Last updated August 13, 2026

Internal employee and workspace-user privacy notice

This notice explains the personal data created when employees, contractors, and assigned users access the private 4h4 Workspace.

1. Controller and scope

The relevant 4h4 employing or contracting entity is intended to be the controller. Its legal name, address, HR/privacy contact, data-protection officer details (if appointed), and EU representative details (if required) must be inserted before live use. This notice supplements, rather than replaces, any broader workforce privacy notice.

2. Data and sources

The workspace records work-account identity, display name, email, assigned role, approval and active status, last access time, changes made to business records, privacy and compliance actions, and security or diagnostic information. Data comes from you, 4h4 administrators, the identity provider, and use of the workspace.

3. Purposes and lawful bases

• Provide and administer secure access, allocate responsibilities, and support candidate and opportunity work.
• Protect systems, investigate misuse, meet legal obligations, establish or defend claims, and demonstrate accountability.
• Depending on the relationship and country, the basis may be performance of an employment or service agreement, legal obligations, and 4h4’s legitimate interests in secure and accountable operations. Consent should not be used where the employment relationship makes it unlikely to be freely given.

4. Monitoring and automated decisions

Activity logs are intended for security, accountability, support, and compliance—not continuous productivity scoring. This workspace must not make automated decisions about employment, discipline, compensation, or dismissal. Material decisions require authorized human review.

5. Access, sharing, and transfers

Authorized administrators, managers, professional advisers, and contracted technology suppliers may receive data where needed. 4h4 must have appropriate confidentiality and processing terms with suppliers. Transfers outside protected regions require a documented legal mechanism, transfer assessment, and appropriate safeguards.

6. Retention

Account and audit information should be kept only as long as needed for access administration, security, legal obligations, or claims, using an approved retention schedule. Access must be disabled promptly when it is no longer required. National employment and limitation-period rules must be incorporated into the final schedule.

7. Your rights

Subject to applicable law and exceptions, you may request access, correction, deletion, restriction, portability, or object to processing, and may complain to the competent supervisory authority. Contact the 4h4 HR or privacy representative identified in the finalized notice. Identity may need to be verified.

8. Security and incidents

4h4 applies role-based permissions, account approval, encrypted transport, security headers, protected write requests, and audit logging. Suspected loss, unauthorized access, or disclosure must be reported immediately through 4h4’s breach-response procedure.