memberships.
• Salary, remuneration, availability and location preferences.
• Job applications, interview notes and assessment information.
• References and referee contact details.
• Right-to-work and identity-verification information.
• Information about placements, assignments and employment.
• Communications between candidates, clients and Avellio.
• Bank, payroll and tax information where relevant to temporary work or payment.
• Health or adjustment information where necessary to support a candidate or worker.
• Diversity and equal-opportunity information where lawfully collected.
• Criminal-conviction information where a lawful role-specific check is required.

Please avoid providing sensitive information unless it is relevant and necessary.

Where recruitment information comes from

We may receive recruitment information:

• Directly from candidates, workers and clients.
• From CVs and job applications.
• From recruitment websites and job boards.
• From professional networking services.
• From referees.
• From hiring organisations.
• From identity, right-to-work and background-check providers.
• From publicly available professional sources.
• From another recruitment business where a lawful introduction has been made.

How we use recruitment information

We may use recruitment information to:

• Register and communicate with candidates and workers.
• Assess skills, experience and suitability.
• Identify and discuss potential opportunities.
• Introduce candidates to prospective employers or clients.
• Arrange interviews, placements and assignments.
• Verify identity, qualifications, references and right-to-work status.
• Administer temporary work, timesheets, payroll and payments where applicable.
• Manage relationships with recruitment clients.
• Maintain records of applications, placements and communications.
• Meet employment, tax, immigration and regulatory obligations.
• Prevent fraud and protect candidates, clients and Avellio.
• Establish, exercise or defend legal claims.

We will not send a candidate’s information to a prospective employer or recruitment client without an appropriate basis for doing so.

5. Software and application information

When a business or authorised user enquires about, purchases or uses Avellio software, we may collect:

• Business names, addresses and contact details.
• Names and work details of account owners and users.
• User roles, permissions and team assignments.
• Login, authentication and account-security information.
• Subscription, invoice and payment-status information.
• Application settings and connected integrations.
• Platform activity and feature usage.
• Audit, diagnostic, security and error logs.
• Support requests, feedback and communications.

We use this information to:

• Provide demonstrations and respond to enquiries.
• Create and administer customer accounts.
• Provide and maintain our software.
• Authenticate users and manage permissions.
• Process subscriptions and maintain accounting records.
• Provide customer support.
• Monitor performance and diagnose faults.
• Protect our applications against unauthorised access, fraud and misuse.
• Develop and improve our products.
• Send operational, security and service information.
• Meet legal and contractual obligations.

The information processed by each Avellio application depends on what that application does. Where a future application carries out materially different processing, we will supply additional product-specific information alongside this policy.

6. Avellio Connect and WhatsApp

Avellio Connect is a shared business messaging platform developed and operated by Avellio Ltd.

It allows authorised teams to manage customer conversations, including conversations conducted through the WhatsApp Business Platform.

Information processed through Avellio Connect

Depending on how a customer configures and uses the service, Avellio Connect may process:

• Names and telephone numbers.
• WhatsApp profile information.
• Message contents and conversation history.
• Photographs, videos, voice notes, documents and other attachments.
• Message dates and times.
• Delivery, read and response statuses.
• Conversation assignments.
• Internal notes and labels.
• Message templates and automated responses.
• Communication preferences.
• Information imported through a customer-enabled migration or integration.
• User activity, security and audit logs.

Message contents and attachments may occasionally contain identity, financial, health or other sensitive information. Avellio does not require people to provide sensitive information unless it is necessary for their dealings with the relevant business.

Where this information belongs to an Avellio customer, Avellio processes it on that customer’s instructions.

How Avellio Connect information is used

When acting as a processor, Avellio may process information to:

• Receive, display, organise and send messages on a customer’s behalf.
• Allow authorised users to manage a shared inbox.
• Store contacts, conversation history and attachments.
• Assign conversations to team members.
• Record internal notes, labels and activity.
• Operate customer-configured templates and workflows.
• Connect the platform to WhatsApp and other selected services.
• Provide platform security, maintenance, backups and support.
• Export, return or delete information in accordance with customer instructions.

Avellio does not sell customer message content or customer-contact information.

Avellio does not use customer-controlled message content for unrelated advertising.

WhatsApp and Meta

Avellio Connect integrates with the WhatsApp Business Platform provided by Meta and WhatsApp companies.

When a business connects its WhatsApp Business Account to Avellio Connect, information may pass between Avellio, that business and the relevant Meta or WhatsApp company. This may include telephone numbers, profile information, messages, attachments, templates, integration identifiers and delivery information.

Businesses using Avellio Connect are responsible for ensuring that they have an appropriate lawful basis for communicating with people through WhatsApp.

They are also responsible for complying with applicable privacy, direct-marketing and consumer-protection laws and with WhatsApp’s requirements concerning consent, marketing messages and approved templates.

Use of WhatsApp is subject to WhatsApp’s Privacy Policy (opens in a new tab) and applicable business terms.

Avellio is an independent software provider. Avellio and Avellio Connect are not owned, sponsored or endorsed by WhatsApp or Meta.

7. Website and technical information

When someone visits our website or uses an Avellio application, we may collect:

• IP address.
• Browser type.
• Device and operating-system information.
• Login dates and times.
• Website pages and application features used.
• Cookie identifiers.
• Security, audit, diagnostic and error information.
• Information supplied through forms, email or customer support.

We use this information to operate our website and applications, respond to enquiries, understand service performance, maintain security and improve our services.

Essential cookies may be used where necessary for security, login and core functionality. Analytics and marketing cookies will only be used where permitted and, where required, after consent has been obtained.

8. Lawful bases

Where Avellio acts as controller, we rely on one or more of the following lawful bases:

Contract

Where processing is necessary to provide recruitment or software services, administer an account, manage a placement or take requested steps before entering into a contract.

Legal obligation

Where processing is necessary to meet employment, immigration, tax, accounting, regulatory or other legal duties.

Legitimate interests

Where processing is necessary for legitimate interests such as:

• Providing recruitment services.
• Identifying and discussing suitable work opportunities.
• Managing relationships with candidates, workers, clients and software customers.
• Operating and improving our business and applications.
• Providing customer support.
• Protecting our systems and users.
• Preventing fraud and misuse.
• Maintaining accurate business records.
• Establishing, exercising or defending legal claims.

We balance these interests against the rights and interests of affected individuals.

Consent

Where consent is required, including for certain marketing, optional cookies or particular uses of sensitive information. Consent may be withdrawn at any time.

Special-category and criminal-conviction information

Where we process health, diversity or other special-category information, or permitted criminal-conviction information, we will only do so where an additional lawful condition applies.

This may include employment-law obligations, substantial public interest, legal claims or explicit consent, depending on the circumstances.

Where Avellio acts as processor, the relevant customer is responsible for determining the appropriate lawful basis.

9. Who we share information with

Where necessary, we may share or make personal information available to:

• Prospective employers and recruitment clients.
• Candidates and temporary workers where necessary for recruitment services.
• Referees.
• Job boards and recruitment platforms.
• Right-to-work, identity, reference and background-check providers.
• Payroll, pension, accounting and payment providers where applicable.
• Meta and WhatsApp companies.
• Cloud hosting, database, storage and content-delivery providers.
• Authentication and cybersecurity providers.
• Email, support, monitoring and error-reporting providers.
• Services and integrations selected by customers.
• Professional advisers, insurers and auditors.
• Regulators, courts, law-enforcement agencies, HMRC and government bodies where required.
• A purchaser, investor or successor involved in a business sale or restructuring.

Where another organisation processes information on our behalf, we require appropriate contractual and security protections.

A current list of material software subprocessors can be requested by emailing privacy@avellio.com.

Avellio does not sell personal information.

10. International transfers

Some organisations involved in providing our services, including Meta group companies, job boards and cloud infrastructure providers, may process information outside the United Kingdom.

Where a restricted international transfer takes place, we use an applicable UK adequacy regulation or appropriate safeguards. These may include:

• The UK International Data Transfer Agreement.
• The UK Addendum to approved standard contractual clauses.
• Another transfer mechanism permitted by UK data-protection law.

Information about the safeguards used for a particular transfer can be requested by emailing privacy@avellio.com.

11. How long we keep information

We retain personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory and contractual requirements.

Unless a different period applies:

• Recruitment candidate records are normally retained for up to 24 months following the last meaningful contact, unless the person agrees to remain in our recruitment network for longer or retention is otherwise justified.
• Records relating to successful placements, temporary work, client contracts, payroll, invoices and accounting are generally retained for six years or for another period required by law.
• Customer-controlled messages, contacts and attachments in an Avellio application are retained while the customer’s account is active and in accordance with the customer’s settings and instructions.
• Following termination of a software account, customer-controlled information will ordinarily be deleted from active systems within 30 days.
• Residual copies may remain in protected backups for up to 90 days before being overwritten or securely deleted.
• Software user-account information is normally retained while the account is active and for 30 days after closure.
• Support communications are generally retained for 24 months after the request is closed.
• Security and audit logs are generally retained for 12 months.
• Marketing information is retained until the recipient opts out or it is no longer accurate or necessary.
• A minimal suppression record may be retained to ensure that an opt-out continues to be respected.

Information may be retained for longer where required by law, to prevent fraud, resolve a dispute or establish, exercise or defend legal claims.

12. Data deletion and account closure

Recruitment candidates, workers and Avellio’s direct customers can request the export or deletion of their information by emailing privacy@avellio.com. Software customers may also use any account controls available in the relevant application.

When a software customer closes its account, we will delete or return customer-controlled personal information in accordance with our agreement, subject to limited retention in protected backups, information that must be retained by law and information required to establish, exercise or defend legal claims.

If you have communicated with a business that uses an Avellio application, you should normally direct a request concerning that conversation to the business itself. The business is generally the controller responsible for responding to you. Avellio will assist the business in responding where required.

Full instructions are available on our Data Deletion page.

13. Cookies

Our website and applications may use:

• Essential cookies required for login, security and core functionality.
• Preference cookies that remember user settings.
• Analytics cookies that help us understand how our website and services are used.
• Marketing cookies where these are used and the visitor has provided any consent required by law.

Essential cookies may be used without consent where they are strictly necessary.

Non-essential cookies will only be placed where permitted and, where required, after consent has been obtained.

Visitors can change their choices using our cookie settings. Further information is provided through Avellio’s cookie notice.

14. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure or access.

These measures include, where appropriate:

• Encryption during transmission and at rest.
• Individual user accounts.
• Role-based access permissions.
• Multi-factor authentication.
• Access logging and audit trails.
• Secure development and deployment procedures.
• Monitoring, backup and recovery processes.
• Restricted staff access to recruitment and customer records.
• Staff and contractor confidentiality obligations.
• Supplier and subprocessor assessments.

No online service can guarantee absolute security.

Software customers are responsible for protecting their login details, assigning appropriate permissions and promptly removing users who should no longer have access.

15. Automated features

Avellio applications may provide customer-configured automation, suggested responses, conversation classification or routing features. Our recruitment services may use software to search, match and organise candidate and vacancy information.

Unless expressly stated otherwise, these features are intended to assist authorised users and Avellio staff. They are not designed to make decisions about individuals that produce legal or similarly significant effects without human involvement.

Customers are responsible for reviewing automated outputs and using these features lawfully and appropriately.

16. Your rights

Depending on the circumstances and the applicable lawful basis, individuals may have the right to:

• Obtain confirmation that their personal information is being processed.
• Request access to their personal information.
• Ask for inaccurate or incomplete information to be corrected.
• Request deletion in certain circumstances.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw consent where processing is based on consent.
• Receive eligible information in a portable format.
• Raise concerns about solely automated decisions where applicable.

These rights are not absolute and may depend on the circumstances of the processing.

You have the right to object at any time to the processing of your personal information for direct marketing.

Who to contact

Recruitment candidates, workers, recruitment clients and Avellio’s direct software customers may contact Avellio directly at privacy@avellio.com.

If you are requesting deletion of a conversation or other information controlled by an Avellio software customer, you should normally contact that business first. Where Avellio acts as processor, we will assist our customer in handling the request.

We may need to request information to confirm someone’s identity before acting on a request. We will only request information reasonably necessary for verification.

17. Complaints

If you have concerns about our use of personal information, please contact privacy@avellio.com so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office.

Website: https://ico.org.uk/ (opens in a new tab)

Telephone: 0303 123 1113

18. Children

Avellio’s recruitment services and software applications are business services and are not intended for children. Application accounts may only be created by authorised business users aged 18 or over.

Our software customers are responsible for ensuring that any use of an Avellio application involving information about children is lawful and appropriately protected.

19. Changes to this policy

We may update this policy to reflect changes to our services, applications, legal obligations or processing activities.

The latest version will always be published on this page with the date it was last updated.

Where a change materially affects how existing candidate or customer information is processed, we will provide appropriate notice.

20. Contact us