Privacy Policy

Last updated: November 21, 2025

This Privacy Policy explains how Fat Potato Ltd ("we", "us", "our") collects, uses, stores, and protects personal data when you use Chinchill.hr (the "Service"). We are committed to safeguarding personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable UK data protection laws.

1. Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

2. Data Controllers and Data Protection Officer

A data controller is an organisation that collects, uses and manages personal data and has responsibility for how the personal data is collected, used and managed.

A data protection officer is the person in an organisation who has responsibility for monitoring compliance with data protection law and for ensuring that personal data is protected within an organisation.

For the purposes of this Privacy Policy, Fat Potato Ltd, is the Data Controller for the personal data associated with the use of our website, marketing activities, and account administration. When you use the Service as an organisation, your organisation acts as the Data Controller for employee and HR-related data processed within the platform. In this case, we act as the Data Processor.

Our Data Protection Officer can be contacted at jodie@fat-potato.co.uk.

3. Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

  • Email address

  • First name and last name

  • Usage Data

  • Data Processed Within the HR Platform such as timesheets and holidays

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our Service or when You access the Service by or through a mobile device.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies We use include beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:

  • Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
  • Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

We use both Session and Persistent Cookies for the purposes set out below:

  • Necessary / Essential Cookies

    Type: Session Cookies

    Administered by: Us

    Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.

  • Functionality Cookies

    Type: Persistent Cookies

    Administered by: Us

    Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

For more information about the cookies we use and your choices regarding cookies, please visit our Cookie Policy.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

  • To provide and maintain our Service, including to monitor the usage of our Service.

  • To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.

  • For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.

  • To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.

  • To manage Your requests: To attend and manage Your requests to Us.

  • For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.

  • For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

We may share Your personal information in the following situations:

  • With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service, to contact You.
  • For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
  • With business partners: We may share Your marketing contact information with selected business partners to offer You relevant products, services or promotions. This does not apply to employee or HR data processed within the platform, which is never shared for marketing purposes.
  • With other users: when You share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.
  • With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. Specific retention periods are:

  • Account data: Duration of your account plus 90 days after closure
  • HR platform data: As directed by your organisation (the Data Controller), typically deleted within 90 days of account termination
  • Billing and financial records: 6 years (UK legal requirement)
  • Usage and security logs: 12 months

We may retain data for longer where required to comply with legal obligations, resolve disputes, or enforce our agreements.

Transfer of Your Personal Data

Your information, including Personal Data, is processed on Amazon Web Services (AWS) infrastructure. We do not transfer Personal Data outside the European Union or United Kingdom unless:

  • the destination country has an adequacy decision under UK data protection law; or
  • appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.

Where international transfers are necessary (for example, to provide customer support), we ensure appropriate safeguards are in place as required by UK GDPR Chapter V.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You from within the Service.

You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data where legally required or permitted, including where necessary to:

  • Comply with a legal obligation
  • Protect and defend the rights or property of the Company
  • Prevent or investigate possible wrongdoing in connection with the Service
  • Protect the personal safety of Users of the Service or the public
  • Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

4. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so under the UK GDPR. Depending on the nature of the interaction and the context in which data is collected, we rely on one or more of the following bases:

Performance of Contract

We process personal data where it is necessary to enter into or fulfil a contract for the provision of our Service. This includes creating and managing user accounts, providing access to platform features, maintaining user authentication, supplying customer support, issuing billing information, and communicating essential service updates. Without this processing, we would be unable to deliver the Service as agreed.

Legitimate Interests

We may process certain data where it is necessary for our legitimate business interests, provided these interests are not overridden by the rights and freedoms of data subjects. Such interests include maintaining and improving our platform's functionality, ensuring system security, detecting and preventing fraud or misuse, performing internal analytics, and enhancing user experience. Where legitimate interests apply, we always assess potential impacts and ensure safeguards are in place.

Consent

In situations where processing is not essential to the operation of the Service, we rely on freely given, specific, informed consent. Examples include the use of optional cookies, analytics technologies, or receiving marketing communications. You may withdraw consent at any time, and doing so will not affect your ability to use the core Service.

Legal Obligation

We may process personal data where required to comply with legal or regulatory obligations. This includes fulfilling financial recordkeeping requirements, responding to lawful requests from regulatory bodies, maintaining security logs, or meeting obligations under data protection laws. Such processing is limited strictly to what is necessary to satisfy the relevant obligations.

5. Children's Privacy

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

6. Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

7. Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

8. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your Personal Data:

  • Right of Access (Article 15): You have the right to request a copy of the Personal Data we hold about you.
  • Right to Rectification (Article 16): You have the right to request correction of inaccurate Personal Data.
  • Right to Erasure (Article 17): You have the right to request deletion of your Personal Data in certain circumstances.
  • Right to Restriction (Article 18): You have the right to request restriction of processing in certain circumstances.
  • Right to Data Portability (Article 20): You have the right to receive your Personal Data in a structured, commonly used, machine-readable format.
  • Right to Object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
  • Rights related to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not use automated decision-making or profiling that produces such effects.

To exercise any of these rights, please contact our Data Protection Officer at jodie@fat-potato.co.uk. We will respond to your request within one month. In complex cases, we may extend this by a further two months, and will inform you if this is necessary.

These rights are not absolute and may be subject to exemptions under UK data protection law.

9. Right to Complain to the Information Commissioner's Office

If you are not satisfied with how we handle your Personal Data or respond to your requests, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10. Contact Us

If you have any questions about this Privacy Policy, You can contact us:

  • By email: hello@chinchillhr.com