Privacy Policy

1. Who we are and what this policy covers

Runway HR Solutions is an HR management platform built for small and medium-sized businesses, provided by Runway CRM Solutions Limited (“Runway”, “we”, “us”, “our”). Our platform helps employers manage things like employee records, absence, performance, onboarding, and documentation in one place.

Because of what our platform does, we handle personal data in two different capacities, and this policy is split accordingly:

• Part A — where we are the data controller. This covers our own website, marketing, sales process, and the account/billing relationship we have with the businesses that subscribe to Runway (“Customers”). We decide why and how this data is processed, so we are directly responsible for it under data protection law.
• Part B — where we are a data processor. This covers the personal data our Customers input into the Runway platform about their own employees, workers, and job applicants (“End Users”). Here, our Customer is the data controller and decides what data to collect and why; we process it only on their instructions, under a Data Processing Agreement (DPA). If you are an employee of a business that uses Runway and you have a question about your own data, you should generally contact your employer first — they control that data and are best placed to answer. Section 8 explains our role in more detail.

This policy is written to reflect UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), which amended parts of the UK's data protection framework with provisions taking effect through February and June 2026.

2. Information we collect

Enquiry and sign-up forms specifically. When you submit any form on our website — whether to ask a question, request a demo, start a free trial, or subscribe to updates — we collect whatever information the form asks for (typically your name, work email, phone number, and company details) so that we can respond to you, set up the trial or demo, and, where you have opted in, follow up with relevant marketing. We do not add you to marketing lists just because you filled in an enquiry or support form unless you have separately opted in, or unless we are following up on that specific enquiry.

We do not intentionally collect special category data (e.g. health, religion, ethnicity) about the individuals in this Part A, other than what you might volunteer to us directly (for example, an accessibility request).

3. Why we use this information and our legal basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms, and concluded it is not — a record of this assessment is available on request.

4. Cookies and similar technologies

Our website and platform use cookies and similar technologies for authentication, essential functionality, analytics, and (where you consent) marketing. Under the Privacy and Electronic Communications Regulations (PECR), as updated by the DUAA, some low-risk cookies used purely for statistical analysis or to remember basic functional preferences may not require consent, but we still give you control over non-essential cookies through our cookie banner. Full detail on the specific cookies we use, their duration, and how to manage your preferences is set out in our Cookie Policy.

5. Who we share this data with

We share personal data covered by this Part A with the following sub-processors and service providers, each of whom only receives the minimum personal data needed to perform their function — we do not deliberately share more personal data with them than that:

We will keep this list up to date as we add or remove tools.

We also share personal data covered by this Part A with:

• Professional advisers (lawyers, accountants, auditors) where necessary.
• Regulators, law enforcement, or courts, where we are legally required to disclose information.
• A buyer, if we sell or reorganise all or part of our business, subject to the same protections in this policy.

We do not sell personal data.

6. International transfers

GitHub, Netlify, Stripe, and Google are all US-headquartered providers and may process personal data on servers located outside the UK, including in the United States. Before any personal data is transferred to them, we rely on a safeguard recognised under UK GDPR, such as the provider's self-certification under the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”), which the UK government has assessed as providing an adequate level of protection, or the UK International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses included in the provider's standard terms.

7. How long we keep this data

We keep personal data covered by this Part A for as long as needed for the purposes it was collected, generally:

• Account and billing data: for the duration of the contract plus 6 years afterwards, to meet standard UK accounting and tax record-keeping obligations (Companies Act 2006 / HMRC requirements).
• Marketing data: until you unsubscribe, or after 24 months of no engagement from you, whichever is sooner.
• Enquiry, demo request, and trial sign-up form data where no paid account is opened: 12 months from your last contact with us, unless you ask us to delete it sooner or opt in to longer-term marketing contact.
• Support communications: 3 years from the last interaction, in line with typical customer service record-keeping practice.
• Recruitment data: 6 months after the recruitment process ends — the period commonly recommended (including by ACAS) to cover the time limit for most UK employment tribunal claims — unless you agree we can keep it for longer.

8. Our role

Our Customers use Runway to manage HR information about their own employees, workers, contractors, and job applicants (End Users). When Runway processes this data, our Customer is the data controller and Runway is the data processor, acting only on the Customer's documented instructions under a written Data Processing Agreement, in line with Article 28 UK GDPR.

This means:

• The Customer decides what personal data to collect about their End Users, why, and for how long — Runway does not set these purposes.
• Runway's own Terms of Service and Data Processing Agreement (DPA) govern exactly how we handle this data on the Customer's behalf, including security measures, sub-processing, breach notification, deletion on termination, and audit rights.
• If you are an End User (e.g. an employee of a Runway Customer) and want to exercise a data protection right, or have a question about how your data is used, you should in the first instance contact your employer, since they control that data. We will support our Customers in responding to such requests as required by our contract with them.

9. Categories of employee data typically processed on the platform

Because Runway is built for HR management, the categories of data our Customers may input can be extensive. Depending on how a Customer configures and uses the platform, this can include:

Special category data. Some of the data above (health data, equal opportunities monitoring, in rare cases trade union membership) is “special category data” under Article 9 UK GDPR, which requires an additional legal condition to process — typically that it is necessary for employment law purposes (Article 9(2)(b), read with Schedule 1 of the Data Protection Act 2018), or explicit consent for optional fields such as diversity monitoring. Our Customers, as controllers, are responsible for identifying and documenting the correct condition; Runway's platform and contractual terms are designed to support this (for example, by allowing special category fields to be optional and access-restricted).

10. Security measures

We apply technical and organisational measures appropriate to the sensitivity of HR data, including: encryption of data in transit (e.g. TLS) and at rest; role-based access controls so that HR data is only visible to authorised users within a Customer's account; multi-factor authentication for staff and administrator access; regular security testing, including penetration testing; confidentiality obligations and data protection training for all staff with access to personal data; and due diligence checks on sub-processors before they are onboarded. Full details are available to Customers on request.

11. Automated decision-making

Runway does not currently make decisions about End Users solely by automated means that produce legal or similarly significant effects (for example, automated decisions to dismiss, discipline, or refuse an application) without human involvement. If this changes — for example, through AI-assisted features — we will ensure appropriate safeguards are in place, including meaningful human review and the ability to contest a decision, and we will update this policy and notify Customers accordingly.

12. Retention and deletion

Data processed on behalf of a Customer is retained for as long as instructed by that Customer, in line with our DPA. On termination of a Customer's contract, we will delete or return the Customer's data within 30 days, except where we are required by law to retain it for longer.

13. Your data protection rights

Subject to certain conditions and exemptions, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data in certain circumstances (“right to be forgotten”).
• Restrict how we use your data.
• Object to processing based on legitimate interests or for direct marketing.
• Data portability — receive your data in a portable format, or have it transferred to another provider, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to decisions based solely on automated processing that significantly affect you, without appropriate safeguards.

To exercise any of these rights in relation to data covered by Part A, contact us using the details in Section 15. In responding, we will carry out reasonable and proportionate searches for your data, in line with the standard introduced by the Data (Use and Access) Act 2025, and will normally respond within one month.

If your query relates to data covered by Part B (i.e. you are an End User of a Customer's account), please contact your employer in the first instance, as they are the data controller for that data.

14. How to complain

If you are unhappy with how we have handled your personal data, please contact us first at hello@runwayhrsolutions.co.uk so we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain directly to the UK's data protection regulator:

15. Contact us

For any question about this policy or how we handle personal data:

16. Children's data

Our platform and website are intended for business use by adults and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

17. Changes to this policy

We may update this policy from time to time, for example to reflect changes in the law, our platform, or our practices. We will post the updated version on our website with a new “last reviewed” date, and where changes are significant, we will take reasonable steps to notify Customers directly.