This page explains how Float handles personal data under the General Data Protection Regulation (GDPR), the EU's law on personal data. Although we're a US-based org, GDPR is the standard other privacy laws get measured against, so it's our cornerstone.
AI hasn't changed what GDPR requires, but it raises the stakes. When our tools consume data to function, the questions about consent, purpose and access becomes more acute.
Here's what we hold and why. Anything tied to an identifiable person counts as personal data.
| Data | Why we collect it |
|---|---|
| Name and photo | Identification across our tools, team pages and internal profiles |
| Banking information | Payroll and reimbursements |
| Home address | Shipping welcome packs and SWAG from the meetups |
| Date of birth | Confirming minimum working age, health insurance docs |
| Personal email address | Contact outside of work systems (offboarding, personal emergencies) |
| Names of family members | Emergency contacts, health insurance docs, meetup logistics |
| Background checks | Verifying eligibility to work, where required |
| Slack posts about life events, family, medical status/history (special category data under GDPR, needs extra care), financial, travel | Not collected on purpose, just what naturally comes up in team conversation |
| Special categories, as per GDPR, are listed below: | Optional, if provided via your HiBob profile this data is used for internal demographic analysis |
| Gender | “ “ |
| Level | Data | Why we collect it |
|---|---|---|
| 👥 People managers | Performance, career development, personal situations (health, family or financial) shared in our tools | To support your growth and provide accommodation when needed |
| ⚙️ Operations (SRE and Biz Ops) | Data storage, tooling, governance | Keeps the systems above running safely and securely |
| ‣ CEO and CTO | Company goals and strategy, policy approval | Sets the direction everything else aligns with |
All personal data starts with you. Once it's with Float, the organization is responsible for keeping it safe and protecting your privacy, while you're here and after you leave. The responsibility is shared:
↓ It starts with a person. You share something (a home address, a health update, a life event) in a post, a DM to Ops, or through a manager.
↓ It lands in a tool. Slack, HiBob, 15Five, Notion: each has its own rules for who can see it, how long it's kept, and what happens on deletion or export.
↓ SRE and Ops set the guardrails. Retention periods, access controls and a data processing agreement are operational responsibilities, not individual ones.
Leadership sets direction and backs it up. Float as an organization is accountable under GDPR.
<aside>
🛠️ Controller and processors: under GDPR, Float is the controller: we decide why data is collected and what it's used for. Our tools (15Five, Kona, Pinpoint, Rippling, HiBob, Notion, Slack, Google Workspace including Gemini, Claude from Anthropic, and the rest) are processors. They handle data on our behalf, under a data processing agreement, within the boundaries we've set. That's why choosing and configuring vendors carefully is an operational responsibility.
</aside>
<aside>
⚠️ Approved tools only. Using anything outside the ‣ is a hard no: no DPA, no retention controls, and no way to trace or delete the data later.
Need something that isn't on the list? Ask in #open-it-ops. For AI tools, file a request in the AI Helpdesk.
</aside>