Privacy Policy

1. Who we are

Renzo is a trading name of Gatenby Technology Group Limited (“Renzo”, “we”, “us”, or “our”), which provides software for HR consultancies. This policy explains how we handle personal information collected through our website, our waitlist form, our founding programme, and the Renzo platform itself when you create an account or subscribe.

For any privacy-related questions, contact us at hello@renzohr.com.

2. What we collect

The information we collect depends on how you interact with us.

When you join the Renzo waitlist

• Your name
• Your email address
• The name of your company
• The date you joined the waitlist

When you applied for the founding programme

In addition to the waitlist details above:

• Your consultancy’s name, website or LinkedIn URL, and size
• The number of Renzo users you anticipated needing
• The kinds of HR work you do and the tools you use
• What you found most frustrating about your day-to-day workflow
• The parts of Renzo you were most interested in trying
• How much time you could give to testing and your preferred check-in format
• Any free-text you chose to add
• A hashed copy of the IP address you submitted from (used only for spam prevention - never stored in raw form, never linked to a login, never shared)

When you create a Renzo account or subscribe

• Your name and email address, and the name of your business
• Your billing address and, if you provide one, your VAT number
• Your subscription details: plan, billing interval, trial dates, and subscription status
• Payment card details are collected and held by Stripe, our payment provider - they never touch Renzo’s servers. We receive confirmation of payment, the card type and last four digits, and your billing address.

When you use the Renzo platform

You use Renzo with your own consultancy and client data. You are the data controller for the personal data of your clients (and their employees, where relevant); Renzo acts as your data processor. That processing is governed by our Data Processing Agreement, which forms part of our Terms of Service. See section 6 below.

When you take part in a referral programme

If you are an existing customer referring a business to us under our customer referral programme:

• The business name, and the first name, last name and business email of the person you are referring
• A record of the referral and that it came from you, so we can credit your reward

If you take part as a partner (introducer) under our partner referral programme:

• Your legal or business name, and your company number and VAT number where you provide them
• Your address, contact name and contact email
• Your bank details (account name, sort code and account number), which we use solely to pay the commission you earn
• A record of your acceptance of the Partner Referral Programme Terms, including the date, time, IP address and browser you accepted from
• The referrals you make and the commission you earn, and the self-billed invoices we raise on your behalf

About a business you refer to us under either programme:

• The business and contact details you give us when you refer them, or that they provide when they sign up
• Where a referral is made through a referral link or code, a record that the sign-up came through that link, so the referral can be attributed

When you refer someone to us, you confirm that you have a lawful basis to share their details with us and, where required, their consent under the Privacy and Electronic Communications Regulations (PECR).

If you have been referred to us, we use the details we hold about you only to set up your account, apply any sign-up discount, and confirm the referral is genuine (see sections 3 and 4). We do not use them to market to you on behalf of the referrer.

We do not collect special-category data through any of our public forms (waitlist, founding application, demo access, signup).

3. How we use your information

We use the information you provide to:

• Provide the Renzo service: create and administer your account and workspace, authenticate you, and deliver the features you use
• Manage your subscription: take payment, issue VAT invoices, administer free trials (including reminding you before a trial ends), and handle billing queries
• Send service communications about your account - for example receipts, renewal and payment notices, security notifications, and material changes to our terms or policies
• Notify you about Renzo and share occasional product updates if you have opted in
• Understand demand and improve the product and roadmap
• Keep the service secure - detect and prevent fraud, abuse, and unauthorised access
• Review founding-programme applications and stay in touch with applicants
• Operate our referral programmes: attribute a referral to the customer or partner who made it, apply any sign-up discount, calculate and pay commission or rewards, and issue self-billed invoices to partners
• Check that a referral is eligible and prevent fraud, self-referral and abuse of the programmes

We will not sell, rent, or share your personal information with third parties for marketing purposes.

4. Lawful basis

Under UK GDPR, we rely on different lawful bases depending on the processing:

• Performance of a contract - creating and running your account, providing the platform, managing your subscription and trial, and taking payment. Without this processing we cannot provide the service.
• Legal obligation - keeping billing, invoicing and VAT records for the periods required by UK tax and accounting law, and complying with other legal duties.
• Legitimate interests - keeping the service secure, preventing fraud and abuse, understanding how the product is used so we can improve it, and communicating with business contacts about the service. We balance these interests against your rights, and you can object at any time (see “Your rights” below).
• Consent - joining the waitlist, receiving marketing updates, and optional analytics cookies. You can withdraw consent at any time.

We also run our customer and partner referral programmes on the basis of our legitimate interests in growing Renzo and rewarding those who recommend us, our legal obligation to keep self-billed invoices and commission records, and - for programme partners - the contract formed when you accept the Partner Referral Programme Terms. Where you share another person’s details with us by referring them, you are responsible for having a lawful basis to do so; we process those details as controller for the purpose of operating the programme.

5. Where we store your data

Renzo’s primary database is hosted on Supabase in the EU-Central region (Frankfurt, Germany), with each consultancy’s data isolated from every other by application-level tenant controls, reinforced by database row-level security. The application itself runs on Vercel, with serverless functions pinned to London (lhr1) so traffic stays in the UK / EU. OAuth tokens for all connected integrations (Microsoft, Google, Dropbox, Xero, QuickBooks) are encrypted at rest with AES-256-GCM before they touch the database.

We rely on the following sub-processors to deliver the service. Each processes a defined slice of data on our behalf under a written data-processing agreement. Some are only used when a consultancy explicitly opts in (e.g. by connecting an integration); those are marked optional.

Where data is transferred outside the UK / EEA, the transfer is covered by the UK International Data Transfer Agreement or Standard Contractual Clauses (SCCs) with our sub-processor. The current sub-processor list is maintained here and customers are notified of any material change.

6. Using the Renzo platform

When you use Renzo, you are the data controller for any personal data of your clients (and their employees) that you enter into the platform. Renzo is the data processor - we hold that data on your behalf, only for the purposes you direct, and only for as long as your subscription continues plus the wind-down period described in our Data Processing Agreement, which mirrors the UK GDPR Article 28 requirements and forms part of our Terms of Service.

While you use the platform we also collect:

• Standard product-usage signals (which features you open, when you log in) so we know what’s landing and what isn’t
• Any feedback you send us in support emails or inside the product
• Authenticated session logs, retained for 30 days, used only for security and incident response

We do not screen-record, key-log, or read your client work content for analytics purposes. AI features (Anthropic) are strictly opt-in per workspace.

Renzo began with a founding programme of HR consultancies who helped shape the product; data collected during that programme is now handled under this policy and the retention periods in section 7.

7. How long we keep it

Waitlist details: until either (a) you unsubscribe, (b) you ask us to delete them, or (c) the Renzo waitlist programme ends - whichever comes first.

Founding-programme application details: up to 12 months after the application window closed, so we can re-contact unsuccessful applicants if a future intake opens. You can ask us to delete your application at any time.

Your account and workspace data: for as long as your subscription (or free trial) remains active. If your subscription ends - because you cancel, or a trial ends without payment - your account is retained so that you can export your data for 30 days, in line with our Data Processing Agreement, and so that you can re-subscribe. After that window we delete workspace data through our soft-deletion and secure-erasure process, unless the law requires us to keep it. Encrypted backups roll off on their normal 90-day cycle.

Billing and VAT records: invoices, payment records and related account information are kept for 6 years after the end of the relevant financial year, as required by UK tax and accounting law, even where the rest of your account has been deleted.

Audit logs: meaningful administrative and data-changing actions are recorded in an append-only log retained for up to 7 years, in line with UK statutory retention for HR-related records.

Referral records: details of a business you refer are kept while they are relevant to operating the programme and to prevent duplicate or fraudulent referrals. If a referred business does not become a customer, you or they can ask us to delete their details at any time.

Partner programme records: if you take part as a partner, we keep your account and contact details for as long as you take part in the programme, and afterwards only as long as needed to pay any commission still owed to you and to meet our legal obligations. Your bank details are held securely, used only to pay your commission, and never shared for marketing; we keep them while you take part and while any commission remains payable, and then delete them. Your self-billed invoices, commission records and your recorded acceptance of the Programme Terms are kept for 6 years after the end of the relevant financial year, as required by UK tax and accounting law and the self-billing arrangement, even where the rest of your details have been deleted.

Authentication logs: 30 days, used only for security and incident response.

8. Cookies & analytics

Our marketing site uses two types of cookies:

• Essential cookies - needed for the site to work and to remember your cookie preference. These are always on.
• Analytics cookies (optional) - if you accept, we load Google Analytics 4 to understand how visitors find and use the site (pages viewed, session duration, referring source, approximate location). We have enabled IP anonymisation, so your full IP address is not stored.

When you first visit, we ask you to accept or decline analytics cookies. We do not load Google Analytics until you accept. You can change your mind at any time: Manage cookie preferences.

We do not use advertising, retargeting or social-media tracking cookies on the marketing site.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information
• Object to processing based on our legitimate interests
• Withdraw your consent and unsubscribe from marketing at any time
• Receive the data you have provided to us in a portable format
• Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk)

Some rights are qualified: where we are required by law to keep records (for example VAT and billing records), we must retain them for the statutory period even if you ask us to delete your other information. For personal data you process about your own clients inside Renzo, you are the controller - their requests are for you to answer, and the platform’s export, correction and deletion tools are there to help you do it.

To exercise any of these rights, email us at hello@renzohr.com. We will respond within 30 days.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of the page reflects the most recent version. Material changes will be communicated by email where possible.

11. Contact us

For questions about this policy or how we handle your data, please contact:

Gatenby Technology Group Limited t/a Renzo
Registered in England & Wales, company no. 17295467
Registered office: 82A James Carter Road, Mildenhall, IP28 7DE
Email: hello@renzohr.com