Privacy Policy

1. Introduction

N Family Holdings Limited, trading as N Family Club ("we", "us", or "our"), located at 47-49 Charlotte Road, London, EC2A 3QT, United Kingdom, operates the n.tranet application (the "Service"), an internal staff intranet accessible at nfamilyclub.com.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Service. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

N Family Holdings Limited is the data controller responsible for your personal data. If you have any questions about this policy or our data practices, please contact our Data Protection team at: dataprotection@nfamilyclub.com

3. Data We Collect

When you sign in to the Service using your Google account, we collect and process the following data:

• Account information: Your name, email address, and profile picture as provided by Google OAuth.
• Authentication data: Authentication tokens and session identifiers managed by our authentication provider, Clerk.
• Usage data: Pages visited, features used, and interactions within the Service for the purpose of improving the user experience.
• Google Calendar data: Event summaries, times, and locations from our shared organisational calendar. This data is fetched server-side using a Google Service Account and is not associated with your personal Google account. We do not request access to your personal calendar. Calendar data is cached briefly in memory and is not permanently stored.
• Chat data: Messages and queries submitted through the AI chat feature within the Service.

4. How We Use Your Data

We use your personal data for the following purposes:

• To authenticate your identity and provide access to the Service.
• To manage your user account and permissions (including manager access levels).
• To provide and maintain the Service, including the AI-powered chat assistant.
• To display shared organisational calendar events on your dashboard. Calendar data is retrieved server-side via a service account and does not involve your personal Google credentials.
• To improve and personalise your experience on the Service.
• To monitor usage patterns and analyse performance using Vercel Analytics.
• To communicate important updates about the Service.

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• Legitimate interest: To operate and improve the Service as an internal staff tool for N Family Club employees and authorised users.
• Performance of a contract: Where processing is necessary for the performance of your employment contract or your engagement with N Family Club.
• Consent: Where you have given explicit consent, such as when signing in via Google OAuth.

6. Third-Party Services

We use the following third-party services to operate the Service:

• Google OAuth: For user authentication only. We request only the minimum permissions necessary to verify your identity (name, email, and profile picture). No calendar permissions are requested from your Google account. See Google's Privacy Policy.
• Google Calendar API (Service Account): We use a Google Service Account to fetch events from our shared organisational calendar. This access is server-side and does not involve your personal Google credentials or calendar. Calendar data is cached briefly in memory and is not permanently stored.
• Clerk: For authentication and session management. See Clerk's Privacy Policy.
• Convex: For backend data storage and real-time functionality. See Convex's Privacy Policy.
• Vercel: For hosting and analytics. See Vercel's Privacy Policy.
• OpenAI: For AI-powered chat features. Chat messages may be processed by OpenAI. See OpenAI's Privacy Policy.
• Sanity: For content management. See Sanity's Privacy Policy.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If your employment or association with N Family Club ends, your account data will be removed within a reasonable timeframe. Authentication session data is managed by Clerk and is subject to their retention policies.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted data transmission via HTTPS/TLS.
• Authentication managed by industry-standard providers (Clerk, Google).
• Role-based access controls within the Service.
• Regular review of security practices.

9. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate personal data.
• Right to erasure: You may request deletion of your personal data in certain circumstances.
• Right to restrict processing: You may request restriction of processing of your personal data.
• Right to data portability: You may request transfer of your data to another service.
• Right to object: You may object to processing of your personal data based on legitimate interest.

To exercise any of these rights, please contact us at dataprotection@nfamilyclub.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Cookies

The Service uses essential cookies required for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use cookies for advertising or marketing purposes.

11. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in compliance with the UK GDPR.

12. Children's Privacy

The Service is intended for use by N Family Club staff and authorised personnel only. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes via the Service. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: