This Privacy Policy explains how Digital Sparrow (“we”, “us”), based in Nicosia, Cyprus, collects, uses and protects personal data when you use Evaltea, a performance management platform, and our website.
1. Our Role
Processor: for employee and performance data (objectives, KPIs, evaluations, incidents, reviews) that organisations enter into Evaltea, we act as a data processor on the instructions of the customer organisation, which is the data controller. See our Data Processing Agreement.
Controller: we act as an independent data controller for our own account administration, billing, security, support, product operations and website analytics.
If you are an employee whose data is in Evaltea, please contact your employer first about how your data is used.
2. Where Data Comes From
Personal data may come directly from you, or from your employer, organisation administrator, manager or another authorised user of your organisation’s workspace.
3. Information We Collect
3.1 Account Information
Name, email address, job title
Profile information (e.g. photo)
3.2 Organisation Data
Organisation name and logo
Organisational structure (units, teams, reporting lines)
User roles and permissions
3.3 Performance Data
Objectives and KPIs
Competency evaluations, self-evaluations and manager evaluations
Incident logs (positive and negative)
Performance reviews and comments
3.4 Usage Data
Login and activity logs, feature usage
Device and browser information, IP address
3.5 Support Communications
Support tickets, messages and related correspondence
3.6 AI Usage and Interaction Data
Inputs sent to AI features (e.g. incident descriptions, evaluation context) and the generated outputs
AI usage counts and credit balances
3.7 Billing and Payment Data
Payments are processed by Stripe. We do not store full card details. We may store billing email, plan and subscription status, number of seats, credit purchases and invoice information. Stripe processes payment data under its own privacy policy.
4. Purposes and Lawful Bases
Providing the service and managing accounts — performance of a contract, or steps taken before entering into a contract.
Billing and accounting — performance of a contract and compliance with legal obligations.
Security, fraud prevention and service improvement — our legitimate interests, where applicable.
Analytics and optional cookies — your consent, where required.
Marketing communications — consent or legitimate interests, as applicable; you can opt out at any time.
Employee performance data — processed by us as a processor on the customer’s instructions; the customer determines the lawful basis.
5. AI Features
Evaltea uses AI to help suggest KPIs, classify incidents, suggest competency evaluations and draft review content.
Relevant inputs may be sent to AI service providers acting as our subprocessors or service providers, only to generate the requested output.
Please avoid entering unnecessary special-category or sensitive data (e.g. health, religion, political views).
AI outputs may be inaccurate and must be reviewed by a human before use.
We do not use customer data to train external AI models unless explicitly stated and permitted.
6. Data Sharing
We do not sell personal data. We share data only with service providers needed to operate Evaltea, including Stripe (payments), hosting and infrastructure providers, email delivery providers, AI service providers, and analytics tools (only with consent). These providers are bound by confidentiality and data protection obligations. We may also disclose data where required by law.
7. International Transfers
If personal data is transferred outside the EEA, the UK or another relevant jurisdiction, we use appropriate safeguards where required, such as adequacy decisions or Standard Contractual Clauses.
8. Data Retention
We retain personal data while your account or service relationship is active. After that, we keep it only as long as needed for recovery, legal, billing, security or compliance purposes. Specific periods depend on the type of data and our legal obligations. When an organisation is deleted, its data is deleted or anonymised within a reasonable timeframe, subject to these needs.
9. Data Security
We use appropriate technical and organisational measures, including secure authentication, encrypted connections (HTTPS) and role-based access controls. No system is completely secure, and we cannot guarantee absolute security.
10. Your Rights
Depending on where you are located (including under the GDPR), you may have the right to:
access your personal data;
correct inaccurate data;
request deletion;
restrict processing;
object to processing;
data portability;
withdraw consent at any time, where processing relies on consent;
lodge a complaint with a competent supervisory authority (in Cyprus, the Commissioner for Personal Data Protection).
For data your organisation controls, we will pass your request to, or assist, your organisation.
11. Organisation Responsibility
Customers using Evaltea are responsible for establishing an appropriate lawful basis for processing employee data and for providing employees with the required privacy information. Consent is not always the appropriate basis in an employment context.
12. Cookies and Tracking
Essential cookies and storage keep you signed in, remember preferences (such as your cookie choice) and keep the service secure. These are always on.
Analytics (Google Analytics, and Microsoft Clarity on our homepage and signup page) are used only after you accept analytics cookies. If you reject or make no choice, these analytics cookies are not set.
You can change your choice by clearing your browser storage for this site.
13. Changes to This Policy
We may update this Privacy Policy and will update the “Last updated” date. Material changes will be communicated where required.
14. Contact
For any questions or data requests, please contact us.
15. Governing Law
This Privacy Policy is governed by the laws of Cyprus.