Terms of Service

1. Who these terms are between

These terms are an agreement between the company named below ("we", "us") and the business that subscribes to Serene HR ("you", "your"). They apply from the moment your company's account is created and for as long as it exists. By using the service on behalf of a business, you confirm that you are authorised to agree to these terms for it.

Operated by

Serenity Digital Limited

Company number

08215186

Registered office

Ralls House, Parklands Business Park, Forest Road, Denmead, PO7 6XP

ICO registration

ZB782226

Contact

[email protected]

The people your company gives access to, including its employees, managers and any HR consultant it appoints, are "users". You are responsible for their use of the service.

2. The service and accounts

• Serene HR is provided as a hosted service. We host it, keep it running and update it; you do not need to install anything.
• Users sign in with a single-use link sent to their email address. There are no passwords. A user must keep their email account secure, and you must tell us promptly if you believe an account has been misused.
• You administer who has access, what role each user holds, and when access is withdrawn. Access for a person whose employment has ended is withdrawn automatically once their record is marked as such.
• Where you use the clock-in kiosk, you are responsible for the device it runs on and for the PINs issued to staff.

3. Your obligations as an employer

You are the data controller for the personal data you and your users enter about your staff. You must:

• have a lawful basis for holding and using that data, including, for sickness records and equal-opportunities information, the conditions UK law requires for special category data;
• tell your staff what is recorded about them and why, which you may do by pointing them to our Privacy Policy alongside your own;
• keep the data accurate, and correct or remove it when asked to by someone entitled to ask;
• give access only to people who need it for their role, and use the roles the service provides to do so;
• respond to your staff's requests to exercise their data protection rights.

4. Acceptable use

You must not, and must not allow any user to:

• use the service for anything unlawful, or to hold data you have no right to hold;
• attempt to gain access to another company's data, another user's account, or any part of the service you have not been given access to;
• probe, scan or test the security of the service without our written agreement;
• copy, resell or make the service available to anyone outside your business;
• upload anything that contains malicious code or that you do not have the right to share.

We may suspend an account that we reasonably believe is being used in breach of this section, and will tell you when we do.

5. Data processing terms

This section sets out the terms on which we process personal data on your behalf, as Article 28 of the UK GDPR requires. It forms part of this agreement.

Subject matter and duration

The processing of personal data about your staff and business contacts necessary to provide the service, for as long as this agreement lasts and for the deletion period after it.

Nature and purpose

Storing, organising, displaying, transmitting and reporting on the data, so that you can administer employment, leave, sickness, time and attendance, documents, performance, pay and related matters.

Types of personal data

The categories listed in the Privacy Policy's description of the data the service holds, including special category data about health and ethnicity.

Data subjects

Your current and former employees, their emergency contacts, and people at organisations you record in the customer relationship features.

In processing that data we will:

1. act only on your documented instructions, which are these terms and the way your users operate the service, unless the law requires otherwise, in which case we will tell you first where we may;
2. ensure that anyone we authorise to process the data is bound by a duty of confidentiality;
3. take the security measures described in the Privacy Policy, appropriate to the risk, including encryption of the most sensitive fields and separation of each company's data;
4. engage sub-processors only as set out in section 6, remain responsible for their performance, and impose on them obligations equivalent to these;
5. assist you, taking into account the nature of the processing, in responding to requests from data subjects, by providing the tools in the service and, where those are insufficient, by helping directly;
6. assist you in meeting your obligations on security, breach notification and data protection impact assessments, and tell you without undue delay after becoming aware of a personal data breach affecting your data;
7. at the end of the agreement, delete the data or return it to you as set out in section 13, and delete existing copies unless the law requires us to keep them;
8. make available the information needed to demonstrate compliance with this section, and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice and no more than once a year unless required by a supervisory authority.

We will tell you immediately if, in our opinion, an instruction infringes data protection law.

6. Sub-processors

You give general authorisation for us to use the sub-processors listed below, which are the same providers the Privacy Policy describes. We will give you at least thirty days' notice before adding or replacing a sub-processor that will process your staff's data. If you object on reasonable data protection grounds and we cannot resolve the objection, you may end this agreement under section 15 without penalty.

7. The assistant and generated content

The service includes an assistant that answers questions and carries out routine actions using an artificial intelligence model. Its replies are generated and may be wrong. They are assistance, not advice: you remain responsible for every decision about your staff, and for checking anything the assistant tells you before you act on it. You may turn the assistant off for any user.

8. Third-party integrations

The service can import records from Breathe HR using an API key you supply. This is optional. Your use of Breathe HR is governed by its own terms, and we are not responsible for its availability or for changes it makes. You are responsible for having the right to import the data you import.

9. Availability, support and maintenance

We aim to keep the service available at all times, and we will give notice of planned maintenance where we reasonably can. We do not guarantee uninterrupted availability. Support is by email at [email protected] during UK business hours. We may release changes and improvements to the service at any time.

10. Fees

Fees, the billing period and payment terms are as agreed in writing between you and us. Where no fee has been agreed, the service is provided free of charge and either party may end this agreement under section 15. Fees are exclusive of VAT.

11. Intellectual property

The service, its software, design and documentation belong to us and our licensors, and nothing in this agreement transfers them to you. You have a non-exclusive, non-transferable right to use the service for your business for as long as this agreement lasts. Your data belongs to you; you give us the right to process it only as needed to provide the service.

12. Confidentiality

Each of us will keep the other's confidential information confidential and use it only for the purposes of this agreement. Your data is your confidential information. This does not apply to information that is public, that the receiving party already had, or that the law requires to be disclosed.

13. Your data when the agreement ends

For thirty days after this agreement ends you may ask us for a copy of your data in a commonly used, machine-readable form, and we will provide it. After that period we will delete your data, including backups in the ordinary course of their rotation, unless the law requires us to keep it. You may ask us to delete it sooner.

14. Warranties and liability

We warrant that the service will perform materially as described and that we will provide it with reasonable skill and care. Beyond that, the service is provided as it is, and we exclude all other warranties to the extent the law allows.

Nothing in this agreement limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law. Subject to that, neither of us is liable to the other for loss of profit, loss of business, or indirect or consequential loss, and our total liability to you under this agreement in any twelve-month period is limited to the fees you paid us in that period or, if none, to one hundred pounds.

You are responsible for the accuracy and lawfulness of the data you enter and for the decisions you make using the service.

15. Termination

Either of us may end this agreement by giving the other thirty days' written notice. Either of us may end it immediately if the other materially breaches it and does not put the breach right within fourteen days of being asked, or becomes insolvent. Sections 5, 11, 12, 13 and 14 continue after the agreement ends.

16. Changes to the service and these terms

We may change the service as we develop it. We may also change these terms; where a change would materially reduce your rights we will give you at least thirty days' notice by email, and you may end the agreement before the change takes effect. Continuing to use the service after that is acceptance of the new terms. The date at the top of this page shows when they were last changed.

17. Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

18. Contact

Notices under this agreement should be sent to [email protected] or to our registered office at Ralls House, Parklands Business Park, Forest Road, Denmead, PO7 6XP.