Privacy policy
This policy explains how we handle personal information on pmfy.org, in the PMFY HR Hub, and in the HR and people services we provide to businesses.
1. Who we are
PlaceMeantForYou ("PMFY", "we", "us") is a Khwaabshala initiative. Khwaabshala is the trading name of Ambikesh Sharma, a sole trader based in London, United Kingdom.
You can contact us about anything in this policy at hello@pmfy.org.
2. Our two roles
When we act for an employer. The PMFY HR Hub (for example derada.pmfy.org) and our HR services are provided to businesses under a written agreement. For staff and job applicants' information, the employer decides how it is used and is the controller. We are the processor: we only use the information on the employer's instructions and to provide our services. If you work for one of our clients, please also read your employer's staff privacy notice, and contact your employer first about your information.
When we act for ourselves. For visitors to pmfy.org, people who contact us, and the businesses we work with, we are the controller.
3. What we collect
Visitors to pmfy.org
We don't use advertising or tracking cookies. Our hosting and security provider records basic technical information, such as IP address, browser type and the pages requested, to keep the site secure and working.
People who contact us and our clients
Names, email addresses, phone numbers, business details, what you tell us when you get in touch, and the records needed to provide and invoice our services.
People who use the PMFY HR Hub
- Account details: your name, email address and how you sign in. If you choose "Continue with Google", we receive your name, email address and profile picture from Google.
- Work records your employer keeps in the Hub: contact and emergency contact details, job title, team, start date, contract type, pay rate, right-to-work status, hours worked, holiday, training records and confirmations that you have read workplace policies.
- Absence records: dates, a reason category, self-certification forms, fit notes and return-to-work notes. Some of this is health information, which is handled with extra care and seen only by you, your manager, your employer's owners and our administrators.
- Speak up reports: concerns you choose to raise. You can raise a concern anonymously. The Hub does not record who sends an anonymous report.
- Security records: sign-in events, two-step sign-in settings for owners and administrators, and a log of changes made to records.
4. Google sign-in
If you sign in with Google, we ask only for your name, email address and profile picture, so that we can identify you and match you to the account your employer set up. We do not access your Gmail, Google Drive, contacts or any other Google data.
PMFY HR Hub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Why we use information, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the HR Hub and HR services to our clients | Contract with our client. For staff information, we act on the employer's instructions and the employer's own lawful bases apply, including its obligations as an employer. |
| Signing you in and keeping accounts secure | Legitimate interests in protecting the information in the Hub |
| Replying to enquiries and running our business | Legitimate interests, or taking steps to enter a contract |
| Keeping financial and tax records | Legal obligation |
We never sell personal information, and we don't use it for advertising.
6. Who we share it with
We use trusted service providers who process information on our behalf and under contract:
- Database, file storage and sign-in services (Supabase). HR Hub data is stored in London, United Kingdom.
- Application hosting, domain and website security providers, including Cloudflare.
- Google, if you choose to sign in with Google.
- Our email provider, to send sign-in emails and notifications.
We may also share information with professional advisers, or where the law requires it. Some providers may process limited information outside the UK. Where they do, we rely on UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement.
7. How long we keep it
- HR Hub records: for as long as the employer's agreement with us lasts, following the employer's own retention schedule. Within 30 days after an agreement ends, we give the employer a full export of their data and then delete it from the Hub, unless the law requires otherwise.
- Encrypted backups: up to 90 days, after which they are deleted automatically.
- Client and financial records: six years after the end of the tax year they relate to.
- Enquiries that don't lead to work: up to two years.
8. How we protect it
All connections are encrypted. Each employer's information is kept separate by database access rules, and within an employer, people see only what their role allows. Files are private and opened through links that expire within minutes. Owners and administrators use two-step sign-in, and changes to records are logged.
9. Your rights
You have the right to ask for a copy of your information, and to ask us to correct it, delete it, restrict or object to its use, or transfer it. If your information is in the HR Hub, please contact your employer first; we will help them respond. You can also contact us at hello@pmfy.org.
If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
10. Cookies
The HR Hub uses only what is needed to keep you signed in. pmfy.org does not use advertising or tracking cookies.
11. Changes to this policy
We'll update this page if anything changes and show the new date at the top. If a change is significant, we'll tell our clients directly.