Privacy Policy
This privacy notice explains how Korza, Inc. ("Korza", "we" or "us") collects and uses personal data about the people who work with us, apply to work with us, deal with us in a business capacity or visit our websites at korza.com and korza.ai. It is written to comply with the United Kingdom General Data Protection Regulation (the "UK GDPR") and the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (the "EU GDPR"), which we refer to together as the "GDPR". Where a part of this notice applies to a particular regime only, we say so. Where the regimes diverge in a way that affects you, we set out both positions.
1. Who we are
Korza, Inc. is a Delaware corporation with its registered office at 116 Spring Street, Los Gatos, California 95030, United States. Korza is the controller of the personal data covered by this notice.
We have appointed Oliver Williams to act as our data protection officer on a voluntary basis. You can contact him by email at the address in section 14 of this notice.
Korza does not yet have an establishment in the United Kingdom or in the European Union. As required by Article 27 of the UK GDPR and Article 27 of the EU GDPR, we have appointed Prighter Group as our representative in both the United Kingdom and the European Union. Its contact details appear in section 14. You may raise any matter concerning our processing of your personal data with our representative, as well as with us directly.
2. The people this notice covers
This notice covers four groups of people:
Our workforce. We employ or engage staff in the United States, Brazil, India and the United Kingdom. We process personal data about our employees and contractors so that we can operate the working relationship, pay them and meet our legal obligations.
People who apply to work with us. We process personal data about applicants for the purposes of recruitment and assessment.
Business development contacts. We hold limited business contact information for people in the United Kingdom and the European Union whom we approach about our services. The contact data we hold is ad hoc and the lists are maintained manually. We do not operate an automated marketing platform.
Visitors to korza.com and korza.ai. We process limited data about the people who visit our website.
This notice does not cover personal data we process on behalf of our customers in the course of providing our services. That processing is governed by the data processing agreements we hold with each customer, and not by this notice.
3. The personal data we collect
For our workforce, we process the categories of personal data necessary to operate the employment or contractor relationship. These include identification and contact details, immigration and right-to-work information, tax and payroll details, bank account details for payment, role, performance and absence information, and security information needed to administer our systems.
For applicants, we process the personal data contained in your application, including identification and contact details, your curriculum vitae, the record of any interviews or assessments, and references where we take them.
For business development contacts, we process limited contact information, typically your name, title, employer, business email address and, where you have shared it with us or it is in the public domain, your business telephone number. We also process notes of any prior contact we have had with you.
For visitors to korza.com and korza.ai, we process technical data including IP address, browser and device information, the pages you visit and how you interact with them, and any information you submit through a form on the site, including any contact form or enquiry. Where you accept analytics or marketing cookies through our cookie banner, we also process the data those cookies generate.
We collect most personal data directly from the person it relates to. Where we obtain personal data from another source, for example a third-party recruitment platform, a referee or a public business directory, we tell you the source when we first communicate with you.
4. How and why we use your personal data
The table below sets out the purposes for which we process personal data and our lawful basis for each.
| Purpose | Lawful basis | Details |
|---|---|---|
| Employing and managing our workforce | Performance of your contract of employment (Article 6(1)(b)); compliance with our legal obligations (Article 6(1)(c)) for tax, payroll and statutory reporting; legitimate interests (Article 6(1)(f)) for HR record-keeping after departure and for the security of our systems | We process employee personal data to operate the employment relationship, pay you, comply with employment, tax and immigration law, manage absence and performance, and maintain proportionate records once you leave. |
| Engaging and paying contractors | Performance of the contract for services (Article 6(1)(b)); legal obligations for tax and reporting (Article 6(1)(c)) | We process contractor data to perform the contract, settle invoices and meet reporting obligations. |
| Recruitment and assessment of applicants | Our legitimate interests in assessing suitability for the role (Article 6(1)(f)); consent (Article 6(1)(a)) where you ask us to retain your data after a particular recruitment process ends | We process applicant data to evaluate applications, conduct interviews and make hiring decisions. Where we hold an application for future opportunities, we do so with your consent. |
| Business development and outbound contact | Our legitimate interests in identifying and approaching prospective business contacts (Article 6(1)(f)) | We process limited business contact data to send tailored outbound communications about our services. You may object at any time and we will stop. |
| Operating and securing korza.com and korza.ai | Our legitimate interests in operating, securing and improving the website (Article 6(1)(f)); consent (Article 6(1)(a)) for any non-essential cookies and analytics, where required | We process visitor data to run the site, prevent abuse, measure performance and improve our content. Where cookies require consent, our cookie banner records your choice. |
| Complying with our legal and regulatory obligations | Compliance with our legal obligations (Article 6(1)(c)); our legitimate interests in defending claims (Article 6(1)(f)) | We process personal data where the law requires it, including responding to lawful requests from regulators and courts, and where we need to establish, exercise or defend legal claims. |
Where we rely on legitimate interests, we have considered the impact of the processing on you and concluded that those interests are not overridden by your interests or fundamental rights. You can ask us for further information about that assessment by contacting us at the address in section 14.
We do not process special category personal data under Article 9 of the GDPR on a routine basis. Where we do process it, for example to support a workforce request relating to health or to make a reasonable adjustment, we will rely on a condition in Article 9(2) and tell you which one.
5. Who we share your personal data with
We share personal data with the providers and service partners we use to run our business. Each of them is subject to a written contract that meets the requirements of Article 28 of the GDPR. They process personal data only on our instructions and may not use it for their own purposes.
| Recipient | Service |
|---|---|
| Google LLC (Google Workspace) | Email, calendar, document collaboration and storage. |
| Microsoft Corporation (Microsoft 365) | Office productivity, email, document storage and collaboration. |
| Slack Technologies, LLC | Internal messaging and collaboration. |
| Notion Labs, Inc. | Internal knowledge base and collaboration. |
| Atlassian Pty Ltd (Jira) | Issue tracking and project management. |
| Linear Orbit, Inc. (Linear) | Engineering project management. |
| Rillet, Inc. | Accounting and financial records. |
| Anthropic, PBC (Claude Enterprise) | AI assistant for internal productivity. We do not allow Anthropic to train its models on our data under the Enterprise terms. |
| Rippling People Center Inc. (Rippling) | Payroll, HRIS and employer-of-record services for our US and Brazil workforce. |
| Ramp Business Corporation (Ramp) | Corporate card and expense management. |
| Employtech Center India Private Limited | Employer-of-record services for our India workforce. |
| Checkr | Employee and pre-employment background screening. We provide identity details for applicants and new joiners so that Checkr can carry out the checks and return the results to us. |
| Prighter | Our appointed representative under Article 27 of the UK GDPR and the EU GDPR, as described in section 14. Prighter receives any request or correspondence that a data subject or a supervisory authority addresses to our representative and passes it to us. |
| Vanta | Security compliance monitoring. Vanta receives workforce account, device and training records from our other systems so that we can evidence our security controls. |
We may also share personal data with our professional advisers, including lawyers, accountants and auditors, where this is necessary to obtain advice or to demonstrate compliance. We will share personal data with regulators, courts and law enforcement bodies where we are required by law to do so. If we sell or restructure our business, we may share personal data with potential purchasers and their advisers, subject to confidentiality protections.
6. International transfers
Korza is a United States company with workforce in the United States, Brazil, India and the United Kingdom. Personal data is processed in those countries and shared with the service providers listed in section 5, several of which are also located in the United States or operate global infrastructure.
Where we transfer personal data from the United Kingdom or the European Economic Area to a country that has not received an adequacy decision, we put in place a recognised transfer mechanism. We rely on the United Kingdom International Data Transfer Agreement, or the United Kingdom Addendum to the European Commission’s standard contractual clauses, for transfers from the United Kingdom. We rely on the European Commission’s standard contractual clauses adopted by Implementing Decision (EU) 2021/914 for transfers from the European Economic Area. The European Commission’s renewed adequacy decision of 19 December 2025, which is valid until 27 December 2031, allows personal data to move freely between the European Economic Area and the United Kingdom.
For transfers from the United Kingdom and the European Economic Area to India, we have carried out a transfer impact assessment that considers the law and practice of the destination and the supplementary measures we apply. You can request a summary of that assessment from the contact in section 14.
For transfers to Brazil, where we use Rippling to support our Brazilian workforce, we rely on the United Kingdom IDTA or Addendum, and on the European Commission’s standard contractual clauses, as the case may be. We monitor the status of any future adequacy assessment of Brazil and will tell you if we change the mechanism on which we rely.
For transfers to the United States, we rely on the standard contractual clauses or the United Kingdom IDTA or Addendum, as the case may be. We monitor the status of the EU-US Data Privacy Framework and the United Kingdom extension to it, and we will tell you if we change the mechanism on which we rely.
7. How long we keep your personal data
We keep personal data only for as long as we need it for the purpose for which we collected it, together with any further period required for legal, regulatory, tax or accounting reasons or for the establishment, exercise or defence of legal claims. The table below sets out our retention positions by category.
| Category | Retention |
|---|---|
| Employee records (UK employee) | Duration of employment plus seven years from the end of the employment relationship, to meet statutory limitation, tax and pension obligations. |
| Contractor records | Duration of the engagement plus six years for tax, accounting and limitation purposes. |
| Recruitment records | Six months from the conclusion of the recruitment process, unless you consent to a longer period. Successful applicants’ records transfer to the employee file. |
| Business development contact records | Until you object to processing or ask us to remove your details, or until our records show no engagement for two years and we refresh the list. |
| Website analytics | Thirteen months from collection, after which the data is aggregated or deleted. |
| Records held for legal or regulatory reasons | For the period necessary to comply with the relevant obligation, defend the relevant claim or respond to the relevant request. |
When the retention period ends, we delete the relevant personal data or anonymise it so that it can no longer be linked to you.
8. How we keep your personal data secure
We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, encryption in transit and at rest where appropriate, role-based access, multi-factor authentication, logging and monitoring, regular review of our security posture and contracts with our processors that require them to apply equivalent measures.
9. Your rights
You have the rights set out in the table below in relation to your personal data. The way you exercise the rights, and the limits that apply, depend on which regime governs the processing and on the circumstances. We will respond to your request within one month, although we may extend that period by a further two months where the request is complex or where we have received a number of requests from you.
| Right | What it means |
|---|---|
| Access | You may ask us to confirm whether we process your personal data and, if we do, to provide you with a copy of that data and certain information about how we use it. |
| Rectification | You may ask us to correct inaccurate personal data or to complete incomplete personal data we hold about you. |
| Erasure | You may ask us to delete your personal data in certain circumstances, including where we no longer need it for the purpose for which we collected it or where you have validly objected to the processing. |
| Restriction | You may ask us to restrict our processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have challenged. |
| Portability | Where we process your personal data by automated means under your consent or to perform a contract with you, you may ask us to provide it to you, or transmit it to another controller, in a structured, commonly used and machine-readable format. |
| Withdraw consent | Where we rely on your consent to process your personal data, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew it. |
| Complain to a supervisory authority | You may complain to a data protection supervisory authority. The relevant authorities are listed in section 13 of this notice. |
Your right to object
You have the right to object to our processing of your personal data where we rely on our legitimate interests as the lawful basis. This includes objecting to processing for direct marketing, in which case we will stop. Article 21 of the GDPR requires us to bring this right specifically to your attention, separately from the other rights. To exercise it, contact us using the details in section 14.
10. Automated decision-making
We do not take decisions about you that produce legal effects, or other similarly significant effects, by purely automated means. We do not carry out profiling that produces those effects. If that changes, we will update this notice and tell you about the change.
11. Whether you must provide personal data
Most of the personal data we ask for is needed because of a contractual or statutory requirement. If you do not provide personal data we need to operate your employment, engagement or application, we may not be able to take the relevant step. Where you are free to choose whether to give us personal data, for example by completing an optional field on a form on the site, we will say so.
12. Cookies
Our website uses cookies and similar technologies. The cookie banner that appears when you first visit the site explains the categories we use, allows you to accept or reject non-essential cookies and records your preference. You can change your preference at any time through the cookie banner. Strictly necessary cookies do not require your consent and cannot be switched off in our systems.
13. Supervisory authorities
You have the right to complain to a supervisory authority if you believe that our processing of your personal data infringes the GDPR.
In the United Kingdom, the supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. The ICO’s website is at ico.org.uk.
In the European Union, you may complain to the supervisory authority of the European Union member state in which you live, work or believe the alleged infringement took place. We do not have an establishment in the European Union, so the one-stop-shop mechanism does not apply and there is no single lead authority for our processing. Our representative under Article 27, Prighter Group, will provide a contact point for supervisory authorities and for data subjects.
14. How to contact us
If you have a question about this notice or about how we process your personal data, or if you want to exercise a right under the GDPR, please contact us:
Korza, Inc., 116 Spring Street, Los Gatos, California 95030, United States.
Data protection officer: Oliver Williams, privacy@korza.com.
Representative under Article 27 of the UK GDPR and Article 27 of the EU GDPR: Prighter Group, acting through its local partners, is our appointed representative for the United Kingdom and the European Union. You can contact our representative, or exercise any of the rights described in section 9, at https://app.prighter.com/portal/11411743864.
15. Changes to this notice
We will update this notice from time to time. The version number and date at the top of the notice tell you when we last did so. Where the change is material, we will draw your attention to it in advance through the channel by which you usually deal with us, including by posting a notice on korza.com and korza.ai.