Last updated: 12 June 2025

This Privacy Policy describes the policies and procedures of Inspired Cloud Solutions Ltd (trading as EthosHub) on the collection, use, and disclosure of your information when you use the Service. It also explains your privacy rights and how the law protects you.

We use your personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

Words with an initial capital letter have meanings defined below. These definitions apply whether the terms appear in singular or plural form.

Definitions

For the purposes of this Privacy Policy:

• Company (referred to as "we", "us", or "our") means Inspired Cloud Solutions Ltd, a company registered in England and Wales, trading as EthosHub.

• You means the individual accessing or using the Service, or the organisation on behalf of which that individual is acting.

• Account means a unique account created for you to access the Service or parts of it.
• Website refers to EthosHub, accessible from https://www.ethoshub.io.
• Service refers to the Website and the EthosHub platform, including all applications and features offered through it.
• Country refers to England and Wales, United Kingdom.

• Service Provider means any natural or legal person who processes data on behalf of the Company — for example, hosting providers, email delivery services, or payment processors.

• Personal Data means any information relating to an identified or identifiable individual.

• Special Category Data means personal data that is particularly sensitive under UK GDPR, including information revealing racial or ethnic origin, health, religious beliefs, or data relating to criminal convictions — categories which may arise in workplace misconduct reports submitted through the Service.
• Cookies are small files placed on your device by a website that record browsing activity and preferences.
• Usage Data refers to data collected automatically from your use of the Service, such as pages visited, time spent, and device information.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

When you use the Service, we may ask you to provide personally identifiable information, including but not limited to:

• Name and email address
• Organisation name and job role
• Content you include in incident reports and messages
• Payment and billing information (processed by Stripe — we do not store card details directly)
• Usage Data

Special Category Data in Incident Reports

The nature of EthosHub's Service means that incident reports submitted by employees may contain Special Category Data — for example, reports involving racial discrimination, harassment, or health-related matters. We process this data solely to provide the case management service contracted by the subscribing organisation. The legal basis for processing Special Category Data is Article 9(2)(b) of UK GDPR (processing necessary for carrying out obligations in the field of employment and social security law) and, where applicable, Article 9(2)(g) (substantial public interest).

Usage Data

Usage Data is collected automatically when you use the Service.

This may include your device's IP address, browser type and version, pages visited, time and date of visits, time spent on pages, and other diagnostic data. When you access the Service via a mobile device, we may also collect device type, unique device identifiers, and mobile operating system information.

Anonymous reporters are a special case: we take deliberate steps not to log or retain IP addresses or any other identifying technical data for anonymous submissions. Only a hashed token (never the raw token) is stored to allow anonymous follow-up access.

Cookies

We use Cookies and similar tracking technologies to maintain session state and remember your preferences.

• Necessary / Essential Cookies

  Type: Session Cookies — Administered by: Us

  Required to authenticate users and maintain secure sessions. Without these, the Service cannot function.

• Functionality Cookies

  Type: Persistent Cookies — Administered by: Us

  Remember your login details and preferences so you do not need to re-enter them on each visit.

You can instruct your browser to refuse cookies, though some parts of the Service may not function correctly without them.

Legal Bases for Processing Your Personal Data

Under UK GDPR, we rely on the following legal bases to process personal data:

• Contract performance: Processing necessary to provide the Service you or your organisation have subscribed to, including account management and case handling.
• Legitimate interests: Improving and securing the Service, preventing fraud, and communicating service updates — where our interests are not overridden by your rights.
• Legal obligation: Retaining certain data to comply with legal or regulatory requirements.
• Consent: Where you have opted in to marketing communications. You may withdraw consent at any time.

How We Use Your Personal Data

We use personal data for the following purposes:

• To provide and maintain the Service, including account creation, case management, and messaging features.
• To manage your account and provide access to the relevant features for your role.
• To process payments and manage subscription billing through Stripe.
• To send service communications — including account setup details, case status updates, and security notices.
• To manage your requests and respond to support enquiries.
• To improve the Service through usage analysis and performance monitoring.

Sharing Your Personal Data

We may share personal data with the following categories of recipient:

• Service Providers (Data Processors): Third-party providers who process data on our behalf under strict data processing agreements. Our current key processors include:
  • Amazon Web Services (AWS) — cloud hosting and file storage (eu-west-2 region, UK)
  • Neon — database hosting
  • Stripe — payment processing
  • Resend / Amazon SES — transactional email delivery
• Subscribing organisations: Case data is accessible to authorised caseworkers and administrators within the organisation that holds the EthosHub subscription. We act as a data processor on behalf of that organisation (the data controller) in relation to employee report data.
• Legal and regulatory authorities: Where required by law, court order, or valid request from a public authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, with prior notice provided.

Retention of Your Personal Data

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Specifically:

• Account data is retained for the duration of the subscription and a reasonable period thereafter.
• Case and incident report data is retained in accordance with the subscribing organisation's data retention settings and applicable employment law obligations.
• Anonymous session tokens are stored in hashed form only and expire after 90 days by default.
• Payment records are retained as required by HMRC and financial regulations.

International Data Transfers

Our primary infrastructure is hosted within the UK (AWS eu-west-2). Some of our Service Providers (such as Stripe) may process data in the United States or other countries. Where data is transferred outside the UK, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses or adequacy decisions — in accordance with UK GDPR Chapter V.

Security of Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data, including encryption at rest and in transit, access controls, and role-based permissions. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no legitimate reason to continue processing it.
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — EthosHub does not make solely automated decisions with legal or significant effects on individuals.

To exercise any of these rights, please contact us at privacy@ethoshub.io. We will respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Children's Privacy

The Service is intended for use by organisations and their employees. It is not directed at anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to remove it.

Links to Other Websites

Our Service may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites and encourage you to review their privacy policies.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice on the Service, and will update the "Last updated" date at the top of this page. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact:

Inspired Cloud Solutions Ltd (trading as EthosHub)
Email: privacy@ethoshub.io
Website: www.ethoshub.io