This policy explains how LadderKit handles personal data on our website and in the LadderKit app.
1. Who we are
LadderKit is operated by LadderKit OÜ, registry code 17619531, J. Poska 14a-2, Tallinn, 10126, Estonia (VAT number EE103039897). Privacy requests: privacy@ladderkit.com. Anything else: info@ladderkit.com.
2. Two roles: processor and controller
Data inside the app — we are a processor. Organisations use LadderKit for their people's roles, check-ins, feedback, growth actions and promotions, and for the accounts their people use to sign in. For that data your organisation is the controller: it decides what is recorded and who can see it, and we process it only on its instructions under our Data Processing Agreement. If your employer set LadderKit up, ask your employer how it uses your data. As part of that service the app sends notifications by email or, where your organisation connects Slack, as Slack direct messages; sign-up codes, password resets and invitations always go by email.
For our own purposes — we are the controller. That is the data described below: website visits, the use we make of accounts to keep them and the service secure and to record what was agreed, billing, security and correspondence with us. It comes from you, from your organisation (for example an administrator who invites you), from Google or Microsoft if you use Sign in with Google or Sign in with Microsoft, and from Stripe for payments.
3. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Website visits: IP address, browser type, page requested | To deliver the website and protect it from abuse | Legitimate interests, Art. 6(1)(f) |
| Account: name, email, password (stored only as a bcrypt hash), last sign-in; your Google or Microsoft account identifier, email, name and Workspace domain or Microsoft organisation (tenant) if you use Sign in with Google or Microsoft | To keep accounts and the service secure and to prevent abuse | Legitimate interests, Art. 6(1)(f) |
| Acceptance of our Terms: who registered the organisation, the version of our Terms accepted and when | To be able to show what was agreed with the organisation | Legitimate interests, Art. 6(1)(f) |
| Billing: billing contact's name and email, company name, address, country, VAT number, invoices; card brand, last four digits and expiry (the card itself is entered only into Stripe's form) | To run the organisation's subscription and take payment; to calculate VAT and keep accounting records | Legitimate interests in performing our contract with your organisation, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
| Country of incorporation | To check we can serve the organisation under EU sanctions, and as the default billing country | Legal obligation to comply with EU sanctions regulations, Art. 6(1)(c) |
| Security and operation: API logs with IP addresses, short-lived rate-limit records, error reports (technical details of an error, the browser and the page, not linked to your name or email) | To secure the service, prevent abuse and fix faults | Legitimate interests, Art. 6(1)(f) |
| Correspondence: your email address, name and what you write to us | To answer you and keep a record of what was agreed | Legitimate interests, Art. 6(1)(f) |
Our contract is with your organisation, not with you personally, so where the data is about you we rely on legitimate interests rather than on a contract. Those interests are: keeping accounts and the service secure and preventing abuse; being able to show what was agreed with your organisation; running our contract with your organisation, including billing; and answering correspondence. You can object to processing based on legitimate interests at any time — see section 7.
What you must provide. To have an account you need a name and an email address, or a Google or Microsoft account; without them you cannot use the app. An organisation must give its country of incorporation to register, and billing details to take a paid plan. A profile picture is optional.
We do not sell personal data or use it for advertising, and we do not use your organisation's data to train machine-learning models. We do not profile anyone for our own purposes. Inside the app, check-in ratings and feedback are, by their nature, assessments of people's work; they are written by people in your organisation, on its behalf. The app can suggest an overall check-in rating: the average of the manager's ratings of individual skills, rounded to the nearest level. That automated help with an assessment can amount to profiling. It is only a suggestion, never filled in for the manager, who chooses the rating and can choose a different one; LadderKit makes no decision about anyone by automated means alone.
4. Who we share data with
Only with providers that help us run LadderKit, under contracts that require them to protect it:
| Provider | What they do for us |
|---|---|
| OVH SAS (OVHcloud), data centres in Europe | Servers, database and backups |
| Cloudflare, Inc. | Network delivery and protection against attacks |
| Stripe Payments Europe, Limited, and Stripe, LLC | Payments, invoicing and VAT; also an independent controller for fraud prevention |
| Resend (Plus Five Five, Inc.) | Service emails |
| Sentry (Functional Software, Inc.) | Error monitoring |
| Google (Google Workspace) | Our email |
| Sign in with Google, if used; Google is the controller of your Google account | |
| Microsoft | Sign in with Microsoft, if used; Microsoft is the controller of your Microsoft account |
If your organisation connects its own Slack workspace, the app delivers notifications into it on your organisation's instruction; Slack then processes them under your organisation's own agreement with Slack, not as our provider.
We may also disclose data where the law requires it, or to a successor if our business is sold, in which case this policy continues to apply.
5. International transfers
Our app and database are hosted in data centres in Europe. Sentry keeps our error reports in its EU data region. Some providers process data outside the EEA:
| Provider | Where data may be processed | Safeguard |
|---|---|---|
| Cloudflare, Inc. | Its global network, including the USA | EU–U.S. Data Privacy Framework; Standard Contractual Clauses |
| Stripe, LLC | USA | EU–U.S. Data Privacy Framework; Standard Contractual Clauses as a fallback |
| Resend (Plus Five Five, Inc.) | USA: account data, email metadata and logs are kept there | Standard Contractual Clauses |
| Sentry (Functional Software, Inc.) | EU; access from the USA, for example by its support | Standard Contractual Clauses |
| EU and USA | EU–U.S. Data Privacy Framework; Standard Contractual Clauses | |
| Microsoft | EU and USA | EU–U.S. Data Privacy Framework; Standard Contractual Clauses |
You can ask us for a copy of the safeguards that apply to a provider at privacy@ladderkit.com.
6. How long we keep data
- Data in the app: while the organisation's account exists. On the organisation's request we delete it from live systems within 30 days; if the organisation's agreement with us ends without such a request, we delete it within 90 days. When the organisation switches to another provider, the transitional and retrieval periods in section 9 of our Terms of Service apply instead. Deleted data leaves our rolling backups within a further 30 days.
- Accounts: for as long as the account exists in the organisation, and deleted with it.
- Record of the Terms accepted: for as long as the organisation's account exists, and 3 years after it is closed — the Estonian limitation period for contractual claims.
- Invitations: an invitation link stops working after 5 days. The invitation itself, with the invited person's name and email, stays in the organisation's data until an administrator removes it, like any other data in the app.
- Server logs: up to 30 days, or less when they are overwritten earlier. If an entry is needed to investigate a security incident, we keep only what that investigation needs, with the reason, until it is closed.
- Rate-limit records: kept only in the server's memory, never written to disk, and removed within two hours of the last request.
- Error reports: up to 90 days.
- Correspondence: up to 3 years after the matter is closed — the Estonian limitation period for contractual claims — or longer where it forms part of accounting records.
- Billing records: seven years, as Estonian accounting law requires.
7. Your rights
You can ask for access to your data, its correction or erasure, restriction of processing, data portability, and you can object to processing based on legitimate interests. For data your organisation keeps in LadderKit, contact your organisation; if you write to us, we will pass your request on and help it respond. For everything else, write to privacy@ladderkit.com. We reply within one month.
What the app keeps from you — for example a promotion request about you, or feedback your organisation does not let you read — is still covered by your right of access. The app's visibility settings decide what you see in the app; they do not limit your rights under data protection law. Your organisation decides on such a request, weighing the rights of others, such as a colleague who wrote feedback, and we help it by providing the data it needs.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the authority where you live or work.
8. Cookies
Our website sets no cookies. The app uses only cookies and browser storage that it needs to work or that remember a setting you chose — mainly a secure session cookie — so it does not ask for consent. Stripe's payment form sets its own cookies on the billing page. Details are in our Cookie Policy.
9. Security
We protect data with encryption in transit, hashed passwords and session tokens, strict separation of each organisation's data, a database that is not reachable from the internet, and nightly verified backups. The full list is in Annex 2 of our Data Processing Agreement.
10. Changes
We publish changes on this page with a new "Last updated" date, and notify customer administrators by email or in the app before a significant change takes effect.