Privacy Policy

1. Who we are

TeamTorch Ltd ("TeamTorch", "we", "our", "us")
Company No. 14453517
Penhurst House, 352 Battersea Park Road, London SW11 3BY, United Kingdom
Email: privacy@teamtorch.io

We comply with the UK General Data Protection Regulation (UK GDPR), the EU GDPR and the Data Protection Act 2018.

2. How this policy applies

If we process your data on behalf of your employer, they remain the primary data controller; this policy explains how we handle that data as their processor.

3. What personal data we collect

The exact data we collect depends on your relationship with us:

• Identification and contact: name, work email, phone, employer, department and job title.
• Employment and professional: skills, career history, performance indicators, assessments and goals.
• Usage and device: IP address, browser type, device ID, time zone, clickstream and pages visited.
• Event and marketing: registration details, badge scans and dietary or accessibility requirements.
• Financial and contractual: invoicing details, bank information for vendors and compensation for employees.
• Special-category or sensitive data: only with consent or where legally required, such as disability or trade union membership.

4. How we collect data

• Directly from you through forms, profile updates, surveys and job applications.
• From your employer through HRIS integrations and CSV uploads.
• Automatically through cookies, SDKs, server logs and analytics tools.
• From third parties such as LinkedIn and event co-sponsors.

5. Why we process your data and our legal bases

Automated decision-making and AI: Insights are generated algorithmically, but are not acted upon without human review. You can request human review by emailing privacy@teamtorch.io.

6. How we protect and de-identify data

• TLS and AES-256 encryption.
• Role-based access control and multi-factor authentication for internal access.
• Penetration tests and vulnerability scans.
• Tokenisation and de-identification for machine learning.

7. Data sharing

We do not sell your data. We may share it with:

• Trusted subprocessors, such as AWS UK.
• Professional advisers and insurers.
• Event partners, where you have opted in.
• Authorities, where legally required.
• Parties involved in a merger or acquisition, with notice.

8. International transfers

Primary hosting is in London, UK. If data is accessed or backed up outside the UK/EEA, we use Standard Contractual Clauses and carry out transfer impact assessments. We are not currently certified under the Data Privacy Framework.

9. Data retention

10. Cookies, tracking and “Do Not Track”

We use essential, analytics (GA4) and functional cookies (reCAPTCHA and Crisp Chat). You can manage cookies through our banner, cookie settings or your browser. We do not respond to DNT signals.

You can also use the Google Analytics opt-out tool. See our Cookie Policy for more information.

11. Children

We do not knowingly collect data from anyone under 16. Contact us to delete any such data.

12. Your rights

• Access, correct or delete your data.
• Object to or restrict processing.
• Receive a portable copy.
• Withdraw consent at any time.
• Request human review of automated decisions.
• Lodge a complaint with the Information Commissioner's Office at ico.org.uk.

13. Security incidents

We maintain an incident response plan and notify affected parties without undue delay.

14. Changes to this policy

We will post updates 30 days in advance on our site and in the app if the policy changes materially.

15. Contact us