Privacy Policy

Last updated: 29 September 2026

This Privacy Policy explains how Oleh Yevhenovych Havryliuk, a sole proprietor registered in Ukraine (“Recnice”, “we” or “us”), handles personal data in connection with the Recnice website and employee recognition software (together, the “Service”). Contact us at contact@recnice.com.

This notice describes our practices in our own capacity and, at a high level, our processing on behalf of organizations using Recnice (“Customers”). It does not replace the privacy notices that Customers must give to their employees or other people whose data they upload. Applicable rights and requirements depend on the relevant law and the circumstances of processing.

1. Who decides how data is used

For personal data that a Customer enters, imports or generates in its workspace for its recognition program, including employee profiles, kudos, rewards, surveys, challenges and related activity (“Customer Data”), the Customer generally determines the purposes and essential means of processing and acts as the controller or equivalent responsible organization. We generally act as its processor or service provider, processing Customer Data to provide the Service under the Customer's documented instructions and any applicable data processing agreement (“DPA”). The Customer decides which people are included, what information it collects, who has access, and how it uses insights or outputs.

We act as a controller or equivalent for data we use for our own purposes, such as website inquiries, customer contacts, account and service administration, security, billing records where applicable, and our own communications. Roles may differ for a specific activity under the relevant law or Customer Agreement.

2. Data we handle and where it comes from

Depending on how the Service is used, we may handle names, business contact details, job and organization information, account identifiers, authentication and access records, Customer-submitted recognition messages, participation and reward records, support correspondence, and other information a Customer or user supplies within the Service. Customers and authorized users provide or generate most Customer Data; identity providers or integrations connected by the Customer may also supply account information.

When a person visits our website or uses the Service, we may receive technical and usage information such as IP address, device and browser details, timestamps, diagnostic logs and interactions needed for operation and security. Cookies or similar technologies may store preferences or support authentication and, if enabled and permitted, measurement. We may receive contact and business information when someone requests a demonstration, writes to us or communicates about a Customer account. We do not ask users to submit sensitive personal data unless the Customer has separately determined it is necessary and lawful for its use of the Service.

3. Purposes and legal bases

As a processor, we use Customer Data to operate, host, secure, support and maintain the Service, deliver features selected by the Customer, troubleshoot issues, and carry out documented Customer instructions. We do not use employee Customer Data for our own direct marketing, targeted advertising or independent employee profiling. If the Customer enables analytics or AI-assisted summaries, we process the relevant Customer Data to provide that feature on its instructions. The Customer determines the appropriate lawful basis for its processing and must assess its use of those features, including any employment or automated-decision rules that apply. Recnice does not itself make employment decisions about individuals.

For processing where we act as a controller and EU or UK data protection law applies, our legal bases depend on the activity: performance of a contract or steps requested before entering one (account administration and requested services); legitimate interests, balanced against individuals' rights (service security, fraud prevention, support, and improving the Service using information we control); compliance with legal duties (such as accounting and responding to lawful requests); and consent where required (such as certain optional cookies or marketing). We do not treat acceptance of this policy as consent to all processing. A person may withdraw consent where processing relies on it, without affecting earlier lawful processing.

We use aggregated or de-identified information for internal operations and service improvement only if it no longer identifies an individual under applicable law; if it can identify a person, we treat it as personal data.

4. Cookies and communications

Some cookies and local storage are needed to provide requested functionality, such as authentication, security and saved settings. Optional analytics or similar tracking, if used, is subject to the choices and notices required in the visitor's location. Where consent is required, we request it before setting non-essential technologies and provide a way to change the choice. Browser settings may also limit storage, although some features then may not function. The cookie notice or consent interface describes any optional tools deployed on the website.

We may send service and account messages needed to administer the Service. We send promotional messages in accordance with applicable marketing law and any required consent or opt-out rules. Promotional messages provide a way to unsubscribe. Unsubscribing does not prevent essential service or transactional messages. We retain a minimal suppression or consent record where needed to honor preferences and demonstrate compliance.

5. Sharing and service providers

We may share personal data with authorized personnel and contracted providers that support hosting, communications, customer support, security, integrations or other functions necessary to provide the Service. They are given access only for relevant purposes and are subject to appropriate contractual and security requirements. Where an optional Customer feature uses another provider, the Customer's configuration and applicable DPA govern that processing. The Customer may make Customer Data visible to its own administrators and users according to its chosen permissions.

We may disclose information where required by a valid legal obligation or where reasonably necessary to protect rights, safety or security, in each case subject to applicable law and our duties to Customers. If the business is reorganized or transferred, information may be transferred as permitted by law and applicable agreements. We do not grant third parties a general right to use Customer Data for their own advertising. Customers can contact us for information about material subprocessors and relevant processing locations.

6. International processing and transfers

We are based in Ukraine, and providers or authorized personnel supporting the Service may be located in other countries. The location of storage and access depends on the Customer's configuration and the providers used. When applicable EU, UK or other law restricts an international transfer, we use a valid transfer mechanism and any required supplementary measures, such as an applicable adequacy decision or appropriate contractual safeguards. A person's use of the Service or acceptance of this policy alone is not the legal basis for a restricted transfer. Contact us for information about safeguards relevant to your data. Customer-specific transfer arrangements are addressed in the applicable DPA.

7. Retention and deletion

For Customer Data, retention is generally determined by the Customer and the applicable agreement. We retain it while needed to provide the Service and then return or delete it as agreed, subject to backup cycles, legal duties and any lawful, documented exceptions. Customers can manage their users and data through the Service or request assistance under their agreement. A user's inactivity does not, by itself, mean that all data in the Customer's workspace will be deleted after a fixed period.

For data we control, we retain it only as long as needed for the purposes described here: for example, while a business relationship or inquiry remains active, for a reasonable period to resolve support or security issues, and for the period required by accounting, tax or other law. Where exact periods depend on context, we apply these criteria, review retention and delete or de-identify data when it is no longer needed. Logs and backups may persist for limited operational periods under applicable schedules.

8. Security

We use technical and organizational measures appropriate to the nature of the information and the risks of processing, including controls over access, authentication, and protection of systems and data in transit where applicable. No service can guarantee absolute security. If you suspect unauthorized access to an account, notify the Customer administrator and contact@recnice.com promptly. Our breach-response obligations to Customers and affected individuals are governed by applicable law and the DPA.

9. Your privacy rights

Depending on the law that applies and our role, you may have rights to receive information about processing, access or correct personal data, request deletion or restriction, object to certain processing, receive portable data, withdraw consent where relevant, and complain to a competent supervisory authority. Some laws also provide rights concerning sale or sharing of data, targeted advertising, or certain automated decisions. These rights are subject to legal conditions and exceptions; we will not discriminate against a person for exercising a right where the law prohibits it.

Send requests to contact@recnice.com. We may verify identity before acting. Where a request concerns Customer Data that we process for a Customer, we will direct it to that Customer or assist the Customer in responding, as required by law and the DPA. You may also contact your employer or organization directly. We respond within applicable legal time limits, including any permitted extensions, and explain if we cannot fulfill a request. Individuals in the EU or UK may complain to their competent data protection authority where the relevant law applies.

10. Children and third-party sites

The Service is intended for use by organizations and their authorized personnel, not for children to use independently. Customers should not submit children's personal data unless they have a lawful basis and an appropriate agreement with us. If you believe such data has been submitted improperly, contact us. Links to external sites or services are governed by those providers' own notices and terms.

11. Updates and contact

We may update this policy to reflect changes in the Service, our processing or applicable law. We will post the updated text and revision date and provide additional notice where required. Material changes to how we use data for our own purposes will not be applied retroactively without any notice or legal basis required by law.

For privacy questions or rights requests, contact Oleh Havrylyuk (Recnice) at contact@recnice.com.