Your data.
Handled responsibly.

Scope of this Privacy Policy

This policy applies when you:

• visit the HR SYSTEM website;
• contact us, request a demonstration or begin a trial;
• create or administer an HR SYSTEM account;
• use HR SYSTEM as an employee, manager or administrator;
• use the HR SYSTEM mobile application;
• use the AI HR Assistant;
• submit a support, privacy or data protection request; or
• interact with our communications and service notifications.

This policy does not replace an employer’s own employee privacy notice or legal responsibilities.

Data controller and processor roles

Website, sales and account administration

For information collected directly through our website, sales enquiries, product communications, account administration and support, HR SYSTEM will generally act as the data controller.

Customer workforce data

When an employer or other customer uploads or manages employee information in HR SYSTEM, that customer will normally be the data controller. HR SYSTEM will normally process that information on the customer’s documented instructions as its data processor.

The precise relationship may depend on the service, configuration and processing activity involved.

Personal data we may collect

The exact information collected depends on the services selected by the customer and the permissions assigned to each user.

How we use personal data

We may process personal data to:

• provide, maintain and secure HR SYSTEM;
• create and administer accounts;
• authenticate users and manage sessions;
• separate information by customer organisation;
• apply role-based access permissions;
• support employee management and onboarding;
• record attendance, leave and workplace activity;
• prepare HR and payroll-ready records;
• store documents and workplace policies;
• provide company news and notifications;
• operate the AI HR Assistant;
• answer enquiries and provide support;
• monitor service reliability, security and performance;
• detect misuse, fraud or unauthorised access;
• maintain audit trails and compliance records;
• improve our services and user experience;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims.

We do not sell employee personal data.

Legal bases for processing

Where HR SYSTEM acts as a controller, the lawful basis depends on the purpose and circumstances. It may include:

• Contract: processing necessary to provide requested services or take steps before entering a contract.
• Legitimate interests: operating, securing and improving HR SYSTEM, communicating with business users and preventing misuse, where those interests are not overridden by individual rights.
• Legal obligation: processing needed to comply with applicable law.
• Consent: where consent is requested for a specific optional activity.

Employers using HR SYSTEM are responsible for selecting and documenting their own lawful bases for processing employee information.

Where special category information is processed, the controller must also identify an applicable additional condition under data protection law.

Employee and company data

HR SYSTEM is designed as a multi-company platform. Customer information should be logically separated so that authorised users can only access information made available to their organisation and role.

Company administrators may configure employees, managers, departments, locations, shifts, documents, policies, workflows and permissions.

Customers are responsible for:

• ensuring information entered into HR SYSTEM is lawful and accurate;
• providing appropriate privacy information to employees;
• assigning suitable access permissions;
• removing access when it is no longer required;
• responding to workforce privacy requests; and
• using HR SYSTEM in accordance with employment and data protection law.

AI HR Assistant data

HR SYSTEM’s planned AI HR Assistant is intended to answer workplace questions using company-specific information approved by the customer.

The AI HR Assistant may process:

• questions and prompts submitted by users;
• approved workplace policies and documents;
• customer-defined AI instructions;
• relevant source references;
• generated answers and user feedback;
• conversation history where enabled and permitted; and
• requests escalated to authorised HR personnel.

Users should not enter unnecessary sensitive personal information into an AI prompt. AI-generated information may be incomplete or incorrect and should not replace professional legal, employment, medical or financial advice.

Material employment decisions should not be based solely on an automated answer without appropriate human review.

Attendance, photographs and biometric information

Certain versions or configurations of the HR SYSTEM application may support profile photographs, attendance verification, camera access or face-related verification features.

Where a feature uses biometric data for the purpose of uniquely identifying an individual, that information may constitute special category personal data. Such a feature must only be activated where the customer has:

• identified a valid lawful basis;
• identified an applicable special-category condition;
• provided appropriate information to affected users;
• assessed necessity and proportionality;
• implemented appropriate safeguards; and
• completed any required data protection impact assessment.

Camera or photo permissions should only be requested when required for a user-selected feature. Device permissions can normally be managed through the device settings.

The customer remains responsible for determining whether biometric or attendance verification is lawful and appropriate for its workforce.

Cookies and analytics

HR SYSTEM may use cookies and similar technologies to keep the website secure, remember preferences, maintain sessions and understand service performance.

Cookie categories may include:

• Necessary cookies required for security, navigation and service functionality.
• Functional cookies used to remember optional settings and preferences.
• Analytics cookies used to understand website performance and feature usage, where permitted.
• Marketing cookies used only where implemented and where any required permission has been obtained.

Stripe payment technologies

When a customer enters a Stripe-hosted payment or subscription flow, Stripe may use cookies or similar technologies that are necessary to:

• secure the payment session;
• authenticate transactions;
• detect and prevent fraudulent activity;
• remember the state of a payment process;
• support regulatory and security requirements; and
• complete or manage a subscription transaction.

These technologies are generally necessary for secure payment processing when a user chooses to make a payment.

More detailed information will be available in our dedicated Cookie Policy .

When personal data may be shared

Payment processing through Stripe

Where customers purchase subscriptions, paid services or trials that convert to a paid plan, payments are processed securely through Stripe.

HR SYSTEM does not ordinarily receive or store complete payment card numbers, card security codes or other sensitive payment credentials. Payment details are submitted directly to Stripe through Stripe’s secure payment infrastructure.

Stripe may process information for:

• payment authorisation and settlement;
• subscription and recurring billing management;
• payment authentication;
• fraud detection and prevention;
• refunds and payment disputes;
• financial and regulatory compliance; and
• transaction security and service reliability.

Stripe processes payment information under its own privacy notice, terms and security procedures.

HR SYSTEM may receive limited information from Stripe, such as a transaction identifier, payment status, billing name, billing email, card brand, expiry details and the final digits of a payment card.

We may share personal data only where reasonably necessary with:

• the customer organisation responsible for the account;
• authorised administrators, managers and HR personnel;
• hosting, infrastructure and cloud service providers;
• payment processors, including Stripe;
• email, communication and notification providers;
• security, monitoring and technical support providers;
• analytics providers where permitted;
• AI or technology providers used to provide configured features;
• professional advisers, insurers and auditors;
• regulators, courts, law enforcement or public authorities where legally required; and
• a buyer, investor or successor in connection with a legitimate corporate transaction.

Service providers should only receive the information necessary for their function and should be subject to appropriate contractual and confidentiality obligations.

We do not permit service providers to use customer workforce information for their own unrelated purposes.

International data transfers

Some service providers may process information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we will seek to use an appropriate transfer mechanism.

Depending on the destination, this may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another lawful safeguard or permitted exception.

Customers may contact us for additional information about relevant transfer arrangements.

Security and encryption

HR SYSTEM uses or plans to use proportionate technical and organisational safeguards based on the nature of the service and information involved.

These safeguards may include:

• encrypted HTTPS connections;
• secure password handling and authentication controls;
• role-based access permissions;
• logical separation of company accounts;
• restricted administrative access;
• security logging and audit trails;
• backup and recovery procedures;
• software maintenance and security updates;
• monitoring for suspicious or unauthorised activity; and
• incident response procedures.

No online system can guarantee absolute security. Users must protect their login credentials, use secure devices and report suspected unauthorised access promptly.

Data retention

Personal data is retained only for as long as reasonably necessary for the relevant purpose, including contractual, legal, accounting, security and dispute-resolution needs.

Retention periods may depend on:

• the customer’s instructions and account settings;
• the type and sensitivity of the information;
• the duration of the customer relationship;
• applicable employment, tax or record-keeping requirements;
• security, fraud-prevention and audit needs;
• backup cycles; and
• the establishment or defence of legal claims.

Following account closure, information may be deleted, anonymised or retained for a limited period where necessary and lawful.

Information contained in backups may remain until the relevant backup is securely overwritten in accordance with the applicable backup cycle.

Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

• be informed about the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request erasure of personal data;
• request restriction of processing;
• object to certain processing;
• request data portability;
• withdraw consent where processing relies on consent;
• ask for human intervention in relation to certain automated decisions; and
• complain to a data protection supervisory authority.

These rights are not absolute and may be subject to exemptions or legal retention requirements.

How to exercise your rights

For information controlled by your employer, contact your employer or HR department first. We may need to refer your request to the relevant customer organisation.

For information controlled directly by HR SYSTEM, email support@hrsystem.co.uk .

We may request information needed to verify identity and protect personal data from unauthorised disclosure.

Complaints to the ICO

Individuals in the United Kingdom may complain to the Information Commissioner’s Office. We encourage you to contact us first so that we have an opportunity to address your concern.

Visit the Information Commissioner’s Office for current guidance and contact information.

Children and young workers

HR SYSTEM is a business and workplace service and is not designed for general use by children.

Where a customer employs a young worker and lawfully records employment information, that customer is responsible for applying appropriate safeguards and complying with employment and data protection law.

Changes to this Privacy Policy

We may update this policy when our services, technology, suppliers or legal obligations change.

The latest version will be published on this page with an updated revision date. Where appropriate, material changes may also be communicated through the service, application or email.

Contact and data protection enquiries

Questions, privacy requests and data protection enquiries may be sent to:

HR SYSTEM
Owned and operated by NFCPay Technologies
Website: hrsystem.co.uk
Email: support@hrsystem.co.uk

You may also use our contact page .

Please do not send unnecessary sensitive employee information through an ordinary contact form.