Privacy Policy

At Rewordin ("we", "our", or "us"), we are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our global employee rewards and recognition platform.

1. Information We Collect

Account Information

When you create an account, we collect:

• Full name and job title
• Work email address
• Company name and size
• Country and preferred currency
• Industry
• Password (encrypted)

HRIS & Integration Data

When you connect HRIS platforms (such as Workday, BambooHR, SAP SuccessFactors, Personio, or ADP), we process the employee data you authorise us to access — including names, email addresses, departments, and employment dates. This data is used solely to deliver rewards and manage your recognition programme.

Reward & Transaction Data

We collect information related to reward transactions, including:

• Reward types, amounts, and recipients
• Delivery status and redemption data
• Budget allocations and approval workflows
• Tax classification data for compliance reporting

Usage Data

We automatically collect information about how you interact with our platform, including:

• Features used and pages visited
• Log data (IP address, browser type, device information)
• Analytics data to improve our services

2. How We Use Your Information

We use the collected information to:

• Deliver, fulfil, and track employee rewards across 150+ countries
• Process reward transactions and manage multi-currency conversions
• Generate tax compliance reports and documentation
• Sync employee data with your connected HRIS platforms
• Send reward notifications and service-related communications
• Provide customer support
• Analyse usage patterns to enhance platform experience
• Ensure security and prevent fraud

3. Data Security

We implement enterprise-grade security measures to protect your data:

• AES-256 Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• PCI-DSS Compliance: Payment and gift card processing meets PCI-DSS Level 1 standards
• Access Controls: Role-based access controls and multi-factor authentication
• Regular Audits: We conduct regular security assessments, penetration testing, and compliance audits
• Data Isolation: Each organisation's data is logically isolated and never shared with other customers

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Reward transaction records are retained for the period required by applicable tax laws (typically 5–7 years). You can request deletion of your data at any time by contacting us. Upon account deletion, we will remove your data within 30 days, except where retention is required by law.

5. Third-Party Services

We work with trusted third-party providers for reward fulfilment, payment processing, analytics, and infrastructure. These include gift card suppliers, payment gateways, and cloud hosting providers. All providers are contractually obligated to protect your data, are GDPR-compliant, and may only use data to perform services on our behalf.

6. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

7. International Data Transfers

Rewordin is headquartered in Wrocław, Poland (European Union). Your data is processed and stored within the EU. When reward fulfilment requires sharing limited data (such as recipient email) with suppliers outside the EU, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

8. Cookies

We use essential cookies to ensure our platform functions properly. We may also use analytics cookies to understand how you use our services. You can manage cookie preferences through your browser settings.

9. Children's Privacy

Our services are intended for business use and are not directed at individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will also notify you via email.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: hello@rewordin.com
Address: Wrocław, Poland

You may also review our Terms of Service for additional information about using the Rewordin platform.