This policy explains what personal data Goalz.Work collects, why we collect it, how long we keep it, and the rights you have over it. It covers our websites, our sales process, and the Goalz.Work platform itself.
Who we are
Goalz.Work is a business software platform operated as a product of Carmatec. Where this policy refers to "we" or "us", it means the entity operating Goalz.Work as named in your contract or order form.
If you are a prospective or current customer, or a visitor to our website, we are the data controller for the personal data described in this policy. If you are an employee of an organisation that uses Goalz, that organisation is the controller of your data in the platform and we act as its processor.
What personal data we collect
We collect three broadly different categories of data, for different reasons and on different legal bases.
Why we use it and on what basis
We use personal data only for the purposes set out below. Where the legal basis is legitimate interests, we have assessed that our interest does not override your rights.
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the platform | Account and platform data | Performance of a contract |
| Support and troubleshooting | Account data, limited platform data | Performance of a contract |
| Billing and collection | Billing contact and payment records | Performance of a contract |
| Security and abuse prevention | Access logs, IP address, audit records | Legitimate interests |
| Responding to enquiries | Form submissions | Legitimate interests |
| Product improvement | Aggregated, de-identified usage statistics | Legitimate interests |
| Marketing emails | Work email and company | Consent, withdrawable at any time |
| Legal and tax compliance | Billing and contractual records | Legal obligation |
Productivity data and profiling
The platform records work-related information about individual employees on behalf of our customers, and computes productivity scores from it using weightings the customer configures. This is a form of profiling, and we treat it seriously.
These outputs are decision support, not automated decision-making. Every score in the product expands to show the factors and weights that produced it, so it can be examined and challenged by the person it describes. Hours only count toward a score once a manager has explicitly approved them, and that approval is attributed and timestamped.
Our customers, as controllers, are responsible for informing their employees that this measurement takes place, for establishing a lawful basis for it, and for ensuring a human reviews any consequential employment decision. We do not use customer employee data to build profiles for our own purposes.
International transfers
Depending on your hosting region, data may be processed in a country other than the one you operate in. Where that involves a transfer out of a region with restrictions on international transfer, we rely on an approved transfer mechanism such as standard contractual clauses, together with technical safeguards.
Enterprise customers can specify a hosting region contractually. If region is a requirement for you, raise it before signing rather than after.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as long as we are required to keep it by law.
How we protect it
We apply technical and organisational measures appropriate to the sensitivity of the data: tenant isolation between customers, role-based access control down to the menu level, encryption of data in transit, restricted internal access on a need-to-know basis, and audit logging of permission and approval changes.
No system is absolutely secure. If a breach occurs that is likely to result in a risk to individuals, we will notify affected customers without undue delay and support them in meeting their own notification obligations.
Your rights
Subject to your jurisdiction, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where consent is the basis.
Children
The platform is business software sold to organisations and is not intended for anyone below the legal working age in their jurisdiction. We do not knowingly collect data from children, and customers must not create user accounts for them.
Data processing agreements
Customers who need a data processing agreement, a record of our sub-processors, or documentation for a security review can request these from privacy@goalz.work. We treat this as a normal part of the buying process rather than an exception.
Changes to this policy
We will update this policy as the product and the law change. Where a change materially affects how we handle personal data, we will notify customers by email or in-product before it takes effect, and the version number and date at the top of this page will change.
For data protection questions, access requests, or to request a data processing agreement, write to privacy@goalz.work. For contractual matters see the Terms of Service, or reach us through the contact page.