Privacy Policy — besideU

Plain English summary: besideU collects only what it needs to provide the platform. We never sell your data, never use it to train external AI models, and always treat bereavement-related information with the highest level of sensitivity. This policy explains exactly what we collect, why, and what your rights are.

1. Who we are

besideU Ltd is a company registered in England and Wales. We operate the besideU platform — an AI-powered workplace bereavement platform that helps organisations support employees through bereavement and loss.

Company name: besideU Ltd

Registered in: England and Wales

Email: [email protected]

Website: besideu.ai

ICO Registration Number: ZC137733

For all data protection queries, please contact us at [email protected] with the subject line "Data Protection Enquiry".

2. What data we collect and why

We collect different types of data depending on who you are and how you use besideU.

2.1 Data collected from organisations (our clients)

Data type	Why we collect it	Lawful basis
Organisation name and contact details	To set up and manage your account	Contract performance
HR lead name and email address	To provide platform access and support	Contract performance
Bereavement policy documents	To configure Maeve with your organisation's specific policy	Contract performance
Billing information	To process your subscription payment	Contract performance

2.2 Data collected from platform users (managers, HR, employees)

Data type	Why we collect it	Lawful basis
Name and work email address	To create and manage platform accounts	Legitimate interests / contract
Job title and reporting structure	To assign correct platform access level	Legitimate interests
Bereavement case information (relationship to deceased, dates, leave taken)	To enable case tracking, touchpoint scheduling, and appropriate guidance	Legitimate interests of the organisation with employee consent where required
Maeve conversation content	To provide AI guidance and, where enabled, to improve response quality within your organisation only	Legitimate interests / consent
Touchpoint logs and completion records	To enable HR oversight and ensure no employee is overlooked	Legitimate interests
Platform usage data	To improve the platform and provide reporting	Legitimate interests

2.3 Data collected from website visitors

Data type	Why we collect it	Lawful basis
IP address and browser information	Security, analytics, and fraud prevention	Legitimate interests
Pages visited and time on site	To understand how people use our website	Legitimate interests / consent
Contact form submissions	To respond to enquiries	Consent

3. Sensitive data

Bereavement information — including the nature of a loss, relationship to the deceased, and the emotional state of an employee — is treated by besideU as sensitive personal data, even where it does not technically fall under the UK GDPR special categories.

Our commitment: We apply the highest level of care to any data connected to bereavement. We do not share it beyond what is necessary to deliver the platform service, we do not use it for marketing, and we do not use it to train external AI models.

Where data does fall under UK GDPR special categories — for example health information relating to grief-related illness — we rely on explicit consent or substantial public interest as our lawful basis for processing.

4. How we use AI (Maeve)

Maeve is besideU's AI guidance assistant. She processes information shared during platform interactions to generate contextual guidance for managers, HR teams, and employees.

Maeve's responses are generated in real time and are not stored beyond the session by default
Conversation data is never used to train third-party AI models
Maeve does not make autonomous decisions — all guidance is advisory and subject to human judgement
Where conversation data is retained for quality or improvement purposes, this is done only within your organisation's data environment and requires your explicit agreement

For full details of how we use AI responsibly, please see our AI Ethics Policy.

5. Who we share data with

We do not sell personal data. We share data only where necessary to deliver the platform, and only with parties who are contractually bound to protect it.

Recipient	Purpose	Location
Cloud hosting provider	To host and run the besideU platform	UK / EEA
AI infrastructure provider	To power Maeve's guidance capabilities	UK / EEA (contractually restricted)
Payment processor	To process subscription payments	UK / EEA
Email service provider	To send platform notifications and system emails	UK / EEA

All third-party processors are subject to data processing agreements that meet UK GDPR requirements. No data is transferred outside the UK or EEA without appropriate safeguards in place.

6. How long we keep your data

Data type	Retention period
Active platform user data	For the duration of your organisation's subscription
Bereavement case records	Up to 3 years after case closure, unless your organisation requests earlier deletion
Maeve conversation logs (where retained)	90 days by default, unless otherwise agreed
Billing records	7 years (UK legal requirement)
Website enquiry data	12 months from last contact

On termination of a subscription, we will delete or anonymise all personal data within 30 days unless legally required to retain it, or unless you request a data export first.

7. Your rights under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to ask us to correct inaccurate or incomplete data
Right to erasure — to ask us to delete your data in certain circumstances
Right to restrict processing — to ask us to limit how we use your data
Right to data portability — to receive your data in a structured, machine-readable format
Right to object — to object to processing based on legitimate interests
Rights related to automated decision-making — to not be subject to decisions made solely by automated means where those decisions significantly affect you

To exercise any of these rights, please email [email protected] with the subject line "Data Rights Request". We will respond within one calendar month.

If you are unsatisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

The besideU website uses a small number of cookies to ensure it functions correctly and to understand how visitors use the site.

Cookie type	Purpose	Consent required?
Essential cookies	Required for the website and platform to function	No
Analytics cookies	To understand how visitors use the site so we can improve it	Yes

You can manage cookie preferences at any time through your browser settings. Refusing analytics cookies will not affect your ability to use the site.

9. Security

besideU takes the security of personal data seriously. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, or disclosure. These include:

Encryption of data in transit and at rest
Role-based access controls — HR sees case data only, employee interactions remain private
Regular security reviews and penetration testing
Cyber Essentials Plus certification (in progress)
Staff awareness training on data protection

In the event of a personal data breach that is likely to result in risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay, in accordance with UK GDPR Article 33.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our platform, legal requirements, or how we operate. When we make significant changes, we will notify active platform users by email and update the "last updated" date at the top of this page.

We encourage you to review this policy periodically.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch.

Email: [email protected]

Subject line: Data Protection Enquiry

ICO Registration: ZC137733

besideU Ltd · Registered in England and Wales