Where Clu processes personal data on behalf of a client organisation as a Data Processor (for example, where a client submits data about its employees for core platform analysis), the client is the Data Controller and its own privacy notice governs that processing. This policy does not cover that processing.

​

​3. What Personal Data We Collect And Why

​

3.1  Website Visitors
When you visit www.getaclu.io, we collect data automatically through cookies and analytics tools. This includes your IP address, approximate location, device type, browser type, operating system, pages visited, time spent on pages, and referral source.
We use this data to understand how our website is used, to improve its content and performance, and — where you have consented — to serve targeted advertising. The tools we use for this are described in Section 5.

 

3.2  Platform Users (Admin Users and Standard Users)
When a client organisation purchases a licence, we create accounts for named Authorised Users. We collect and process the following personal data for these individuals:

• Full name and work email address (used for account creation and login)

• Job title and organisation name (used for account management)

• Login activity and platform usage data (used for security, audit, and support)

• Correspondence with Clu's support or account management teams

The lawful basis for this processing is the performance of our contract with the client organisation, and our legitimate interests in operating a secure and functional platform.

 

3.3  Marketing Contacts
We hold personal data about individuals who have engaged with Clu commercially or consented to receive communications. This includes:

• Name and work email address

• Job title, organisation, and LinkedIn profile (where provided or publicly available)

• Notes on commercial interactions and engagement history

• Email open and click data from marketing communications

We only add individuals to our CRM where we have a legitimate interest basis or explicit consent. Every contact record in HubSpot is documented with its lawful basis at the point of capture.
Legitimate interests: We may hold and use contact details of individuals at organisations that represent potential clients, where we have a reasonable expectation that our services are relevant to them, and where the use of their data does not outweigh their interests or rights. We have conducted a Legitimate Interests Assessment covering this processing, which is available on request.
Consent: Where individuals have actively opted in to receive marketing communications from Clu, we process their data on that basis. You can withdraw consent at any time using the unsubscribe link in any communication or by emailing hello@getaclu.io.

 

3.4  Client Employees: Career Pathways Module
Where a client activates the Career Pathways Module, employees of that client may be sent a link to a web application that allows them to explore role adjacency and internal mobility options based on their organisation's rebuilt workforce model.
Access is via a link sent to the employee's work email address. We process that email address to authenticate access. Employees are not required to complete any personally identifiable fields in the module; use is entirely voluntary.
Any personal data an employee voluntarily provides within the module is processed by Clu on behalf of the client organisation (Clu as Data Processor, client as Data Controller). However, because the employee has no direct contractual relationship with Clu, they may contact us directly with data rights requests at hello@getaclu.io, and we will liaise with the client organisation as appropriate.
The lawful basis for Clu's own processing of the work email address (for authentication) is our legitimate interests in providing a secure access mechanism for the module on behalf of the client.

​

3.5  Client Employees: Work Capture Forms
When a client deploys Work Capture Forms, specific employees receive a link to a short, structured questionnaire. Forms are targeted to individuals in areas of the organisation that the Clu model has flagged as presenting structural risk; they are not sent broadly.
Access is via a link sent to the employee's work email address. No personally identifiable fields are mandatory. Responses are used to validate and refine the analytical model produced for the client.
The same controller/processor framework applies as for the Career Pathways Module. Employees may contact Clu directly at hello@getaclu.io with any data rights requests.

​

4.  Lawful Bases for Processing

UK GDPR requires us to identify a lawful basis for each processing activity. The table below sets out our processing activities and the basis on which we rely for each.