Privacy Policy

Who is responsible

Workforce Observatory is the data controller for personal data collected through this website (workforceobservatory.com). You can reach us about anything in this policy at privacy@workforceobservatory.com — we reply within two business days.

A note on scope: this policy covers the website. The Workforce Observatory platform itself runs inside each client’s own perimeter — employee data processed there is governed by the client’s policies and the Data Processing Agreement between us.

What we collect

• Contact and lead forms — name, work email, company, role and your message, when you submit them.
• Newsletter — your email address, when you subscribe.
• First-party analytics (only after you accept analytics cookies) — a pseudonymous visitor id and session id stored in our own cookies (wo_vid, wo_sid, wo_vc, wo_attr), the pages you view, your country from the request header, and first-touch attribution (referrer, UTM parameters).
• Chat assistant messages — the conversation you type is sent to Cloudflare Workers AI to generate a reply and is stored server-side (keyed to the anonymous visitor cookie, deleted after 90 days) so we can understand what visitors ask and prepare better answers. Do not share personal or sensitive data in chat.
• Bookings — if you schedule a call through our embedded calendar, Cal.com processes your name, email and chosen slot as our processor.
• Support portal — account data and ticket content for clients, covered by the agreement and DPA.

What we never do

• No third-party advertising trackers, no social media pixels, no fingerprinting.
• We do not sell, rent or share your data with advertisers or data brokers.
• We do not identify anonymous visitors — the visitor id stays a random cookie until you choose to submit a form.
• We do not collect employee data on this website — that belongs to client deployments, inside their perimeter.

Why we process (legal bases)

• Consent — analytics cookies and the newsletter; you can withdraw either at any time from the cookie preferences or the unsubscribe link.
• Steps before a contract — answering your demo or contact request, scoping a diagnostic, sending the resources you asked for.
• Legitimate interest — proportionate B2B follow-up to your enquiry, securing the website (rate limiting, abuse protection) and keeping basic server logs.

Who processes data for us

• Cloudflare — site hosting, Workers AI (chat replies), Turnstile bot protection, privacy-preserving web analytics.
• Brevo — transactional and marketing email delivery.
• Cal.com — meeting scheduling, when you book a demo.
• LinkedIn — only if we run campaigns: a hashed version of your email may be sent to LinkedIn’s Conversions API to measure campaign outcomes. Raw emails never leave for advertising purposes.

Each processor is bound by a data processing agreement. The current list also lives in the Trust Center (/en/trust) and is updated before changes take effect.

How long we keep it

• Analytics events and chat transcripts — deleted after 90 days.
• Leads and enquiries — kept while the conversation is active, then archived or deleted when there is no ongoing reason to keep them.
• Newsletter — until you unsubscribe.
• Contract and billing records — as required by accounting law.

Your rights

You can request access, correction, deletion, restriction, portability or object to processing at any time — write to privacy@workforceobservatory.com. If you believe we mishandled your data, you can complain to the Romanian supervisory authority (ANSPDCP) or your local data protection authority.

Cookies we set

• wo_vid — anonymous visitor id, first-party, 1 year (analytics, consent-gated).
• wo_sid — rolling session id, ~30 minutes (analytics).
• wo_vc — visit count that powers the welcome-back note (analytics).
• wo_attr — first-touch attribution: referrer and UTM parameters (analytics).
• Cookie consent choice — remembers your decision.
• Cloudflare may set strictly-necessary security cookies (e.g. Turnstile).