Privacy Policy
Version 5:
This page informs you of our policies regarding the collection, use and disclosure of your Personal Information when you use our Service.
Peaky ApS ("us", "we", or "our") operates the https://www.peaky.io website and our applications listed on our website (the "Service"). We will not use or share your information with anyone except as described in this Privacy Policy. We use your Personal Information for providing and improving the Service. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, accessible at https://www.peaky.io.
The Service is a business-to-business leadership platform. It is used by organisations (our "Licensees") and their employees. For most personal data processed through the Service, the Licensee is the data controller and Peaky acts as data processor on the Licensee's documented instructions, as set out in our Data Processing Agreement.
Personal Information we collect
Information you provide us
"Personal Information" means any information that identifies or can be used to identify an individual directly or indirectly. While using our Service, you may provide us with, or we may ask you to provide us with, certain personally identifiable information that can be used to contact or identify you. Personal Information may include, but is not limited to, your name, work email address, your role and team within your organisation, and the wellbeing and engagement responses and free-text reflections you choose to submit through the Service.
Information we collect automatically
We collect information that your browser sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other statistics.
Information collected through AI features
Where you or your employer uses the AI-powered features of the Service, we process the following categories of data through our AI system:
Employee engagement responses and wellbeing data submitted through the Service
Interaction patterns and usage data within the Service
Organisational structure data provided by the Licensee (e.g. team membership, role, seniority)
This data is analysed by our AI system to generate insights and recommendations for managers. See the section "Use of Artificial Intelligence" below for further details.
Use of Personal Information
We may use your Personal Information to:
Communicate with you about your account and provide you with customer support in order to perform our contractual obligations in relation to your use of the Service. Where we have not entered into a contract with you, we may use your Personal Information to contact you in reliance on our legitimate interest in administering and supporting our Service.
Contact you with newsletters, marketing or promotional materials in accordance with your marketing preferences and this Privacy Policy. You may opt out of receiving any, or all, of these communications by following the unsubscribe link or instructions provided in any email we send. We will not send you unsolicited or third party marketing.
Use third party services such as PostHog to collect, monitor and analyse Log Data within the Service application in order to perform product analytics in reliance on our legitimate business interests in improving and enhancing our products and Services for our users.
Operate the AI features of the Service, including analysing employee engagement data and generating AI Output for managers, as further described below.
Use of Artificial Intelligence
How AI is used in the Service
The Service uses artificial intelligence to analyse employee engagement data and generate insights and recommendations ("AI Output") for managers and administrators. The AI system processes data about individual employees' responses and engagement patterns in order to:
Identify trends in employee wellbeing and engagement
Generate written summaries and recommendations for managers
Flag areas of potential attention within teams or the organisation
AI Output is intended as a decision-support tool only. No automated decisions with legal or similarly significant effects are taken solely on the basis of AI processing. A human manager always reviews and acts upon AI Output. The AI does not rank or compare individual employees against each other.
Legal basis for AI processing
The processing of personal data through the AI features is carried out on behalf of the Licensee (your employer or organisation) as data controller, with Peaky acting as data processor. The legal basis for this processing is determined by the Licensee. This will typically be:
The performance of an employment contract or the exercise of employer rights and obligations (Article 6(1)(b) or (c) GDPR), or
The legitimate interests of the Licensee in managing and supporting its workforce (Article 6(1)(f) GDPR), where such interests are not overridden by the interests or rights of the employee
Employees are informed of the use of AI through their employer's internal policies and notices, and through the transparency measures described below.
AI provider and data transfers
The AI features are powered by OpenAI, L.L.C. ("OpenAI"), which processes personal data as a sub-processor of Peaky under a Data Processing Agreement that incorporates the EU Standard Contractual Clauses for international transfers to the United States. Data submitted to the AI features is not used by OpenAI to train its general-purpose models. We are working towards processing AI requests within the EU in order to remove this international transfer; see "International transfers" below.
EU AI Act
Peaky is assessing and implementing its obligations in relation to the AI features of the Service under Regulation (EU) 2024/1689 (the EU AI Act). The AI features are designed to support human decision-making only and do not produce decisions with legal or similarly significant effects solely on the basis of automated processing.
Employees whose data is processed by the AI system have the right to:
Be informed that AI is used to analyse their engagement data and generate recommendations for their managers
Request meaningful information about the logic and significance of the AI Output that relates to them
Ask their employer, as data controller, for human review of any significant decision that was informed by AI Output and that affects them. Such decisions are made by the employer, not by Peaky; Peaky assists the employer in facilitating this review
Exercise all data subject rights set out below, including the right to access, rectify, and request erasure of their personal data
To exercise these rights, employees should contact their employer (the Licensee) in the first instance, or contact Peaky directly at the address listed at the end of this policy.
Transparency about AI in the Service
Where the AI features are active, AI-generated content is clearly identified as such within the Service, so that users can always see when a summary, insight or recommendation has been generated by AI.
Your Data Protection Rights
Your personal data is processed transparently. You are entitled to request access to, rectification, portability, erasure or restriction of the processing of your personal data. Where your employer is the data controller, such requests are made to your employer, who instructs Peaky to act on them. You may also contact Peaky directly. We facilitate these requests and respond within the timeframes required by applicable law.
Where personal data is processed through the AI features of the Service, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you (Article 22 GDPR). Peaky's AI features are designed to support human decision-making only, and do not produce solely automated decisions.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA country of your habitual residence, place of work or place of an alleged infringement. In Denmark, the supervisory authority is the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.
Categories of recipients of Personal Information
We do not claim any ownership over customer data and will never transfer, sell, or license out access to said data to any third parties, except to our sub-processors to provide our services, as instructed by our customer or as legally required by the competent authorities.
Our current sub-processors include: Render.com (backend hosting, EU/Frankfurt), Supabase.com (database and authentication, EU/Frankfurt), Vercel.com (frontend hosting), Sentry.io (error monitoring), PostHog (product analytics), SendGrid/Twilio (transactional email and SMS), Google OAuth (authentication), and OpenAI (AI processing). A full and up-to-date list of sub-processors, including processing locations and transfer mechanisms, is available in the Data Processing Agreement.
Retention of Personal Information
We do not retain Personal Information longer than necessary for the purposes for which it was collected, or where we have an ongoing legitimate business or legal obligation to retain it.
Personal data is deleted when a user is removed by an administrator or by Peaky, or following a valid erasure request. Upon deletion, the user's personal data is removed from our active production systems, and any residual copies held in encrypted backups are removed in the ordinary backup rotation cycle of 7 days.
Security
The security of your Personal Information is important to us, and we strive to protect it. No method of transmission over the Internet, or method of electronic storage, is completely secure, and we have therefore adopted appropriate technical and organisational measures designed to protect your Personal Information. This includes a strict access control regime, and encryption of data both at rest (AES-256) and in transit (TLS 1.2 or higher).
International transfers
Your information, including Personal Information, may be transferred to, processed and stored in a country other than your country of residence, where data protection laws may differ from those in your jurisdiction.
Our core infrastructure, including our database and backend, is hosted within the EU. Certain sub-processors are located in the United States. For all transfers to a third country, we rely on a transfer mechanism in accordance with applicable data protection law, in particular the EU Commission approved Standard Contractual Clauses, supplemented where appropriate by additional safeguards.
Transfers of personal data to OpenAI for the purpose of AI processing currently take place to the United States and are governed by the EU Standard Contractual Clauses and OpenAI's data processing addendum. We are working towards processing these AI requests within the EU in order to remove this international transfer.
Cookies
Cookies are files with a small amount of data, which may include an anonymous, unique identifier. Cookies are sent to your browser from a website and stored on your device.
We use cookies to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.
Compliance with laws
We will disclose your Personal Information where required to do so by law or subpoena, or if we believe that such action is necessary to comply with applicable law and the reasonable requests of law enforcement, or to protect the security or integrity of our Service.
Business Transaction
If Peaky is involved in a merger, acquisition or asset sale, your Personal Information may be transferred. We will provide notice before your Personal Information is transferred and becomes subject to a different Privacy Policy.
Links to other sites
Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party sites or services.
Children's Privacy
The Service is a business-to-business product intended for use by organisations and their employees. It is not directed at, and we do not knowingly collect Personal Information from, anyone under the age of 13. If you become aware that a person under 13 has provided us with Personal Information, please contact us, and we will delete such information.
Changes to this Privacy Policy
We may update our Privacy Policy in order to keep it up to date and accurate. We will notify you of any such changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.
Contact
If you have any inquiries, complaints or questions concerning how we process your information, including questions about your rights in relation to AI processing, please contact us at:
Peaky ApS Kastanievej 21, 4690 Haslev, Denmark CVR: 46550307 Email: michael@peaky.io Website: https://www.peaky.io