Last Updated: 14 July 2026

Introduction

This Privacy Notice explains how Bridgit Pay Ltd collects and handles your personal information, and applies to all of our Services, which includes our website. Through our product offerings, Customers and their employees can create pay reports and information pertaining to pay gaps in the organisation. We value your trust and take our privacy obligations seriously. We have developed this Privacy Notice to provide you with detailed information about how your personal information and data is collected, held, and processed by Bridgit Pay Ltd.

This notice (together with our Terms and Conditions and any other documents it refers to) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and any subsequent UK data protection legislation, the data controller for data that we collect from you is Bridgit Pay Ltd (Company Number: 16980884 registered in England and Wales), whose registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. Bridgit Pay Ltd is registered as a data controller with the Information Commissioner's Office (ICO) in the United Kingdom, registration number ZC187876.

Bridgit Pay Ltd is the data controller for the information we collect about you directly, such as your account, contact and website usage data. For pay and demographic data provided by your Company to generate pay gap reports ("Customer Data"), your Company is the data controller and Bridgit Pay Ltd acts as a data processor on its behalf.

By using Bridgit’s services, you acknowledge that you have read and understand this Privacy Notice.

Contact us:
If you have questions regarding this Privacy Notice, please contact us by email: team@bridgitpay.com.

What type of information is collected from you and how is this collected?

The information we collect about you will depend on the way that you use our Services and which Services you avail of. We will only collect personal information which is necessary to deliver our Services. Pay data is held in pseudonymised form: employees are identified by a unique identifier supplied by your Company rather than by name, our data model has no employee-name field, any name columns present in uploaded files are discarded on ingest and never stored, and raw upload files are not retained. Access is restricted to your Company's authorised administrators.

• Customer or Company means, in relation to you, the person or entity that has contracted with Bridgit Pay Ltd to allow you to use Bridgit’s Services. The Customer or Company will generally be your employer, or an identified subgroup (i.e., division, department, etc.) within your employer;

• Administrator means any person who has log in credentials to a Customer account to manage that account, run reports, review and share pay gap data, or manage the account to enable individual users to provide feedback;

• Visitor means any person who visits our Website(s).

Information we collect includes:

• Contact information: When you provide us with your contact information, whether through use of our Services, creation of an account, a form on our website, or an interaction with our sales or customer support team, we collect your contact information. This information may include, for example, your name and email address.

• Usage information: We collect usage data about you whenever you interact with our Services. This may include which web pages you visit, what you click on, when you performed those actions, and other activities. You can manage your cookie preferences via the cookie preferences manager.

• Device and browser data: We collect data from the device you use to access our Services, such as your IP address, operating system, browser details and time of visit. This information may also tell us your location.

• Cookies and page tags: We use third party tracking services that employ cookies and page tags (also known as web beacons) to collect aggregated and anonymous data about Visitors to our Websites. This data includes usage details and user statistics. You can manage your cookie preferences via the cookie preferences manager.

• Other data you submit: We may collect your personal information or data if you submit it to us in other contexts. For example, by giving us a testimonial, attending an event we host or entering a contest. We may also collect personal information at other points throughout our Services or within our website that states personal information is being collected. If you contact us at team@bridgitpay.com, we will also collect any information that you provide to us voluntarily, such as your operating system version, and other requested information in order for us to respond to your request.

• Information collected from your Company: Your Company will provide us with data to calculate the pay gap at your organisation. This includes demographic and pay data about employees, held in pseudonymised form: employees are identified by a unique identifier supplied by your Company rather than by name, and any name columns present in uploaded files are discarded on ingest and never stored. We process this data solely on your Company's behalf and on its instructions: for this data, your Company is the data controller and Bridgit Pay Ltd is a data processor. If you are an employee with questions about how your pay data is used, please refer to your employer's privacy notice in the first instance.

We may collect the following information about Administrators:

• Registration details: When you register an account or another Administrator creates an account for you, we collect your name, company name, email address, password, and other information.

• Billing details: If you use a credit card for billing, our credit card processor may collect information such as the cardholder’s name, billing address, email address, credit card number, expiry date and credit card security code.

• Account settings: You may be able to set or update various preferences and personal details on your account settings page or your profile. For example, your name, email address, default language or time zone.

How is your information used?

Depending on which Bridgit services you avail, the personal information collected is used for the purposes of:

• Identity verification: This information is used to confirm your identity when registering for access to our services. The information is matched against our existing records to allow you to login.

• Pay Gap Reporting: The information we collect is used to generate pay gap reporting. This reporting is aggregated data and does not personally identify any individual.

• Communication with Bridgit: If you send us an email, we will use your email address to respond to your query and to keep a record of our correspondence.

• Creating aggregated de-identified data: We may create aggregated de-identified data for any purpose derived from data we hold about you. For example, we may create aggregated de-identified data to share with customers, prospects, partners for business or research purposes, or for provision of our Services.

• Preventing harm: We may disclose your personal information to your Company or relevant authorities if your use of our Services indicates an imminent risk of harm to you or to others around you.

We will not sell or rent your information to third parties.

We will not share your information with third parties for marketing purposes.

Who has access to your information?

Your information will be accessible to Bridgit administrators and by your Company’s Administrator. Pay gap data is held in pseudonymised form, and reports are aggregated.

In addition, we may pass your information to our third-party service providers, subcontractors, and associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example to process payment transactions). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing purposes, unless you have requested us to do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.

We may disclose your information if we are under a duty to disclose or share your personal data to comply with any legal obligation, or to enforce or apply our Terms and Conditions and other agreements; or to protect the rights, property, or safety of Bridgit Pay Ltd, our users, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

How we use AI

Some Bridgit features use artificial intelligence to explain results in plain language. For example, generating written commentary on your pay gap figures, suggesting how spreadsheet columns map to our template, and analysing job descriptions you submit.

All AI processing takes place on Amazon Bedrock hosted in the European Union (Ireland). By design, our AI features work from aggregated statistics and document structure rather than employee-level records: pay gap commentary is generated from summary figures only, and column-mapping suggestions use column headings and a small sample of non-identifying cell values so never names, identifiers, or personal details. Data submitted to our AI features is never used to train AI models, and the model provider has no access to it. AI-generated text is validated against the underlying calculated figures before it is shown meaning the numbers in your reports are always computed directly from your data, never by AI.

A current list of our service providers, including our AI infrastructure provider, is available on our Sub-processors section below.

Our sub-processors

Bridgit Pay Ltd uses a small number of third-party service providers ("sub-processors") to help deliver our Services. This list covers the sub-processors that may process Customer Data (the pay and demographic data your Company provides to generate pay gap reports) or account data on our behalf. Each sub-processor is bound by a data processing agreement that imposes data protection obligations materially no less protective than our own commitments to you, and each processes data only to the extent necessary to provide our Services.

We will give customers at least 30 days' notice before adding a new sub-processor, in line with our Terms and Conditions. To receive these notices by email, contact team@bridgitpay.com.

Your choices

You can change your marketing preferences at any time by unsubscribing from emails, choosing the unsubscribe option on our website or by emailing us at team@bridgitpay.com.
You can delete your account and associated profile in the Bridgit platform through your Company Administrator, or by emailing us at team@bridgitpay.com.

How you can access and update your information

You can update your details by logging into the Bridgit platform and viewing your profile, then writing to your Company Administrator to update.
Alternatively, if you wish to change your details or any of the other information, we hold is inaccurate or out of date, please email us at: team@bridgitpay.com.

Security precautions in place to protect the loss, misuse, or alteration of your information

Data is encrypted in transit using TLS 1.3 and at rest using AES-256, on infrastructure providers holding independent security certifications (ISO 27001, SOC 2 Type 2). Access to the platform is restricted to authenticated users and protected by multi-factor authentication.

Non-sensitive personal data (e.g., your email address) is transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our sites or applications, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Your rights

You are responsible for ensuring that the information you provide to us is accurate, complete, and up to date. You can review your information by logging into Bridgit and visiting your profile page. To request a change to your information you can do so by writing to your Company Administrator, or by emailing team@bridgitpay.com.

You have a number of rights in relation to your personal data, these include the right to:

• find out how we process your data;

• request that your personal data is corrected if you believe it is incorrect or inaccurate

• request that your data is deleted (within 30 days);

• obtain restriction on, or object to, processing of your personal data;

• if we are relying on consent, you can withdraw your consent to our processing of your personal data (including any direct marketing);

• if we are relying on legitimate interests for direct marketing, you can object to receiving such direct marketing;

• obtain a copy of the personal data we process concerning you. Contact us at team@bridgitpay.com and we will provide a copy within one month.

• lodge a complaint with the Information Commissioner’s Office (the ICO). If you have a concern or complaint about the way we handle your data, we ask that you contact us in the first instance to allow us to investigate and resolve the matter.

If you would like to exercise any of your rights or find out more, please contact us at team@bridgitpay.com.

Legal basis for processing your data

We may process your data because:

• We are legally obliged to confirm your identity, or

• We have your consent to register for the Services; or

• The processing is necessary for the performance of the contract with you or your employer to provide our services; or

• It is in our legitimate business interests to do so.

• In some instances, we will rely on your consent to process personal data and where we do this, you will be made aware.

How long do we keep your personal information?

Account data: your personally identifiable data (such as your name and email address) will be erased if your account is deactivated by your employer or if your employer terminates their contract with Bridgit Pay Ltd.

Customer Data (pay and demographic data): retained for the duration of your Company's contract and deleted on termination in line with our Terms and Conditions. Backup copies are retained for up to 90 days for disaster recovery, after which they are permanently deleted.

Aggregated statistics: we may retain aggregated, de-identified statistics (which identify no individual) as described in our Terms and Conditions.

IP addresses

When you access our Services, we collect technical information from your device, including your IP address, operating system type, and browser version. We use this information for system administration and security purposes, such as maintaining the security of our Services, diagnosing technical issues, and understanding how our website is used in aggregate. We treat this information as personal data under UK GDPR and handle it in accordance with this Privacy Notice. It is retained only for as long as needed for these purposes.

Use of 'cookies'

Our site makes use of cookies to distinguish you from other users of our website. This helps us to provide you with a positive experience when you browse our website and allows us to improve our site.

'Cookies' are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns. Some cookies contain identifiers that are personal data under UK GDPR, and we handle them in accordance with this Privacy Notice; you can manage your preferences via the cookie preferences manager or your browser settings. As an example, we make use cookies to store your country preference. This assists us to improve our website and deliver a better more personalised service.
It is possible to turn off cookies by setting your browser preferences. Turning cookies of may result in reduced functionality when using our website.

Changes to our privacy notice

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Review of this notice & Contact

We keep this notice under regular review. This Privacy Notice was last updated in July 2026. Questions, comments, and requests regarding this Privacy Notice are welcomed and can be submitted to team@bridgitpay.com.