Privacy Policy

Last updated 25 August 2026

Who we are

One Big Team is a trading name of Crazy Cat Software Limited, registered in England and Wales under company number 15029972. Our registered office is 2nd Floor, Market House, Market Square, Aylesbury, Buckinghamshire HP20 1TN.

This policy explains how we handle personal data when you visit our website, contact us, create or administer an account, or use One Big Team. Contact us at privacy@onebigteam.co.uk.

Our role

For employee, worker, applicant and other HR data entered by a customer, the customer is normally the controller and One Big Team acts as its processor. Questions or rights requests about that information should normally be directed to the relevant employer or organisation. Our Data Processing Agreement governs that processing.

Crazy Cat Software Limited is the controller for information used to operate our own business, including website enquiries, trial and account administration, billing, supplier management, direct communications and platform-level security records created for our own security and legal purposes. We do not become controller of Customer-controlled HR information merely because it appears in a tenant audit record or is accessed during support.

Information we handle as controller

We may collect:

Your name, work email, organisation, job role and contact details;
Account, authentication and service-administration information;
Enquiries, support requests and correspondence;
Subscription, invoice, payment-status and transaction information. Payment-card details are collected directly by Stripe and are not stored by One Big Team;
Service usage, security, audit, device and diagnostic information, including IP address and browser information; and
Cookie and browser-storage information described in our Cookie Policy.

We normally obtain this information from you, your organisation, your use of the service, and service providers involved in authentication, billing, hosting, security and communications.

Why we use it and our lawful bases

We use personal data:

To create and administer trials, accounts and subscriptions, provide requested services and communicate about them — necessary to perform a contract or take steps at your request before entering one;
To bill customers, maintain business and tax records, and comply with regulatory duties — necessary to comply with legal obligations;
To secure, monitor, troubleshoot and improve the service; prevent misuse and fraud; provide support; and manage our business relationships — necessary for our legitimate interests in operating a secure and effective business, provided those interests are not overridden by your rights;
To respond to enquiries — necessary to take requested steps, perform a contract, or for our legitimate interests in communicating with prospective and existing customers; and
For optional marketing or non-essential storage technologies where used — with consent where the law requires it. Consent may be withdrawn at any time.

We do not use personal data for solely automated decisions that produce legal or similarly significant effects.

Customer-controlled HR information

Customers may use the service to process employee records, contact details, employment and compensation information, leave and sickness records, recruitment information, documents, emergency contacts, audit history and equal-opportunities monitoring information. This can include special-category data. The relevant customer determines why that information is processed, who may access it and the applicable lawful basis.

We disclose personal data only where necessary to:

Provide the service using the processors listed on our Subprocessors page and the other service providers identified there;
Process subscription payments and prevent fraud;
Obtain professional advice, insurance or business support under appropriate confidentiality obligations;
Comply with law, court orders or lawful requests; or
Protect the rights, safety and security of One Big Team, our customers or others.

We do not sell personal data.

International transfers

Some providers may process information outside the UK. Where a restricted transfer occurs, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment and additional safeguards where required. You may ask privacy@onebigteam.co.uk for information about the safeguard relevant to your personal data. We may redact confidential commercial or security information from any copy we provide.

Retention

We keep personal data only for as long as needed for the purposes described above, including legal, accounting, security and dispute-resolution requirements.

Customer service data remains available during the subscription and for a 30-day recovery period after cancellation. We then disable ordinary access and complete deletion of active Customer-controlled records and stored files through our controlled deletion process, subject to any lawful retention requirement;
Residual customer data may remain in provider-managed, access-restricted backups until those backups expire under the applicable provider retention cycle. It is not restored for ordinary use and applicable deletion instructions are reapplied following a disaster-recovery restoration;
Customer exports generated for immediate download are not intentionally retained by One Big Team after delivery. Where an assisted export must be staged temporarily, it is deleted within seven days;
Website enquiries and unsuccessful sales enquiries are normally retained for up to 24 months after the last meaningful contact, unless a longer period is needed for an ongoing matter or legal claim;
Support correspondence is normally retained for the subscription term and up to 24 months afterwards, unless a longer period is needed for security, a complaint or a legal claim;
Account, transaction and billing records may be retained for the period required by tax, accounting and legal rules; and
Platform security records are normally retained for up to 12 months and Customer audit records for the subscription term and controlled deletion period, unless a longer period is necessary to investigate an incident, meet a legal obligation or establish, exercise or defend a legal claim.

The customer controls retention of HR records while its account remains active and is responsible for applying appropriate retention periods to those records.

Security

We use technical and organisational safeguards including authentication, role-based access, organisation isolation, encryption in transit and at rest, private document storage, audit logging, monitoring and backups. More information is available on our Security page.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your personal data; object to processing; receive portable data; and withdraw consent. These rights are not absolute and exemptions may apply.

For information controlled by your employer or another One Big Team customer, contact that organisation first. For information controlled by us, email privacy@onebigteam.co.uk. We may need to verify your identity before acting on a request.

Data protection complaints

You may make a data protection complaint by emailing privacy@onebigteam.co.uk. Please describe what you believe has gone wrong and include enough information for us to identify the relevant account, communication or processing. Do not send passwords or unnecessary sensitive information.

We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed where an investigation takes longer, and tell you the outcome. We will record complaints and the steps taken to resolve them. If the complaint concerns information controlled by a Customer, we will normally forward it securely to that Customer or explain how to contact them; we will still investigate any part concerning our own conduct as processor.

You may also complain to the Information Commissioner's Office at ico.org.uk. You do not have to contact us before approaching the ICO, although giving us the opportunity to investigate may resolve the concern sooner.

Whether you must provide information

Information marked as required during registration, billing or support is needed to provide the relevant service or respond to your request. If it is not provided, we may be unable to create an account, supply the service or answer the enquiry. Optional fields are identified where applicable.

Changes

We may update this policy when our services, suppliers or legal obligations change. We will publish the revised version and its updated date, and provide additional notice where a change materially affects how we use personal data.