Privacy policy

1. Who we are

Teamli is operated by Nimble IO Ltd, a company registered in England and Wales (company number 12045561), registered office 20-22 Wenlock Road, London, England, N1 7GU. We are registered with the UK Information Commissioner's Office (ICO).

For anything in this policy, contact privacy@teamli.co.uk.

2. Our two different roles

This matters, because different rules apply to each:

• We are the controller of data about you as our customer or website visitor - your account, billing, support and marketing data. This policy explains how we handle it.
• We are the processor of the data you put into Teamli about your own employees - their records, leave, absence, policies, reviews and cases (“Employee Data”). You remain the controller of it. We only handle it on your instructions, under our Data Processing Agreement, which forms part of our terms of service and is available on request.

3. What we collect, why, and our lawful basis

• Account data (name, email, hashed password, company details) - to create and run your account. Lawful basis: performance of our contract with you.
• Billing data (billing name and address, subscription and invoice records, the last four digits and expiry of your card) - to take payment and keep accounts. Lawful basis: contract, and legal obligation for tax records. We never see or store your full card number - card details are handled directly by Stripe.
• Employee Data - processed only as your processor, on your instructions (see sections 2 and 4).
• Enquiry and marketing data (name, email and anything you tell us via our contact, demo or mailing-list forms) - to answer you and, if you have opted in, to send you Teamli news and updates. Lawful basis: legitimate interests in responding to your enquiry; consent for marketing emails.
• Usage, device and log data (IP address, browser, pages viewed, actions in the app, error logs) - to keep the service secure, diagnose faults and improve the product. Lawful basis: legitimate interests in running a secure, working service.
• Support communications, including live chat on this website - to help you and to improve our support. Lawful basis: contract and legitimate interests.

4. Health data and other special category data

An HR system holds information that UK GDPR treats as special category data. Sickness records, fit notes, return-to-work interviews, occupational health referrals and health and wellbeing flags are all data concerning health. Disciplinary and capability cases may contain it too.

You are the controller of that data, and you decide what goes into Teamli. As your processor we hold it on your instructions and apply the same protections as the rest of your account: encryption in transit and at rest, role-based access so only the people you authorise can open a record, and an audit log of who looked at what. We do not use it for any purpose of our own.

You are responsible for having a lawful basis and an Article 9 condition for processing it - usually employment law obligations under Article 9(2)(b) and Schedule 1 of the Data Protection Act 2018 - and for giving your employees the privacy information they are entitled to. If you need our processing details for your own record of processing activities or a DPIA, ask us and we will provide them.

5. What we never do

We never sell or rent your personal data. We never use your Employee Data to train AI models. We never use your Employee Data for any purpose other than delivering the service you signed up for and as permitted by our Data Processing Agreement.

6. Who we share data with

We use a small number of carefully chosen suppliers (sub-processors) to run Teamli. They may process personal data on our behalf, under contract, and only for the purpose we engage them for:

• Wasabi - encrypted file and attachment storage, including fit notes and case documents (UK region).
• Stripe - card payments and subscription billing.
• Mailgun - sending transactional email such as verification codes, approval notifications and reminders.
• Pipeline - the contact, demo and mailing-list forms on this website, which are hosted by Pipeline and collect only what you type into them.
• NimbleChat - the live chat widget on this website, for support conversations you start.
• Google Fonts - serving the typeface on our website, which means Google receives your IP address when a page loads.

A current list of sub-processors is available from privacy@teamli.co.uk. We will give customers reasonable notice before adding a sub-processor that handles Employee Data.

We may also disclose data where we are legally required to (for example a court order), or to establish, exercise or defend legal claims. If our business is sold or reorganised, data may transfer to the buyer, who must continue to protect it under this policy.

7. Where your data is stored, and international transfers

Your Employee Data and file attachments are stored in UK data centres, with files held on Wasabi's UK region.

Some of our other suppliers are based outside the UK, so limited personal data (for example billing data shared with Stripe, or email addresses shared with Mailgun) may be transferred internationally. Where that happens we rely on an appropriate safeguard under UK GDPR - normally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

8. How long we keep it

• Account and Employee Data - for the life of your subscription and 30 days after cancellation, then deleted. You can ask us to delete sooner.
• Backups - taken once every 24 hours and kept on a rolling 28-day basis, after which they are overwritten.
• Financial and tax records - six years from the end of the relevant accounting period, because UK law requires it. This applies even if you ask us to delete your account.
• Marketing contacts - until you unsubscribe, plus a suppression record so we do not email you again by mistake.

Retention within your account is yours to decide. How long you keep a leaver's record, a closed case or an old fit note is a decision for you as controller, and you can delete them at any time.

9. How we protect it

We encrypt data in transit (TLS) and at rest, hash passwords, offer two-factor authentication, restrict staff access to what is needed to do the job, log administrative actions, and keep encrypted backups taken once every 24 hours. Those backups are there so we can restore the service after a failure on our side - they are not a substitute for keeping your own records, and the limits on our responsibility for data loss are set out in our terms of service. No system is perfectly secure, but if a breach affects personal data we will notify the ICO within 72 hours where required, and tell you without undue delay so you can meet your own obligations to your employees. There is more detail on our security page.

10. Your rights

Under UK GDPR you can ask us to:

• give you a copy of your personal data, or port it to another provider;
• correct it if it is wrong, or delete it;
• restrict or object to how we use it, including profiling;
• stop sending you marketing - you can withdraw consent at any time, using the unsubscribe link in any marketing email.

Email privacy@teamli.co.uk and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are an employee whose record is held in your employer's Teamli account, your employer is the controller of it, not us. Send your subject access request or other rights request to them - we will point you to them, and we will help them answer it.

If you are unhappy with how we have handled your data you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

11. Cookies

We use essential cookies and local storage to make the site and app work, plus optional analytics you can decline. We do not use advertising cookies or track you across other websites. See our cookie policy for detail and to change your preferences.

12. Children

Teamli is a business tool. It is not intended for children and we do not knowingly collect personal data from anyone under 18 as a controller. If you employ people under 18 and hold their records in your account, you are the controller of that data and responsible for handling it lawfully.

13. Changes to this policy

We may update this policy. If a change materially affects how we use personal data we will email account holders at least 30 days before it takes effect. The date at the top always shows the current version.