Privacy Policy

This policy explains what personal information Dragon HRM SaaS collects, why, and what happens to it. It is a general template: the organisation running this installation should review it and adapt it to the law that applies to them.

1. Who is responsible
Dragon HRM SaaS is operated by the organisation running this installation (the operator). Companies that subscribe use it to manage their own employees. For the employee records a company enters, that company decides what is collected and why; the operator processes those records on its behalf and on its instructions.

2. What we collect
Account information: the name, email address and password of each person who signs in.
Company records: whatever a subscribing company enters about its staff, such as contact details, contracts, attendance, leave, payroll and documents, and what job applicants send through a company's careers page.
Usage information: technical records such as sign-in times and the actions taken inside the product, kept for security and to investigate problems.
Messages: what you send us through the contact form, and the email address you give to receive our news.

3. How we use it
To provide the service a company has subscribed to; to keep accounts secure; to send the messages the service relies on, such as password resets; to answer enquiries; and to meet our legal obligations. We do not sell personal information.

4. Who it is shared with
Only the outside services this installation is set up to use:
- Hosting and email delivery, to run the service and send its messages.
- Payment providers, when a company pays for a plan online. Card details are entered on the provider's own page and never reach this service.
- An AI provider, when the operator switches on an AI feature. The text that feature works on -- a document being drafted, a review being written, a CV being read, or a question put to the employee assistant -- is sent to the provider the operator has chosen, under that provider's terms.
- Google reCAPTCHA, when it is switched on, to tell people from automated sign-ups on public forms.
- Google Analytics, only for visitors who accept analytics cookies.
- Addresses a company sets up itself to receive notice of events in its own account (webhooks).
We disclose information to authorities only where the law requires it.

5. How long it is kept
For as long as the account is active and afterwards only as long as the law requires. Activity records are removed automatically after a set period. A company can export its records from the screens that hold them, and can ask the operator to delete its account and records.

6. Security
Access is limited by role and by company, passwords are stored as one-way hashes, and two-factor sign-in is available. No system is perfectly secure, and we will tell affected customers promptly if a breach affects their information.

7. Cookies
We use the cookies needed to keep you signed in and to protect forms against forgery. On the public pages we also ask before setting analytics cookies; if you accept, Google Analytics measures visits. You can change your answer at any time from the Cookie settings link at the foot of the home page. We do not use advertising cookies.

8. Your rights
You can ask to see, correct or delete the personal information held about you. If a company holds your employee record or your job application, ask that company first; we will help it answer.

9. Changes and contact
We may update this policy and will show the new version here. Questions can be sent through the contact form on the home page.