Privacy Policy

In this Privacy Policy, the following definitions are used:

Data:

collectively all information that you submit to Pair Software Ltd via the Website. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.

Data Protection Laws:

any applicable law relating to the processing of personal Data, including but not limited to the UK GDPR, and any national implementing and supplementary laws, regulations and secondary legislation.

UK GDPR:

the UK General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

Pair Software Ltd, we or us:

Pair Software Ltd, a company incorporated in England and Wales with registered number 15307012 whose registered office is at West Cottage, Apperley Farm, Stocksfield, Northumberland NE43 7SJ.

User or you:

any third party that accesses the Website and is not either (i) employed by Pair Software Ltd and acting in the course of their employment or (ii) engaged as a consultant or otherwise providing services to Pair Software Ltd and accessing the Website in connection with the provision of such services.

Website:

the website that you are currently using, pairsoftware.io, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

Application:

the Pair Software mobile application, available for iOS and Android, and any related mobile services.

Services:

the Website and the Application, collectively.

In this Privacy Policy, unless the context requires a different interpretation: the singular includes the plural and vice versa; references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this Privacy Policy; a reference to a person includes firms, companies, government entities, trusts and partnerships; "including" is understood to mean "including without limitation"; reference to any statutory provision includes any modification or amendment of it; the headings and sub-headings do not form part of this Privacy Policy.

This Privacy Policy applies to the actions of Pair Software Ltd and Users with respect to the Services (that is, this Website and the Application). References in this Privacy Policy to the Website should, where the context permits, be read as including the Application. This Privacy Policy does not extend to any websites that can be accessed from the Services including, but not limited to, any links we may provide to social media websites. Section 11 sets out additional disclosures specific to the Application.

For purposes of the applicable Data Protection Laws, Pair Software Ltd is the “data controller”. This means that Pair Software Ltd determines the purposes for which, and the manner in which, your Data is processed.

In addition to acting as a data processor for our platform customers (see Section 2 above), Pair Software Ltd is itself a data controller for certain individuals who interact with us directly rather than through a customer's use of the platform. This includes:

• job applicants and candidates who apply for roles at Pair Software Ltd;
• visitors who contact us through the Website's chat widget or contact forms;
• individuals whose public comments or posts are processed for sentiment-analysis features offered to our customers (see Section 9);
• Pair Software Ltd's own staff.

Data collected: for job applicants and candidates, we collect name, contact details, CV/résumé, cover letter, and any information you provide during the application or interview process. For chat and contact-form users, we collect name, email address, and the content of your enquiry.

Purpose and legal basis: we process this data to assess applications, respond to enquiries, and operate our recruitment and business-communication processes. Our legal basis is legitimate interests (recruitment and business communications) and, where applicable, taking steps prior to entering into a contract with you (Art. 6(1)(b) UK GDPR).

Special category data: where an application or enquiry includes special category data (for example, health or disability information disclosed voluntarily by a candidate), we process this only with your explicit consent or as necessary for equality-of-opportunity monitoring, and we apply additional access restrictions to such data.

Retention: unsuccessful candidate data is retained for 6 months following the conclusion of the recruitment process, after which it is deleted, unless you ask us to keep your details on file for future opportunities. See Section 15 for further retention information.

We may collect the following Data, which includes personal Data, from you:

• name;
• contact information such as email addresses and telephone numbers;
• web browser type and version, operating system, screen resolution, and device information (automatically collected);
• IP address and approximate location derived from IP address (automatically collected);
• behavioural and usage data including mouse movements, clicks, scrolls, page interactions, session recordings, and heatmap data (automatically collected via Microsoft Clarity - see Section 7);
• cookie consent preferences recorded by Cookiebot (see Section 6);
• in each case, in accordance with this Privacy Policy.

We collect Data in the following ways:

• data is given to us by you; and
• data is collected automatically.

Data That is Given to Us by You

Pair Software Ltd will collect your Data in a number of ways, for example:

• when you contact us through the Website, by telephone, post, e-mail or through any other means;
• in each case, in accordance with this Privacy Policy.

Data That is Collected Automatically

To the extent that you access the Website, we will collect your Data automatically, for example:

• we automatically collect some information about your visit to the Website. This information helps us to make improvements to Website content and navigation, and includes your IP address, the date, times and frequency with which you access the Website and the way you use and interact with its content.

Our Website uses cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our Website. We use the following categories of cookies:

• Essential cookies: strictly necessary for the Website to function. These cannot be switched off and do not require your consent.
• Statistics/analytics cookies: used to understand how visitors interact with our Website, including via Microsoft Clarity (see Section 7). These are only activated with your explicit consent.
• Preference cookies: used to remember your settings and preferences across visits.
• Marketing cookies: used to deliver relevant advertising. These are only activated with your explicit consent.

Cookiebot - Consent Management Platform

Cookie consent on our Website is managed by Cookiebot, a Consent Management Platform (CMP) provided by Usercentrics A/S, registered in Denmark (company reg. no. 34624607).

Cookiebot operates by:

• Scanning our Website to identify all cookies and tracking technologies in use;
• Presenting you with a consent banner on your first visit, categorised by cookie type;
• Blocking all non-essential cookies and scripts (including Microsoft Clarity) until you give explicit consent;
• Recording your consent with a timestamp, so we have a verifiable consent record;
• Allowing you to change or withdraw your consent at any time.

Legal basis for Cookiebot itself: Legitimate interests - Cookiebot sets a single essential cookie ('CookieConsent') to store your consent state. This is strictly necessary to honour your preferences and comply with our legal obligations.

Data stored in CookieConsent cookie: Your consent state (accepted/declined per category), timestamp, and consent method. No personal identifiers such as your name or email address are stored in this cookie.

Retention: The CookieConsent cookie is retained for 12 months, after which your preferences will be asked again.

To view, change, or withdraw your cookie consent at any time, click "Cookie Settings" in the footer of any page on our Website.

For a full declaration of all cookies used on our Website, including names, purposes, and durations, please see our Cookie Declaration:

Cookie Declaration - pairsoftware.io/cookies

Further information about Cookiebot:

• Cookiebot Privacy Policy
• Cookiebot Data Processing Agreement

We use Microsoft Clarity, a behavioural analytics service provided by Microsoft Ireland Operations Limited, to understand how visitors interact with our Website. Clarity is only activated after you have given explicit consent via our Cookiebot cookie banner.

Clarity collects data including:

• session recordings (replays of your visit);
• heatmaps (where users click, move, and scroll);
• mouse movements, clicks, and scrolling behaviour;
• device, browser, and operating system information.

Data controller for Clarity data: Microsoft Ireland Operations Limited.

Legal basis: Your explicit consent, obtained via our Cookiebot banner before Clarity is activated. You may withdraw consent at any time via Cookie Settings in the footer.

Data storage: Microsoft Azure cloud infrastructure. Clarity data is retained for between 30 days and 13 months depending on data type, after which it is deleted from Microsoft's servers and backups.

International transfers: Clarity customers in the UK contract with Microsoft Ireland Operations Limited (MIOL), which has Standard Contractual Clauses (SCCs) in place with Microsoft Corporation in the United States, lawfully covering cross-border data transfers.

Note: Microsoft Clarity does not collect your name or email address. Microsoft retains rights to use aggregated data for its own purposes in accordance with its privacy statement.

Further information:

• Microsoft Privacy Statement
• Microsoft Clarity Terms of Use
• Microsoft Clarity Consent Mode (Cookiebot integration)

Any or all of the above Data may be required by us from time to time in order to provide you with the best possible service and experience when using our Website. Specifically, Data may be used by us for the following reasons:

• internal record keeping;
• improvement of our products and services;
• transmission by email of marketing materials that may be of interest to you (where you have provided consent or we have a soft opt-in basis to do so);
• contact for market research purposes which may be done using email, telephone, fax or mail - such information may be used to customise or update the Website;
• website analytics and user experience optimisation (subject to your cookie consent via Cookiebot).

We will only process your Data on one of the following legal bases:

• Consent - for analytics cookies (including Microsoft Clarity), marketing cookies, and direct marketing;
• Legitimate interests - for internal record keeping, service improvement, and consent management (Cookiebot), where we have assessed that our interests are not overridden by your rights;
• Legal obligation - where processing is necessary to comply with applicable law.

For the delivery of direct marketing to you via e-mail, we'll need your consent, whether via an opt-in or soft-opt-in:

• Soft opt-in consent applies when you have previously engaged with us (for example, you contact us to ask for more details about a product/service, and we are marketing similar products/services)). Under soft opt-in consent, we will take your consent as given unless you opt out.
• For other types of e-marketing, we are required to obtain your explicit consent; that is, you need to take positive and affirmative action when consenting, for example by checking a tick box.
• If you are not satisfied with our approach to marketing, you have the right to withdraw consent at any time - see Section 13 below.

We use the following third-party service providers (subprocessors) to operate our platform and Website. Each has been assessed for compliance with applicable data protection laws and a Data Processing Agreement (DPA) is in place where required:

A full and current list of subprocessors is maintained at:
trust.pairsoftware.io

Several of our third-party subprocessors (see Section 9 above) are based outside the UK, or transfer Data to countries outside the UK in the course of providing their services, including to the United States. The specific subprocessor and its country or region of processing are set out in Section 9.

Where such transfers take place, we ensure appropriate safeguards are in place. Depending on the subprocessor, these may include one or more of the following: the UK Extension to the EU-U.S. Data Privacy Framework; Standard Contractual Clauses (SCCs) approved by the European Commission; or the UK International Data Transfer Addendum (IDTA) issued by the Information Commissioner's Office.

A summary of the transfer mechanism relied upon for each subprocessor is provided in Section 9 above. Further detail, including copies of relevant safeguards, is available on request at support@pairsoftware.io.

This section provides additional disclosures specific to the Pair Software mobile application (the Application), available for iOS and Android. It supplements, and should be read together with, the rest of this Privacy Policy.

Data collected by the Application: device identifiers, GPS location data associated with shift clock-in and clock-out, and shift or venue details necessary to provide the Application's core functionality.

Location data: the Application uses your device's location to record clock-in and clock-out times and to display nearby shift venues. Location and shift data associated with your account is retained for 120 days, after which it is deleted or anonymised as part of the Application's automated retention process.

Token and account storage: authentication tokens are stored securely on your device using the operating system's secure storage (iOS Keychain / Android Keystore) and are not accessible to other applications.

Third-party map providers: the Application displays shift venue locations using OpenStreetMap map tiles, loaded via a third-party content delivery network. This means your device's IP address and approximate location may be visible to these third parties when a map is displayed.

Push notifications: the Application uses Firebase (a Google service) to deliver push notifications, such as shift reminders and duty manager alerts. See Section 9 for further detail on this subprocessor.

Account deletion: you can delete your account and associated Data directly within the Application at any time via your account settings. This will initiate the erasure process described in Section 13 (Your Rights).

Permissions: the Application may request certain device permissions (such as location and notifications) that are required to provide its core shift-management features. You can review and manage these permissions at any time in your device settings.

We may share your Data with the following groups of people for the following reasons:

• our employees, agents and/or professional advisors - to obtain advice from professional advisers;
• Microsoft Ireland Operations Limited - to provide behavioural analytics through Microsoft Clarity in order to improve our Website's usability and performance (subject to your cookie consent);
• Usercentrics A/S (Cookiebot) - to manage and record your cookie consent preferences;
• in each case, in accordance with this Privacy Policy.

You have the following rights in relation to your Data:

• Right to access - the right to request copies of the information we hold about you at any time, or that we modify, update or delete such information. We will not charge you for this, unless your request is manifestly unfounded or excessive.
• Right to correct - the right to have your Data rectified if it is inaccurate or incomplete.
• Right to erase - the right to request that we delete or remove your Data from our systems.
• Right to restrict our use of your Data - the right to block us from using your Data or limit the way in which we can use it.
• Right to data portability - the right to request that we move, copy or transfer your Data.
• Right to object - the right to object to our use of your Data including where we use it for our legitimate interests.
• Right to withdraw consent - where we rely on consent as our legal basis (including for cookies), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. To withdraw cookie consent, use Cookie Settings in the footer of our Website.

To make enquiries, exercise any of your rights, or withdraw your consent, please contact us at: support@pairsoftware.io

If you are not satisfied with the way a complaint is handled by us, you may be able to refer your complaint to the Information Commissioner's Office (ICO). The ICO's contact details can be found at:
https://ico.org.uk/

It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.

We will use technical and organisational measures to safeguard your Data, for example:

• access to your account is controlled by a password and a username that is unique to you;
• we store your Data on secure servers hosted on AWS eu-west-2 (London) with UK data residency;
• we implement role-based access controls (RBAC) to limit access to personal data;
• data in transit is encrypted using TLS;
• we maintain audit logging of access to personal data within the platform.

If you suspect any misuse, loss, or unauthorised access to your Data, please contact us immediately at: support@pairsoftware.io or security@pairsoftware.io

For further guidance on protecting your information online, please visit www.getsafeonline.org, supported by HM Government and leading businesses.

Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this Privacy Policy or until you request that the Data be deleted.

Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes.

Key retention periods for third-party subprocessors:

• Cookiebot CookieConsent cookie: 12 months from consent.
• Microsoft Clarity behavioural data: 30 days to 13 months depending on data type.
• Job applicant and candidate data: see Section 3 for specific retention periods.

This Website may, from time to time, provide links to other websites. We have no control over such websites and are not responsible for the content of these websites. This Privacy Policy does not extend to your use of such websites. You are advised to read the Privacy Policy or statement of other websites prior to using them.

Pair Software Ltd may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of Pair Software Ltd. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use the Data for the purposes for which it was originally supplied to us.

We may also disclose Data to a prospective purchaser of our business or any part of it. In the above instances, we will take steps with the aim of ensuring your privacy is protected.

You may not transfer any of your rights under this Privacy Policy to any other person. We may transfer our rights under this Privacy Policy where we reasonably believe your rights will not be affected.

If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.

Pair Software Ltd reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on the Website and you are deemed to have accepted the terms of the Privacy Policy on your first use of the Website following the alterations.

You may contact Pair Software Ltd by email at support@pairsoftware.io

This Privacy Policy was last updated on Aug 2026.

For general privacy enquiries: support@pairsoftware.io

To report a security vulnerability or data breach: security@pairsoftware.io

For our full Trust Centre including subprocessors, security controls, and infrastructure details:

trust.pairsoftware.io

This section records material reviews and changes made to this Privacy Policy, and the date of the next scheduled review.

Aug 2026 - Reviewed and updated. Added Section 3 (Pair Software as Data Controller - Job Applicants, Candidates and Other Individuals) and Section 10 (International Transfers). Updated Section 9 (Third-Party Subprocessors) to add Stripe, Twilio, Firebase and Meta Platforms, Inc. Updated Section 15 (Data Retention) accordingly.

Aug 2026 - Extended scope to the mobile Application. Added Section 11 (Mobile Application - Additional Disclosures), extended the definitions in Section 1 (Application, Services) and widened Section 2 (Scope) to cover the mobile Application alongside the Website. This entry supersedes the previous mobile-only privacy notice.

May 2026 - Baseline version. Subprocessors listed: Amazon Web Services (AWS), Amazon Simple Email Service (SES), Google Gemini, Microsoft Clarity, and Cookiebot.

Next scheduled review: February 2027.