OQOOL Legal Hub

The legal information provided here is for Oqool clients and users who have legal questions about our products, terms, policies, and compliance.

PRIVACY NOTICE

Last updated August 01, 2025




This Privacy Notice for Zabeel UK Limited ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:


  • Visit our website at https://oqool.io or any website of ours that links to this Privacy Notice


  • Download and use our mobile application (OQOOL), or any other application of ours that links to this Privacy Notice


  • Engage with us in other related ways, including any sales, marketing, or events


Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at contact@oqool.io.



SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.


What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.


Do we process any sensitive personal information? Some of the information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.


Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources. Learn more about information collected from other sources.


How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.


In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Learn more about when and with whom we share your personal information.


How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.


What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.


How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.


Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.



TABLE OF CONTENTS

   

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?


6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

7. HOW LONG DO WE KEEP YOUR INFORMATION?

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

9. DO WE COLLECT INFORMATION FROM MINORS?

10. WHAT ARE YOUR PRIVACY RIGHTS?

11. CONTROLS FOR DO-NOT-TRACK FEATURES


12. DO WE MAKE UPDATES TO THIS NOTICE?

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?



1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.


We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.



Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

  • phone numbers


  • job titles


  • contact preferences


  • contact or authentication data


  • email addresses


  • names


  • mailing addresses


  • billing addresses


Sensitive Information. We do not process sensitive information.



Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called 'HOW DO WE HANDLE YOUR SOCIAL LOGINS?' below.



Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

  • Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.


  • Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.



All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.


We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.



Like many businesses, we also collect information through cookies and similar technologies.



The information we collect includes:


  • Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.


Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.


Information collected from other sources

In Short: We may collect limited data from public databases, marketing partners, social media platforms, and other outside sources.


In order to enhance our ability to provide relevant marketing, offers, and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, social media platforms, and from other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data (or user behaviour data), Internet Protocol (IP) addresses, social media profiles, social media URLs, and custom profiles, for purposes of targeted advertising and event promotion.


If you interact with us on a social media platform using your social media account (e.g. Facebook or X), we receive personal information about you from such platforms such as your name, email address, and gender. You may have the right to withdraw your consent to processing your personal information. Learn more about withdrawing your consent. Any personal information that we collect from your social media account depends on your social media account's privacy settings. Please note that their own use of your information is not governed by this Privacy Notice.


2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.


We process your personal information for a variety of reasons, depending on how you interact with our Services, including:


  • To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.


  • To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.


  • To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.




  • To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.



  • To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see 'WHAT ARE YOUR PRIVACY RIGHTS?' below.


  • To deliver targeted advertising to you. We may process your information to develop and display personalised content and advertising tailored to your interests, location, and more.


  • To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.



3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.



Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ('third parties') who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organisation apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.


The categories of third parties we may share personal information with are as follows:

  • Affiliate Marketing Programs


  • Data Analytics Services


  • Ad Networks


  • Social Networks


  • Sales & Marketing Tools



We also may need to share your personal information in the following situations:

  • Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.


  • When we use Google Maps Platform APIs. We may share your information with certain Google Maps Platform APIs (e.g. Google Maps API, Places API). Google Maps uses GPS, Wi-Fi, and cell towers to estimate your location. GPS is accurate to about 20 meters, while Wi-Fi and cell towers help improve accuracy when GPS signals are weak, like indoors. This data helps Google Maps provide directions, but it is not always perfectly precise. We obtain and store on your device ('cache') your location for twelve (12) months. You may revoke your consent anytime by contacting us at the contact details provided at the end of this document.


  • Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Notice. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.


  • Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.



4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.


We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.


We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.


Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.Google Analytics

We may share your information with Google Analytics to track and analyse the use of the Services. The Google Analytics Advertising Features that we may use include: Remarketing with Google Analytics. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You can opt out of Google Analytics Advertising Features through Ads Settings and Ad Settings for mobile apps. Other opt out means include http://optout.networkadvertising.org/ and http://www.networkadvertising.org/mobile-choice. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.


5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.


As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, 'AI Products'). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.


Use of AI Technologies


We provide the AI Products through third-party service providers ('AI Service Providers'), including OpenAI. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?' You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.


Our AI Products


Our AI Products are designed for the following functions:

  • AI bots


How We Process Your Data Using AI


All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process, giving you peace of mind about your data's safety.


6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.


Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.


We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.


7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.


We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than 1 year.


When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymisesuch information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.


8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.


We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.


9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.


We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at m.ansari@oqool.uk.


10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short:  You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.


Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.


However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.


Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.


Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.


If you have questions or comments about your privacy rights, you may email us at contact@oqool.io.


11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.



12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.


We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Revised' date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.


13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email at contact@oqool.io, by phone at 004402045770079, or contact us by post at:


Zabeel UK Limited

Data Protection Officer

167-169 Great Portland Street, London, W1W 5PF

United Kingdom


14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.


Platform Privacy Policy

Privacy Policy

Zabeel UK Limited (operator of the OQOOL platform)

Last updated: 19 March 2026


1.                 Who we are

This Privacy Policy explains how Zabeel UK Limited ("Zabeel", "OQOOL", "we", "us" or "our") collects, uses, shares and protects personal data, and the rights available to individuals under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Zabeel UK Limited is a company registered in England and Wales under company number 12745092, with its registered office at Great Portland Street, London W1W 5PF, England.

We operate the OQOOL platform (oqool.io), which comprises Mahara, an artificial-intelligence tool for designing cross-border upskilling programmes with built-in compliance checks, and the OQOOL HR management platform. OQOOL is a business-to-business service used by organisations ("business customers"). Through the platform, our business customers process personal data relating to their own employees and personnel.

If you have any questions about this Privacy Policy or about how we handle personal data, you can contact us at contact@oqool.io. This is our single point of contact for all privacy matters.

2.                 Our role: when we are a controller and when we are a processor

The law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes personal data on a controller's behalf and on its instructions). Our role depends on the personal data concerned.

We are the controller of personal data relating to:

visitors to our website and marketing enquirers;

the account administrators, contacts and authorised users at our business customers who register for, administer or access the platform; and

personal data we process to run our business, provide the OQOOL service to our customers, and meet our own legal obligations.

For the personal data described above, this Privacy Policy is the relevant privacy notice and we are responsible for the processing it describes.

We are a processor of the personal data that our business customers upload to, generate within, or process through the platform about their own employees and personnel ("HR data"). For that HR data, the business customer is the controller: it decides what data is processed and for what purpose. We process that data only on the documented instructions of the business customer, under a separate written data processing agreement that meets the requirements of Article 28 UK GDPR.

If you are an employee of one of our business customers and you have questions about how your employer uses your personal data on the platform, or you wish to exercise your data protection rights in relation to that data, you should contact your employer (the controller) in the first instance. Where we receive such a request, we will promptly refer it to the relevant business customer and will assist that customer in responding, as required by our data processing agreement.

3.                 The personal data we collect and its sources

3.1.             Personal data we process as controller

Information you provide to us. When you contact us, request a demonstration, register for an account, administer the platform or correspond with us, we may collect your name, job title, employer, business email address, telephone number, account login credentials, billing and contact details, and the content of your communications with us.

Information collected automatically. When you visit our website or use the platform, we may automatically collect technical and usage data, including your Internet Protocol (IP) address, device and browser type, operating system, language settings, referring pages, the pages and features you access, and the dates and times of access. We collect this data using cookies and similar technologies (see section 9).

Location data. Where a feature relies on location (for example, mapping or programme-design functionality), we may process approximate geolocation derived from your IP address or, with your permission, more precise device location. Where the platform caches device-location information to support such features, it is held only for as long as needed for that feature to work and is then deleted.

We do not generally seek to process special category personal data (such as data revealing health, racial or ethnic origin, religious beliefs or trade union membership) about our website visitors and account users. If you choose to volunteer such information to us, we will process it only where a condition under Article 9 UK GDPR and Schedule 1 to the Data Protection Act 2018 applies, for example your explicit consent.

3.2.             Personal data we process as processor on behalf of business customers

When providing the platform to a business customer, we process the employee and personnel data that the customer determines. Depending on how the customer configures and uses the platform, this may include employee identifiers and contact details, role, department and employment information, learning and upskilling records, performance and development data, and, where the customer uses relevant modules, HR and payroll-related data.

This HR data may include special category data (for example, information that could reveal health or other sensitive characteristics) where the business customer chooses to process it. We do not determine whether such data is processed; the business customer, as controller, is responsible for identifying an appropriate Article 9 UK GDPR condition and corresponding Schedule 1 Data Protection Act 2018 basis for any special category data, and for providing any privacy information required to its employees. We process all such data strictly on the customer's documented instructions under our Article 28 data processing agreement.

4.                 How we use personal data and our lawful bases

We only process personal data where we have a lawful basis to do so under Article 6 UK GDPR. The table below explains, for the data we process as controller, the purposes of processing and the lawful basis for each.

Purpose

Lawful basis

To create and administer accounts, provide the OQOOL platform and services, and provide customer support

Performance of a contract (Article 6(1)(b)), or our legitimate interests in servicing our customer relationships where you are a contact of a business customer (Article 6(1)(f))

To operate, secure, maintain and improve our website and the platform, including troubleshooting, testing and analytics

Our legitimate interests in running and improving a secure, reliable service (Article 6(1)(f))

To communicate with you about your account, service changes and administrative matters

Performance of a contract (Article 6(1)(b)) and our legitimate interests in managing our relationship with you (Article 6(1)(f))

To send marketing communications about our products and services

Your consent (Article 6(1)(a)), which you may withdraw at any time, or our legitimate interests in promoting our services to existing business contacts where permitted by law (Article 6(1)(f))

To use non-essential cookies and similar analytics technologies

Your consent (Article 6(1)(a))

To comply with our legal and regulatory obligations, including tax, accounting and corporate record-keeping

Compliance with a legal obligation (Article 6(1)(c))

To establish, exercise or defend legal claims and protect our rights

Our legitimate interests in protecting our business (Article 6(1)(f))

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and have concluded they are not. You may object to processing based on legitimate interests at any time (see section 8).

Where we rely on your consent, you may withdraw it at any time; withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

For HR data we process as a processor, the lawful basis (and, where special category data is involved, the Article 9 condition and Schedule 1 basis) is determined by the business customer as controller, not by us.

5.                 Artificial intelligence and automated processing

The OQOOL platform includes AI-assisted features, including the Mahara tool, which helps design cross-border upskilling programmes and runs built-in compliance checks. We use these technologies transparently and want to be clear about what they do.

The outputs of OQOOL and the Mahara AI are advisory only. They are designed to support and inform human decision-making by our business customers and their authorised users; they do not themselves make decisions about individuals. OQOOL does not carry out solely-automated decision-making that produces legal effects concerning an individual or that similarly significantly affects an individual within the meaning of Article 22 UK GDPR. Any decisions affecting an employee (for example, about their development, role or performance) remain the responsibility of the business customer and are taken by people, informed but not determined by the platform's outputs.

Because no solely-automated decisions producing legal or similarly significant effects are made, the specific Article 22 safeguards for such decisions (such as a right to obtain human intervention in, or to contest, an automated decision) do not arise. You retain all of your general data protection rights, as set out in section 8.

Where AI features are provided using third-party technology providers, we do so under contractual arrangements consistent with this Privacy Policy, including the processing-location and safeguards position set out in sections 6 and 7.

6.                 Who we share personal data with

We do not sell personal data. We share personal data only as described below.

Service providers and processors. We use trusted third parties to help us provide the website and platform, such as cloud hosting and infrastructure providers, website and product analytics providers, communication and customer-support tools, payment and billing providers, and AI technology providers that support certain platform features. These providers process personal data only on our instructions and under written contracts that require them to keep it secure and to use it only for the purposes we specify.

Our business customers. Where we act as a processor, we handle HR data on behalf of, and share it back to, the relevant business customer that is the controller of that data.

Professional advisers and authorities. We may share personal data with our professional advisers (such as lawyers, accountants and auditors) and with regulators, courts or law-enforcement bodies where we are legally required or permitted to do so.

Business transfers. If we are involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and data protection safeguards.

We choose our providers carefully and, consistent with section 7, process personal data in the United Kingdom. Where any provider's processing would involve personal data leaving the UK, we will put appropriate safeguards in place before that happens, as described in section 7.

7.                 Where we process personal data (international transfers)

We process personal data in the United Kingdom. We do not currently transfer personal data outside the United Kingdom.

If, in future, it becomes necessary to transfer personal data to a country outside the UK (for example, if we engage a provider that processes data overseas), we will ensure that an appropriate transfer mechanism is in place before any such transfer takes place. This will be one of the following:

a transfer to a country or international organisation covered by UK adequacy regulations made under the Data Protection Act 2018; or

appropriate safeguards under Article 46 UK GDPR, such as the Information Commissioner's Office (ICO) International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any supplementary measures required following a transfer risk assessment.

We will update this Privacy Policy to reflect any such transfers and the safeguards relied upon.

8.                 Your data protection rights

Under the UK GDPR, you have the following rights in relation to personal data for which we are the controller:

the right to be informed about how your personal data is used (which this Privacy Policy provides);

the right of access to a copy of your personal data;

the right to rectification of inaccurate or incomplete personal data;

the right to erasure of your personal data in certain circumstances;

the right to restrict processing in certain circumstances;

the right to data portability, allowing you to obtain and reuse certain data you provided to us;

the right to object to processing based on our legitimate interests, and to object to direct marketing at any time;

the right to withdraw consent at any time where we rely on consent; and

rights in relation to automated decision-making and profiling (noting, as explained in section 5, that we do not carry out solely-automated decision-making producing legal or similarly significant effects).

How to exercise your rights. To exercise any of these rights, please contact us at contact@oqool.io. We will respond to your request without undue delay and, in any event, within one month of receipt, as required by Article 12(3) UK GDPR. We may extend this period by up to two further months for complex or numerous requests, in which case we will let you know within the first month. There is normally no charge for making a request, although we may charge a reasonable fee, or decline to act, where a request is manifestly unfounded or excessive. We may ask you to verify your identity before responding.

Employee / HR data held on behalf of business customers. If your personal data is processed by us as a processor on behalf of your employer (a business customer), your employer is the controller and is responsible for responding to your rights requests. Please direct such requests to your employer. If you contact us, we will promptly refer your request to the relevant business customer and assist them in responding.

9.                 Cookies and similar technologies

We use cookies and similar technologies on our website and platform. Some are strictly necessary to provide the service you have requested (for example, to enable you to log in and to keep the service secure); these do not require your consent. Others are non-essential, such as analytics and performance cookies that help us understand how the website and platform are used.

We will only set non-essential cookies with your consent, in accordance with the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR. When you first visit our website, we present a cookie banner that lets you accept or reject non-essential cookies, and you can change your preferences at any time through our cookie settings.

Some browsers offer a "Do Not Track" (DNT) setting. There is currently no uniform industry standard for responding to DNT signals. Regardless of whether your browser sends a DNT signal, we will not set non-essential cookies unless you have given consent through our cookie-consent tool, and you can manage your choices there at any time.

10.              How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide our services, to satisfy any legal, accounting, tax or reporting requirements, and to establish, exercise or defend legal claims.

To decide how long to keep personal data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and the applicable legal and regulatory requirements. For example, where we act as controller, we retain certain records for periods set by law, such as tax and payroll records retained in line with HM Revenue & Customs requirements, statutory accounting and company records retained under the Companies Act 2006, and employment-related records retained for the periods recognised as appropriate for such records.

Where we process HR data as a processor on behalf of a business customer, we retain that data for as long as the business customer instructs and in accordance with our data processing agreement. On termination of the customer's agreement, we will delete or return that data as instructed by the customer, save where we are required by law to retain it.

When personal data is no longer needed, we securely delete or anonymise it.

11.              How we keep personal data secure

We take the security of personal data seriously and implement appropriate technical and organisational measures designed to protect it against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include access controls, encryption in transit and at rest where appropriate, network and application security controls, logging and monitoring, staff confidentiality obligations and training, and regular review of our safeguards. We also require our processors to maintain appropriate security measures.

12.              Children

OQOOL is a business-to-business service. It is not directed to, or intended for use by, children, and we do not knowingly provide our services to or collect personal data from anyone under the age of 18. If you believe that a child's personal data has been provided to us, please contact us at contact@oqool.io and we will take appropriate steps to delete it.

13.              Complaints and the supervisory authority

If you have any concerns about how we handle your personal data, we would encourage you to contact us first at contact@oqool.io so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

14.              Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory or operational reasons. When we make changes, we will revise the "Last updated" date at the top of this policy and, where the changes are significant, we will take reasonable steps to bring them to your attention. We encourage you to review this policy periodically.

15.              How to contact us

If you have any questions, requests or concerns about this Privacy Policy or our handling of personal data, please contact us at:

Zabeel UK Limited

Registered in England and Wales, company no. 12745092

Great Portland Street, London W1W 5PF, England

Email: contact@oqool.io