legal
Data Privacy Policy
Last updated 27 October 2026
1. Important information
1.1 This Data Privacy Policy explains how Seven20 collects, uses, stores, shares and protects personal data in connection with its website, products, services, communications and business operations.
​
1.2 It is intended to provide transparent information to website users, customers, users of Seven20’s products, prospects, suppliers, candidates, and other individuals whose personal data may be processed by Seven20.
​
1.3 This policy should be read alongside any specific privacy notice, cookie notice, contract terms or product-specific notice that may apply in your particular circumstances. Section 15 explains how Seven20 handles data received from Google APIs.
2. Who Seven20 is
2.1 In this policy, Seven20, we and us mean Seven20.io Ltd, a company incorporated in England and Wales with company number 11629733, whose registered office is at Unit 208, The Vanilla Factory, 39 Fleet Street, Liverpool, L1 4AR. Seven20 is registered with the Information Commissioner’s Office under registration number ZA793957.
​
2.2 Seven20 is the controller of personal data processed in connection with its website and related business activities where Seven20 determines the purposes and means of processing.
​
2.3 Questions about this policy or about Seven20’s privacy practices should be directed to Seven20’s data protection lead at dpo@seven20.io, or by post to the registered office above.
​
2.4 Seven20 has appointed EU Rep as its representative in the European Union under Article 27 of the EU GDPR. EU Rep can be contacted at 26 Pembroke Street Upper, Dublin 2, Ireland, or at info@eurep.ie. Individuals in the European Economic Area and supervisory authorities may contact EU Rep, or Seven20’s data protection lead directly at dpo@seven20.io.
​
2.5 Seven20 keeps this policy under regular review and may update it from time to time to reflect legal, operational, technical or organisational changes. The date at the top of this policy shows when it was last updated.
3. Our products and customer data
3.1 Seven20 provides Salesforce-based recruitment software and related products to business customers. When a customer or its users put personal data into Seven20’s products, the customer is the controller of that data and Seven20 processes it on the customer’s behalf as a processor, under the customer’s agreement with Seven20 and Seven20’s Data Processing Addendum.
3.2 If your personal data is held in a Seven20 customer’s system, for example because you are a candidate, client contact or employee of that customer, please contact that customer about how your data is used and to exercise your rights. Seven20 will help its customers respond to such requests as required by its contracts with them.
4. What personal data Seven20 collects
4.1 Depending on the nature of the relationship with the individual, Seven20 may collect and process categories of personal data including identity data, contact data, financial data, transaction data, technical data, profile data, usage data, marketing and communications data, and other information voluntarily submitted through forms, enquiries, recruitment activity, account creation, or service use.
4.2 Seven20 may also create or use aggregated and anonymised information for statistical, analytical, service improvement, capacity planning, security monitoring, or reporting purposes where that information does not identify an individual.
4.3 Where Seven20 processes special category data or criminal offence data for its own recruitment purposes, it will do so only where a condition under Article 9 or Article 10 of the UK GDPR and, where required, Schedule 1 to the Data Protection Act 2018 applies, and with additional safeguards appropriate to the sensitivity and risk of that processing.
5. How personal data is collected
5.1 Personal data may be collected directly from individuals when they contact Seven20, complete forms, create accounts, use services, request information, subscribe to updates, purchase services, apply for roles, or otherwise interact with the organisation.
5.2 Seven20 may also collect technical and usage information automatically through website technologies such as cookies, logs, analytics tools, security monitoring tools and similar technologies, subject to applicable transparency and consent requirements.
5.3 In addition, Seven20 may receive personal data from third parties such as analytics providers, advertising networks, search information providers, payment providers, technical service providers, public registers, recruitment partners, business partners, or other lawful sources.
6. How Seven20 uses personal data
6.1 Seven20 will only use personal data where there is a lawful basis to do so. Depending on the circumstances, this may include performance of a contract, compliance with a legal obligation, legitimate interests, consent, or another lawful basis permitted by applicable law.
6.2 Personal data may be used to provide services, manage accounts, respond to enquiries, administer contracts, process payments, deliver support, improve website functionality, maintain security, prevent fraud, analyse service performance, manage recruitment, send service communications, comply with legal obligations, and, where permitted, send marketing communications.
6.3 Where Seven20 relies on legitimate interests, it first carries out a legitimate interests assessment to weigh its interests against the impact on individuals, and will not rely on that basis where individuals’ rights and freedoms override those interests.
6.4 Where consent is required, such as for certain cookies or certain direct marketing activities, Seven20 will seek that consent and provide a means to withdraw it.
7. Marketing and cookies
7.1 Seven20 may use personal data to send information about services, updates, events or other content that may be relevant to the recipient, subject to applicable electronic marketing rules and opt-out rights.
7.2 Individuals can opt out of marketing communications at any time using unsubscribe options or by contacting Seven20 directly.
7.3 Seven20’s website may use cookies and similar technologies for functionality, analytics, security and, where relevant, preference or marketing purposes. Where required by law, cookie choices will be managed through an appropriate consent mechanism and supported by a separate cookie notice or cookie settings tool.
8. Disclosure of personal data
8.1 Seven20 may share personal data with employees, contractors, professional advisers, auditors, insurers, technology and hosting providers, analytics providers, payment providers, recruitment or communications providers, regulators, law enforcement bodies, and other third parties where disclosure is necessary, proportionate and lawful.
8.2 Where third-party service providers process personal data on Seven20’s behalf, Seven20 will require them to act only on documented instructions, apply appropriate confidentiality and security controls, and meet contractual data protection obligations.
8.3 Personal data may also be disclosed in connection with a business sale, merger, acquisition, restructure, investment transaction, legal claim, or regulatory requirement where such disclosure islawful and necessary. Data received from Google APIs is subject to the additional restrictions in section 15.
9.1 Where personal data is transferred outside the UK or outside the EEA, Seven20 will ensure that an appropriate safeguard is in place, such as an adequacy decision, approved contractual clauses, binding corporate rules, or another lawful transfer mechanism recognised under applicable law.
9.2 Seven20 will assess international transfers where required and implement supplementary measures where necessary to ensure that transferred personal data continues to receive a level of protection essentially equivalent to that required under applicable data protection law.
9. International transfers
10. Data security and technical measures 1
0.1 Seven20 applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or inappropriate forms of processing.
10.2 These measures include governance controls, role-based access controls, authentication measures, least-privilege access, secure configuration, patching, endpoint protection, logging and monitoring, encryption where appropriate, secure backup, resilience arrangements, incident management, supplier assurance, and confidentiality obligations.
10.3 Seven20 is certified to ISO/IEC 27001:2022. Its information security management system includes controls relating to information security policies, legal and regulatory compliance, privacy and protection of personally identifiable information, information classification, deletion, masking, and leakage prevention.
11. Data retention
11.1 Seven20 will retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, tax, accounting, contractual, security and disputemanagement requirements.
11.2 Retention periods may vary depending on the type of data, the purpose of processing, the sensitivity of the information, and the applicable legal or operational obligations. Where data is no longer required, it will be securely deleted, anonymised or destroyed. Retention of data received from Google APIs is described in section 15.
12. Data subject rights
12.1 Subject to applicable law, individuals may have rights to request access to their personal data, rectification, erasure, restriction, objection, portability, and withdrawal of consent where consent is relied upon. Individuals may also have rights relating to automated decision-making, where relevant.
12.2 Seven20 will maintain procedures to verify identity, assess requests, and respond within applicable legal timescales. Requests may be refused or limited only where permitted by law.
12.3 Individuals also have the right to raise concerns with Seven20 and to lodge a complaint with the Information Commissioner’s Office or another competent supervisory authority where they believe their personal data has been processed unlawfully. Contact details are in section 16.
13. Children and third-party websites
13.1 Seven20’s website is not intended for children unless expressly stated otherwise, and Seven20 does not knowingly collect personal data from children through the website without appropriate legal basis and safeguards.
13.2 The website may contain links to third-party websites, plug-ins or applications. Seven20 is not responsible for the privacy practices of third parties, and users should review the relevant privacy notices when leaving Seven20’s environment.
14. Personal data breaches
14.1 Seven20 maintains procedures for identifying, reporting, assessing, containing and investigating suspected or actual personal data breaches. Where required by law, Seven20 will notify the relevant supervisory authority and affected individuals within the applicable timescales. Where a breach affects data Seven20 processes for a customer, Seven20 will notify that customer as set out in its agreement with them.
15. Google user data
15.1 This section explains how Seven20’s Notetaker and Sequencer products access, use, store, share and delete data received from Google APIs (Google user data) when a user connects a Google account. It applies in addition to the rest of this policy and takes priority if there is any conflict.
15.2 Data we access. With the user’s permission, and only for the features described below:
(a) Notetaker reads the user’s Google Calendar events, including event titles, times, attendees’ names and email addresses, and online meeting links, so that it can identify the meetings the user wants it to join, record and transcribe.
(b) Sequencer sends emails from the user’s Gmail account on the user’s behalf, as part of the email sequences the user creates. It reads the headers and subject lines of messages in that mailbox, but does not use message bodies, so that it can detect replies and bounces and pause a sequence. Sequencer does not access the user’s calendar.
(c) Both products receive the user’s basic Google profile information (name, email address and profile picture) to identify the connected account.
15.3 Seven20 requests only the Google permissions it needs for these features: for Notetaker, access to view the user’s calendars and calendar events; for Sequencer, access to read and send email in the user’s Gmail account; and, for both, Google sign-in to identify the user.
15.4 How we use it. Seven20 uses Google user data only to provide and improve the user-facing features of Notetaker and Sequencer that the user has chosen to use. Seven20 does not:
(a) sell Google user data;
(b) use or transfer Google user data for advertising, including personalised, retargeted or interest-based advertising;
(c) use or transfer Google user data to determine creditworthiness or for lending purposes; or
(d) use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models, or allow any service provider to do so.
15.5 Human access. Seven20 personnel do not read Google user data unless: the user has given affirmative agreement to view specific data (for example, when asking for support); it is necessary for security purposes, such as investigating abuse or a security incident; it is necessary to comply with applicable law; or the data has been aggregated and anonymised for internal operations.
15.6 Sharing. Seven20 shares Google user data only with:
(a) a third-party email and calendar integration provider that connects to Google on Seven20’s behalf, acting as Seven20’s sub-processor;
(b) Seven20’s cloud hosting provider, which stores data on Seven20’s behalf;
(c) the user’s organisation, through its Salesforce organisation, where the feature is designed to record information there (for example, Notetaker meeting summaries and action items, and Sequencer email activity and follow-up tasks); and
(d) regulators, law enforcement or other parties where required by applicable law.
These providers may use Google user data only to provide their services to Seven20 and are bound by written data protection terms. Seven20 will not transfer Google user data as part of a merger, acquisition or sale of assets without first obtaining the user’s explicit consent. A list of Seven20’s sub-processors is available on request from dpo@seven20.io.
15.7 Storage and security. When setting up Notetaker or Sequencer, the user’s organisation chooses the cloud hosting region in which its data is stored. Seven20 connects each hosting region to its integration provider’s service in either the United States or the European Union, choosing the closest fit for that region; for example, organisations hosted in the UK use the European Union service. Google user data is encrypted in transit (using TLS) and at rest, and access is restricted to authorised personnel under the security measures in section 10.
​
15.8 Retention. Seven20 keeps Google user data only for as long as needed to provide the relevant feature:
​
(a) Gmail message content handled by Sequencer is processed in transit to send the email and is not stored by Seven20;
(b) Notetaker uses calendar access only to find and join the user’s meetings, and stops accessing the calendar as soon as the user disconnects. Calendar events that appear in the user’s organisation’s Salesforce organisation are created by Salesforce’s own activity capture service, not by Seven20, and remain under that organisation’s control; and
(c) when an organisation’s Notetaker or Sequencer subscription ends, all Google user data Seven20 holds for it is deleted within 30 days after the period for requesting a data export ends or, if an export is requested, within 30 days after the export is delivered. Backup copies are deleted within 90 days. Information the feature has written into the user’s organisation’s Salesforce organisation is controlled by that organisation and is not deleted by Seven20.
15.9 Disconnecting and deletion. A user can disconnect their Google account at any time, either in the product or by removing Seven20’s access at myaccount.google.com/permissions. In Notetaker, open the App Launcher, go to the My Notetaker Settings tab and select Disconnect under Calendar connection. In Sequencer, open the App Launcher, go to Seven20 Sequencer, open the My Mailbox tab and select Disconnect. When a user disconnects, Seven20 immediately stops accessing their Google account, deletes the stored access credentials and revokes its integration provider’s access. A user can ask Seven20 to delete their Google user data by emailing dpo@seven20.io. Because Seven20 processes this data on behalf of the user’s organisation, Seven20 will confirm the request with that organisation and then delete the data without undue delay, and ask its integration provider to do the same. Backup copies are deleted within 90 days. 15.10 Limited Use. Seven20’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
16. Contact and review
16.1 Questions about this policy, privacy rights requests and privacy concerns should be sent to Seven20’s data protection lead at dpo@seven20.io, or by post to Seven20.io Ltd, Unit 208, The Vanilla Factory, 39 Fleet Street, Liverpool, L1 4AR.
16.2 This policy shall be reviewed at least annually and earlier where there are material changes to law, regulation, business operations, systems, vendors, international transfers, or risk exposure.
16.3 Individuals in the UK may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk). Individuals in the European Economic Area may complain to the data protection supervisory authority in the country where they live or work, or to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (dataprotection.ie).