Privacy Policy

Last Updated: August 20 2026

WORK‑SELF Ltd. (“WORK‑SELF,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal information when you use our websites, applications, or services (collectively, the “Services”).

1. Introduction and Scope

WORK-SELF LTD ("WORK-SELF", "we", "us", "our") is a company incorporated in England and Wales with company number 16537587 and registered office at 138 Liverpool Road, London N1 1LA, United Kingdom.

This Privacy Policy explains how we handle personal data in connection with Maya Enterprise, our human context server and employee transformation programme for organisations ("Maya Enterprise" or the "Services").

Maya Enterprise is an enterprise product. It is licensed to organisations and is not offered to consumers. This Policy therefore describes the handling of personal data in a business-to-business context. It does not cover any consumer product previously operated by WORK-SELF.

This Policy should be read alongside the Maya Enterprise Terms and Conditions and, where WORK-SELF acts as a processor, the Data Processing Agreement ("DPA") executed with the relevant customer organisation. Where this Policy conflicts with an executed DPA in respect of processing carried out on behalf of a customer, the DPA prevails.

2. Who This Policy Covers

This Policy concerns three groups of people.

Covered Employees. Individuals employed or engaged by a customer organisation ("Customer") whose employee context is held within Maya Enterprise or who take part in the coaching programme. This is the largest group and the one for which the Customer, not WORK-SELF, is responsible as controller.

Customer representatives. Administrators, procurement, finance, legal and technical contacts at a Customer or a prospective Customer, and Authorised Users who administer the Services.

Website visitors. Individuals who visit work-self.com or contact us through it.

3. Our Role: Controller and Processor

3.1 Where we act as processor

For all personal data relating to Covered Employees, including employee context, coaching interaction data and context access logs, the Customer is the controller and WORK-SELF is the processor. We process that data only on the Customer's documented instructions and in accordance with the DPA. The Customer decides what data enters Maya Enterprise, which agent systems may receive it, and for what purpose.

3.2 Where we act as controller

WORK-SELF is the controller for a limited set of personal data that we determine the purposes and means of processing ourselves, namely: business contact details of Customer and prospect representatives; account administration and authentication records; billing and contractual records; security and fraud prevention records; website and marketing data; and correspondence with us.

3.3 Joint controller arrangements

In limited circumstances WORK-SELF and a Customer may act as joint controllers, for example where both parties jointly determine the purposes of a benchmarking or evaluation programme. Any such arrangement will be recorded in a written agreement setting out each party's responsibilities, and the essence of that arrangement will be made available to affected individuals.

3.4 What we are not

WORK-SELF is not the employer of any Covered Employee. We do not make employment decisions, we do not supervise or direct Covered Employees, and we do not act as a system of record for employment data.

4. Personal Data We Process

4.1 Employee context (processor)

Maya Enterprise holds structured context about Covered Employees so that it can be served, under the Customer's permission rules, to approved agent systems at runtime. Depending on the Customer's configuration this may include:

• identity and directory attributes: name, work email address, employee or worker identifier, business unit, location and reporting line;

• role and responsibility attributes: job title, function, accountabilities, ownership of processes or systems, and delegation and cover arrangements;

• workflow attributes: position within a process, review and approval relationships, escalation paths, service commitments and deadlines;

• capability attributes: skills, tools proficiency, certifications and capability development status;

• derived attributes: context and confidence scores, readiness indicators and other structured outputs generated by Maya Enterprise from the above.

4.2 Context access logs (processor)

Every request made by an approved agent system for employee context generates a record. That record identifies the requesting agent, the context scope served, the Covered Employee to whom the context relates, and the time of the request. These logs are personal data. They exist so that the Customer can supervise, audit and demonstrate the governance of agent access to employee context, and so that we can secure the Services.

4.3 Coaching interaction data (processor)

Where the Customer subscribes to the coaching programme, we process participation records, session content and progress records generated by Covered Employees. Section 8 explains how this data is treated and what the Customer can and cannot see.

4.4 Customer representative data (controller)

• name, job title, work email address, work telephone number and business address;

• account credentials in hashed form, authentication events, single sign-on identifiers and role assignments;

• billing, procurement and contractual records, including Order Forms and statements of work;

• correspondence with our sales, support, security and legal teams.

4.5 Technical and usage data

• internet protocol address, browser and device information, operating system and time zone;

• administration console usage, features accessed and session duration;

• interface and connector telemetry: call volumes, endpoints, latency, error rates and rate-limit events. We record metadata about these calls, not the substance of any prompt exchanged between a Customer agent system and a model provider.

4.6 Prospect and business development data (controller)

For enterprise sales and partnership activity we process professional business contact information obtained from public professional directories, company websites, events and referrals. We rely on legitimate interests for this, we process business contact details only, and any individual may object at any time by writing to privacy@work-self.com.

4.7 Special category data

Maya Enterprise is not designed to process special category personal data as defined in Article 9 of the UK GDPR. We do not seek health data, biometric data, data revealing racial or ethnic origin, religious or philosophical belief, trade union membership, sex life or sexual orientation.

Customers are instructed not to submit special category data to Maya Enterprise. Where a Customer requires such processing for a specific and lawful purpose, it must be expressly agreed in the Order Form and DPA, and the Customer must first establish a valid Article 9 condition. Where special category data reaches the Services incidentally, we will notify the Customer and act on its instructions to remove or restrict it.

We do not carry out emotion inference, voice tonality analysis, sentiment scoring of individuals, or biometric identification within Maya Enterprise.

5. Where We Obtain Personal Data

• From the Customer: through integrations with the Customer's own systems, including human capital and people systems, identity providers, ticketing systems and knowledge bases, and through direct upload or configuration by Customer administrators.

• From Covered Employees: through their own use of the coaching programme and any profile information they provide or confirm.

• Generated by the Services: derived context attributes, access logs and telemetry produced in the course of operating Maya Enterprise.

• Directly from Customer representatives: when they register, correspond with us, attend a meeting or complete a security or procurement process.

• From our service providers: hosting, infrastructure, security and communications providers acting on our instructions.

• From public sources: professional directories and company websites, for business development only.

6. Purposes and Lawful Bases

6.1 Purposes for which we act as processor

For the following purposes the Customer is the controller and determines the lawful basis. We carry out the processing under our contract with the Customer and the DPA, and only on the Customer's documented instructions.

• Operating Maya Enterprise and serving employee context to approved agent systems.

• Delivering the coaching programme to Covered Employees.

• Maintaining context access logs so that the Customer can supervise and audit agent access to employee context.

• Generating reporting and analytics for the Customer within the scope of the Order Form.

• Assisting the Customer in responding to requests from individuals exercising their data protection rights.

6.2 Purposes for which we act as controller

For the following purposes WORK-SELF determines the purposes and means of processing. The lawful basis for each is stated.

• Account creation, authentication, single sign-on and role management for Authorised Users. Basis: performance of a contract; legitimate interests.

• Billing, credit control and contract administration. Basis: performance of a contract; legal obligation.

• Security monitoring, abuse prevention and incident investigation. Basis: legitimate interests; legal obligation.

• Service, availability and security notifications sent to Customer contacts. Basis: performance of a contract; legitimate interests.

• Product improvement using anonymised and aggregated data. Basis: legitimate interests.

• Enterprise business development and marketing to business contacts. Basis: legitimate interests, subject to objection at any time.

• Meeting our regulatory, tax, accounting and record-keeping duties. Basis: legal obligation.

• Establishing, exercising or defending legal claims. Basis: legitimate interests; legal obligation.

6.3 Our legitimate interests

Where we rely on legitimate interests, those interests are in operating and securing an enterprise service, administering our commercial relationships, improving our product, and developing our business. We have assessed in each case that these interests are not overridden by the interests or fundamental rights of the individuals concerned. A summary of any legitimate interests assessment is available on request from privacy@work-self.com.

7. Employee Context Served to Agent Systems

The purpose of Maya Enterprise is to serve structured, permissioned employee context to agent systems at the moment they need it. This section explains how that works and who controls it, because it is the most significant processing we carry out.

7.1 The Customer controls the boundary

The Customer decides which employee context is held in Maya Enterprise, which agent systems are approved to receive it, and what scope each approved agent may request. WORK-SELF serves context only within the boundaries the Customer configures. We do not decide what an agent may see.

7.2 Approval before access

No agent system receives employee context until the Customer has registered and approved it, identified its operating entity and purpose, and assigned a named accountable owner within the Customer organisation. Access is granted on a least-privilege basis.

7.3 Purpose limitation

Employee context is served for operational coordination: identifying who owns a piece of work, who reviews it, where it escalates and when it is due. It is not provided for surveillance, covert monitoring, productivity ranking of individuals, emotion inference or social scoring, and the Terms and Conditions prohibit those uses.

7.4 Every request is recorded

Each context request is logged as described in Section 4.2. The Customer can review these logs at any time through the administration console. This is a deliberate design decision: agent access to employee data should be observable by the organisation that is accountable for it, and by the individuals it concerns.

7.5 Agent systems are the Customer's responsibility

Approved agent systems are operated by or for the Customer. Once context has been served to an agent system, that system holds it under the Customer's control and the Customer's own privacy notices. WORK-SELF does not operate, instruct, tune or supervise Customer agent systems and is not responsible for what they do with the context they receive.

8. Coaching Confidentiality

The coaching programme only works if Covered Employees engage with it honestly. That requires clarity about what their employer can see.

8.1 Default position

Unless the Order Form expressly records a different configuration, the substance of an individual's coaching sessions, including free-text entries, reflections and session content, is not made available to the Customer at an individual level. The Customer receives participation and progress reporting at cohort and aggregate level, and individual-level capability attributes only where the Order Form provides for it.

8.2 Where the configuration differs

Where a Customer requires individual-level coaching visibility, that must be recorded in the Order Form and DPA, and the Customer must inform affected Covered Employees clearly and in advance. WORK-SELF will provide the applicable configuration in writing to any Covered Employee who asks.

8.3 Limits

Coaching data is not used to generate performance ratings, disciplinary evidence or redundancy selection criteria, and the Terms and Conditions prohibit the Customer from using it for those purposes. The coaching programme is a professional capability service. It is not a clinical, medical or mental health service, and it is not a route to occupational health.

8.4 Wellbeing disclosures

If a Covered Employee volunteers information about their health or wellbeing during coaching, we do not seek it, we do not index it as employee context, and we do not serve it to agent systems. Covered Employees should raise health matters with their employer or a qualified professional through the appropriate channel.

9. Artificial Intelligence and Model Training

9.1 We do not train on Customer Data

WORK-SELF does not use personal data or other Customer data from Maya Enterprise to train, fine-tune or improve any artificial intelligence or machine learning model that is made available to any other customer or to any third party. We do not disclose Customer data to a model provider for training purposes. Configuration and tuning carried out solely for a Customer's own instance remains within that Customer's environment.

9.2 Model inference

Where the Services use a third-party language model to generate an output, that processing is carried out under contractual terms that prohibit the provider from retaining the data for its own purposes or using it for model training. Model inference providers are engaged as sub-processors and are covered by Section 12.

9.3 Anonymised and aggregated data

We generate anonymised, aggregated statistical data from the operation of the Services for security, capacity planning, research, benchmarking and product improvement. That data does not identify, and is not capable of re-identifying, any individual or Customer. We do not publish anonymised data in a form attributable to a Customer without that Customer's prior written consent.

9.4 Automated decision-making

WORK-SELF does not make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects. The Terms and Conditions prohibit Customers from using Maya Enterprise, alone or with any agent system, to make such decisions without meaningful human involvement, including decisions on recruitment, selection, promotion, remuneration, performance rating, discipline, redundancy and termination.

9.5 Nature of outputs

Context objects, derived attributes and coaching recommendations are probabilistic and inferential. They may be incomplete or out of date. They are inputs for a competent person to consider, not statements of fact about an individual. Individuals may seek correction of any attribute they believe to be inaccurate under Section 13.

9.6 AI regulation

WORK-SELF is the provider of Maya Enterprise. The Customer is its deployer, and is the provider of its own agent systems. Each party carries the obligations attaching to its role under applicable artificial intelligence legislation, including the EU Artificial Intelligence Act where it applies and any equivalent or successor framework. We maintain technical documentation, logging capability and context lineage sufficient to support Customers in meeting their deployer obligations, and make that information available on reasonable request.

10. How We Share Personal Data

We do not sell personal data. We do not share personal data with third parties for their own marketing purposes. We do not display advertising in Maya Enterprise and we do not permit any third party to use employee context for advertising.

We share personal data only as follows.

• Approved agent systems: employee context is served to the agent systems that the Customer has registered and approved, within the scope the Customer has configured, as described in Section 7.

• Sub-processors: service providers acting on our instructions under a written contract, as described in Section 12.

• The Customer: reporting, analytics and administration data made available to the Customer as controller, subject to the coaching provisions in Section 8.

• Professional advisers: our lawyers, auditors, insurers and accountants, bound by professional duties of confidence.

• Corporate transactions: in connection with a merger, acquisition, reorganisation or sale of all or substantially all of our assets, subject to equivalent privacy protections and with notice where required by law.

• Legal and regulatory: where required by law, court order or a competent regulator, including the Information Commissioner's Office. Where we receive a request for Customer data from a public authority, we will, unless legally prohibited, notify the Customer and seek to redirect the request to the Customer.

• With consent: for any other purpose to which the individual has consented, which may be withdrawn at any time.

11. Sub-Processors

We engage the following categories of sub-processor to deliver Maya Enterprise:

• cloud hosting, storage and compute providers;

• distributed database and data infrastructure providers;

• workflow automation and integration providers;

• language model inference providers;

• security, logging and monitoring providers;

• communication and notification providers; and

• billing and payment providers.

A current list of named sub-processors, the processing each carries out and its location, is maintained and made available to Customers. Every sub-processor is engaged under a written contract imposing data protection obligations no less protective than those we owe to the Customer.

We give Customers prior notice of any intended addition or replacement of a sub-processor. Customers may object on reasonable data protection grounds within the notice period, and we will consider any objection in good faith and work to resolve it, including through the mechanisms in the DPA.

12. International Transfers and Data Residency

WORK-SELF is established in the United Kingdom. Some sub-processors are located outside the United Kingdom and the European Economic Area, including in the United States.

Where personal data is transferred to a country that is not the subject of an adequacy decision, we implement an appropriate safeguard, being the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another lawful mechanism, together with supplementary technical and organisational measures where required. We carry out a transfer risk assessment where applicable.

Where an Order Form specifies a data residency region, Customer data at rest is hosted in that region. Customers may request details of the transfer mechanisms applicable to their data by writing to legal@work-self.com.

13. Rights of Individuals

13.1 Rights available

Individuals in the United Kingdom and the European Economic Area have the following rights, subject to legal exemptions and limitations: access to their personal data; rectification of inaccurate or incomplete data; erasure; restriction of processing; data portability; objection to processing based on legitimate interests or to direct marketing; the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and, where processing is based on consent, the right to withdraw that consent at any time without affecting prior processing.

13.2 Covered Employees: contact your employer first

If you are an employee or contractor of a Customer, your employer is the controller of your employee context, your coaching data and your context access logs. Please direct your request to your employer in the first instance, using its own privacy contact. We will support the Customer in responding, as required by the DPA and within the timescales it sets.

If you contact us directly, we will acknowledge your request, tell you which Customer organisation holds your data, and pass the request to that Customer, unless we are instructed or legally required to do otherwise. We will not respond substantively to a request about Customer data without the Customer's instruction.

13.3 Where we are controller

Where WORK-SELF is the controller, write to privacy@work-self.com. We respond to verified requests within one calendar month of receipt, which may be extended by up to two further months for complex requests, in which case we will tell you within the first month. We may need to verify your identity. We do not charge a fee unless a request is manifestly unfounded or excessive, and we do not treat anyone less favourably for exercising a right.

13.4 Authorised agents

You may appoint an authorised agent to make a request on your behalf. We will require written evidence of the agent's authority and may verify your identity directly.

13.5 Marketing preferences

You may opt out of marketing communications at any time using the unsubscribe link in any marketing message, or by writing to privacy@work-self.com. Opting out of marketing does not stop service, security or contractual communications.

14. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, and in line with our legal obligations.

14.1 Data we hold as processor

• Employee context: held for the subscription term in accordance with the Customer's documented instructions. Available for export for 30 days after termination, then deleted or anonymised, unless longer retention is required by law.

• Coaching interaction data: as specified in the DPA. In the absence of a specific instruction, for the subscription term plus 12 months.

• Context access logs: as specified in the Order Form or the Documentation, and in any event for the minimum period needed to meet the Customer's own record-keeping obligations under applicable artificial intelligence and employment legislation.

14.2 Data we hold as controller

• Customer representative account data: for the duration of the relationship plus 3 years.

• Contractual, billing and tax records: 7 years from the end of the relevant accounting period.

• Security and authentication logs: 12 months, or longer where required for an active investigation.

• Support and correspondence records: 3 years from resolution.

• Prospect and business development data: 2 years from the last meaningful interaction, or until the individual objects.

14.3 Anonymised data

Anonymised and aggregated data may be retained indefinitely. It does not identify, and cannot be used to re-identify, any individual or Customer.

15. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss and destruction. These include:

• encryption of personal data in transit using TLS 1.2 or higher, and encryption at rest;

• role-based access control and least-privilege access for our personnel, on a need-to-know basis;

• multi-factor authentication on internal systems and support for single sign-on for Customer administrators;

• logical segregation of Customer environments;

• logging of administrative access, agent registration and context access;

• vulnerability management, secure development practice and periodic security testing;

• personnel screening, confidentiality obligations and data protection training; and

• data minimisation and pseudonymisation where technically feasible.

Any certification or attestation held by WORK-SELF is identified in the security documentation made available to Customers. We will notify a Customer if a certification stated in its Order Form lapses or is withdrawn. Customers may request our current security documentation by writing to security@work-self.com.

We maintain a documented incident response procedure. In the event of a personal data breach affecting Customer data, we notify the Customer without undue delay and provide the information the Customer reasonably needs to meet its own obligations under Articles 33 and 34 of the UK GDPR. Where we are controller, we notify the Information Commissioner's Office and affected individuals where the legal thresholds are met.

No system is impervious. Customers and Authorised Users are responsible for the security of their credentials, connector keys and their own systems.

16. Cookies and Website Tracking

This section applies to work-self.com, our public website. It does not describe the Maya Enterprise application, which is accessed by authenticated Authorised Users and approved agent systems and does not use advertising or marketing cookies.

We use strictly necessary cookies for authentication, session management and security. These cannot be disabled. We use functional cookies to remember preferences, and analytics cookies to understand how the website is used. Analytics and any marketing cookies are set only with consent, given through the cookie banner on first visit.

You may change your preferences at any time through the banner or your browser settings. Disabling some cookies may affect website functionality. We honour the Global Privacy Control signal where it is technically implemented.

17. Children

Maya Enterprise is an enterprise product intended for adults in a workplace context. It is not directed at children and we do not knowingly process the personal data of anyone under 18. If you believe a child's personal data has reached us, write to privacy@work-self.com and we will take prompt steps to remove it.

18. Data Processing Agreement

Every Customer whose use of Maya Enterprise involves WORK-SELF processing personal data on its behalf must execute a DPA with us before or at the commencement of the Services. The DPA governs:

• the subject matter, nature, purpose and duration of processing;

• the categories of personal data and of data subjects;

• our obligations as processor, including security measures, sub-processor management, assistance with data subject rights, assistance with data protection impact assessments, breach notification, and return or deletion of data;

• international transfer mechanisms and any data residency commitment;

• audit and inspection rights; and

• restrictions on model training and on secondary use of Customer data.

To request our standard DPA, or to discuss a bespoke arrangement, write to legal@work-self.com.

19. Employee Transparency and Consultation

The Customer, as controller, is responsible for informing Covered Employees that their employee context is held within Maya Enterprise and may be served to approved agent systems, and for completing any consultation required with a works council, trade union or employee representative body in the relevant jurisdictions.

We support that obligation. We provide template employee notice language, a plain-language description of what Maya Enterprise holds and serves, and the context access logging that lets an organisation show its workforce how employee context is actually being used. Customers are responsible for reviewing and adapting that material for their own jurisdictions and circumstances.

20. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, legal obligations or business. The current version is published at work-self.com with a revised effective date.

For a change that materially affects how we process personal data, we will give Customers at least 30 days' written notice, and will notify individuals for whom we are controller by email or prominent notice. For non-material changes, the revised Policy takes effect on posting.

21. Complaints

If you have a concern about how your personal data is handled, please raise it with us first at privacy@work-self.com. We will investigate and respond promptly.

If you are a Covered Employee, please also raise the matter with your employer, which is the controller of your data.

If you remain dissatisfied, you may complain to a supervisory authority:

• United Kingdom: Information Commissioner's Office, www.ico.org.uk, telephone 0303 123 1113.

• European Economic Area: your local data protection supervisory authority. A list is available at edpb.europa.eu.

22. Contact

• Privacy enquiries and data subject requests: privacy@work-self.com

• Data Processing Agreements and legal matters: legal@work-self.com

• Security documentation and incident reporting: security@work-self.com

• Enterprise sales: enterprise@work-self.com

• Support: support@work-self.com

• Post: WORK-SELF LTD, 138 Liverpool Road, London N1 1LA, United Kingdom

WORK-SELF LTD is registered in England and Wales, company number 16537587, and is registered with the Information Commissioner's Office under the Data Protection Act 2018.