Ronda is a service for UK employers. This policy explains what personal data we collect, why, and what your rights are. It is written to be read, not filed.
Two roles matter here. When you visit ronda.one, contact us or hold a Ronda account, we are the controller of your personal data and this policy applies in full. When your organisation uses Ronda to work with information about its own employees, your organisation is the controller and Ronda is the processor, acting on its instructions under a Data Processing Agreement. Section 9 covers that.
Who we are
Ronda is operated by Ronda Ltd, London SW13 ("Ronda", "we", "us").
Questions about this policy or your data: data@ronda.one. We aim to respond within five working days.
What we collect
When you visit the site. Technical information your browser sends, such as IP address, browser type and the pages you view. We use this to run and secure the site.
When you contact us. Your name, work email, company name and anything you put in the message. Phone number and company size if you choose to give them.
When you hold an account. Your name, work email, password (stored hashed, we cannot read it), company name, your role, and the settings you choose.
When you use the service. The questions you ask, the answers Ronda gives, documents you upload, processes you run, and connections you set up to other systems. Where that material contains information about your employees, your organisation is the controller of it (section 9).
From other sources. If your organisation connects an HR, finance or similar system to Ronda, we receive the data that system sends under the permissions your organisation grants. We do not buy data or collect it from public profiles.
We do not knowingly collect data from anyone under 18.
Why we use it and our lawful basis
We do not use your data, or your organisation's data, to train AI models available to anyone else.
Who we share it with
We share personal data only with providers who help us run Ronda, and only as far as needed:
- Anthropic provides the AI model that generates Ronda's answers. Content you submit is processed to produce a response. Anthropic processes data under terms that prohibit using it to train their models.
- Supabase hosts our database and authentication.
- Vercel hosts the website and application.
- Email and support tooling used to send service messages and reply to you.
We may also share data where the law requires it, to protect our rights or safety, or as part of a sale or restructuring of the business, in which case this policy continues to apply.
We do not sell personal data.
International transfers
Our data is primarily hosted in the UK and EU. Some providers, including Anthropic, may process data in the United States. Where data leaves the UK we rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision. You can ask us for more detail on the safeguards in place.
How long we keep it
We keep personal data for as long as needed for the purposes above, then delete or anonymise it. As a guide:
- Enquiries: while we are in contact and for a reasonable period afterwards.
- Account and service data: for the life of the account. When an account closes, service data is deleted within 30 days unless we are required to keep it longer.
- Security and system logs: for a limited period consistent with keeping the service safe.
- Records we must keep by law, or that relate to a dispute: for as long as that requirement lasts.
Security
We use encryption in transit and at rest, access controls, and credentials stored in encrypted form. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur, but we take reasonable steps to prevent it and we will tell you and the ICO where the law requires it.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it;
- restrict or object to how we use it;
- provide it in a portable format;
- withdraw consent where we rely on it.
Email data@ronda.one. We will respond within one month, or tell you if we need longer. We may need to confirm your identity first.
If your request concerns information your employer holds in Ronda, we will usually pass it to your employer, as they are the controller.
You can complain to the Information Commissioner's Office at ico.org.uk. We would prefer the chance to resolve it first.
When Ronda is the processor
If your organisation uses Ronda to work with information about its own employees, your organisation decides what goes in and why. We process it only on your organisation's instructions, under a Data Processing Agreement available to every business customer, and we return or delete it at the end of the contract. Employees with questions about their data should contact their employer in the first instance.
Cookies
Ronda uses cookies that are strictly necessary to keep you signed in and keep the service secure. We do not currently use advertising cookies. If we introduce analytics or other non-essential cookies we will ask for consent first and update this policy.
Changes
We will update this policy when our practices change. The date at the top tells you when. Significant changes will be notified to account holders.