About Us and This Policy

This Privacy Policy is issued by ME24 Limited (company number 16701491), trading as “Areela” (“we”, “us” or “our”). Our registered office is Springfield House, Springfield Road, Horsham, England, RH12 2RG. We are registered with the Information Commissioner’s Office (“ICO”) under registration number ZC069669. ME24 Limited is the data controller for the corporate processing described in this Policy. For corporate privacy enquiries and rights requests, please contact support@areela.com or, pending confirmation of a corporate-specific address, support@areela.com.

Scope and Data Subjects

This Policy applies to personal data processed by ME24 Limited in connection with its corporate activities. It does not cover personal data processed through the Areela Platform or the Areela mobile applications, which is addressed in the Privacy Notice - Trainer and Business Users (Document 1) and the Privacy Notice - End Users (Document 2). Employees and workers: identity and contact details, home address, date of birth, National Insurance number, bank and payment details, emergency contact, employment history, qualifications, performance, absence, health, disciplinary and grievance records, IT usage and access logs, and photographs. Contractors and consultants: name, contact details, company and registration details, bank and payment details, project and engagement records, IR35 assessment data, and invoices. Suppliers and business contacts: name, job title, company name, business contact details, contract and purchase order records, and payment and invoicing records. Website visitors to areela.com: IP address, browser and device information, operating system, screen resolution, pages visited, time spent on pages, referring URL, cookies and similar technologies. Job applicants and recruitment candidates: name, contact details, CV and application data, interview notes and assessments, references, right-to-work documentation, and voluntary diversity-monitoring data where collected. Corporate contacts and enquirers, including directors, officers and shareholders where relevant: name, email address, telephone number, company, and the nature and content of the enquiry.

Purposes and Lawful Bases

Employment administration, including onboarding, contracts, day-to-day management and offboarding, is carried out on the basis that processing is necessary for the performance of a contract (Article 6(1)(b)). Payroll, benefits, pensions, tax administration, health and safety and other employment-law requirements may additionally rely on legal obligation (Article 6(1)(c)). Supplier and contractor management, procurement, engagement administration and payment processing rely on performance of a contract (Article 6(1)(b)) and, where appropriate, our legitimate interests in managing suppliers, contractors and business operations (Article 6(1)(f)). Website operation, security, analytics and improvement rely on our legitimate interests (Article 6(1)(f)) where appropriate. Non-essential cookies and similar technologies are used only with consent (Article 6(1)(a)) in accordance with the Cookie Policy. Recruitment and selection rely on our legitimate interests in evaluating candidates (Article 6(1)(f)). Consent (Article 6(1)(a)) is used where required for voluntary diversity monitoring or to retain an unsuccessful candidate in a talent pool. We also process personal data for legal and regulatory compliance, dispute resolution, legal claims, insurance and risk management, and corporate communications on the basis of legal obligation (Article 6(1)(c)) and/or legitimate interests (Article 6(1)(f)), as applicable. Where health or other special category data is processed, we rely on the applicable Article 9 condition, which may include employment, social security and social protection law or explicit consent. We will use clear opt-in consent where consent is relied upon and retain evidence of that consent.

How We Collect Personal Data

We collect personal data directly from individuals, through employment and supplier relationships, through recruitment processes, through enquiries and forms, automatically through areela.com and its cookies, and from third parties such as referees, recruitment agencies, insurers, professional advisers, public authorities and suppliers where permitted by law.

Recipients and Service Providers

We may share personal data on a need-to-know basis with ME24 Limited directors, managers and authorised personnel; HM Revenue & Customs; pension providers; insurers; legal advisers, auditors, accountants and other professional advisers; recruitment agencies; payroll and HR platform providers; IT, cloud hosting, communications and security providers; regulators and law enforcement authorities; and other recipients where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal data. Where a service provider processes personal data on our behalf, we require appropriate contractual confidentiality, security and data-processing protections in accordance with Article 28 of the UK GDPR.

International Transfers

Some corporate service providers may process personal data in the United States or elsewhere outside the UK and EEA, including Slack Technologies, LLC, GitHub, Inc., Not Just Tickets Ltd (Plain) and certain Google services. Where required, ME24 Limited relies on an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard under Articles 46–49 of the UK GDPR.

Retention

Our standard retention periods are: employment, payroll, tax and National Insurance records: generally six years after employment ends; pension records: for the life of the scheme plus 15 years where applicable; health and occupational-health records: for the duration of employment plus six years unless a longer statutory period applies; unsuccessful recruitment records: six months after the recruitment process, unless the candidate consents to longer talent-pool retention; supplier and contractor records: generally seven years after the contract ends; website analytics and cookie data: in accordance with the Cookie Policy and the applicable settings; and corporate enquiries: generally two years after the last contact. When personal data is no longer required, it is securely deleted or anonymised. We may retain information for longer where necessary to comply with law or establish, exercise or defend legal claims.

Your Data Protection Rights

Subject to applicable exceptions, you may request access to your personal data; rectification of inaccurate or incomplete data; erasure; restriction of processing; data portability where the conditions are met; and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects; ME24 Limited does not currently make decisions of that kind in its corporate activities. To exercise your rights, contact support@areela.com. We will respond without undue delay and, in any event, within one month, subject to any lawful extension for complex or numerous requests.

Complaints to the ICO

If you are dissatisfied with how we handle your personal data, you may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, at ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concerns first.

Cookies and Website Tracking

Our website at areela.com uses cookies and similar technologies. Please refer to the Cookie Policy and Cookie/Tracking Notice (Document 3 of this suite), available at areela.com/legal, for details of the cookies we use, their purposes and how to manage preferences.

Security

We maintain appropriate technical and organisational measures, including encryption in transit and at rest, access controls, authentication, security assessments, incident response procedures and staff training. Further details are set out in Document 6A (Security and Incident Response Policy: Internal) and Document 6B (Security and Incident Response Policy: External Customer Summary).

Changes and Version Control

We may update this Policy to reflect changes in our processing activities, legal requirements or business practices. The current version will be available at areela.com/legal. Where we make material changes, we will provide at least 30 days’ advance notice by: (a) displaying a prominent notice on the Platform; (b) sending an email to the address associated with your account; or (c) both. Material changes include changes that affect: your rights and obligations; how your personal data is processed; the scope of services or features available to you; or any other matter that could reasonably be expected to affect your use of the Platform.

Contact Us

Company: ME24 Limited (company number 16701491), trading as Areela (areela.com). Registered office: Springfield House, Springfield Road, Horsham, England, RH12 2RG. ICO registration: ZC069669. Privacy contact: support@areela.com