Privacy Notice

Version 1.0 · Effective 7 June 2026 · Republic of Ireland

Who we are

WorkWise Policy Assistant ("WorkWise", "we") is an Irish HR-tech product. For employees of our client companies, WorkWise acts as a data processor. Your employer is the data controller and decides what data is processed about you.

What data we process

Account data: name, work email, role.
Policy documents your employer uploads.
Questions you ask the assistant and its answers, with citation metadata.
Escalation tickets when your question triggers a sensitive-topic rule.
Consent log (cookie banner choices), audit log of administrative actions.
Technical: session token, IP address (transient, for security only).

Legal basis

Processing relies on Article 6(1)(b) (performance of your employment contract via the tools your employer provides) and 6(1)(f) (legitimate interest in operating and securing the service). We do not use special-category data unless your employer explicitly uploads it within their own policies.

Where your data lives

All personal data is stored in the European Union (default: Ireland,eu-west-1). Inference for AI answers runs in EU regions of our providers. Transfers outside the EEA, if any, are covered by Standard Contractual Clauses.

Sub-processors

We use a small number of vetted sub-processors. The list is published at /sub-processors and updated when it changes.

Retention

Your employer chooses the retention period. The default is 12 months for chat messages and audit entries; documents are kept until your employer deletes them or terminates the contract.

Your GDPR rights

You may access, rectify, port, restrict, object to or delete your personal data. Signed-in employees can do this from My data & privacy inside the app, or by contacting your employer or our DPO at info@workwisehr.ie. You may also lodge a complaint with the Irish Data Protection Commission.

Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is gated by Row Level Security so one company can never read another's data. Administrative actions are recorded in an immutable audit log.

Cookies

We use a single strictly-necessary cookie for your sign-in session. Optional analytics cookies are opt-in via the cookie banner.