Privacy Policy

Data Controller and Data Processor

ProtoHR operates as both a data controller (for account and billing data we collect directly) and a data processor (for employee and HR data entered by your organisation). Your organisation is the data controller for all employee personal data processed within your tenant.

Where we act as a processor, we process employee data only on your organisation’s documented instructions and in accordance with a Data Processing Agreement (“DPA”) that forms part of our Terms of Service.

Categories of Personal Data We Process

2.1 Account and Billing Data

• Full name, work email address, and password (hashed).
• Company name, billing address, VAT / tax identification number.
• Payment card details (handled directly by Stripe; we store only the last four digits and card type).
• Subscription plan, billing cycle, and invoice history.

2.2 Employee HR Data

• Identity data — full legal name, date of birth, gender, nationality, national ID or passport number.
• Contact data — personal and work email, phone number, home and work address.
• Employment data — job title, department, employment type, start and end dates, employment contract, probation period, notice period.
• Payroll and compensation data — salary, pay grade, bonuses, deductions, bank account details, tax codes, national insurance / social security numbers, payslips.
• Attendance and time data — clock-in/out records, timesheets, shift patterns, overtime.
• Leave data — leave requests, leave type, approval status, leave balances (including sick leave, annual leave, maternity/paternity leave).
• Performance data — appraisals, goals, feedback, disciplinary records (where your organisation chooses to record these).
• Documents — contracts, offer letters, certificates, ID documents, and other HR documents uploaded to the document vault.
• Special category data — health or disability information, where voluntarily provided by your organisation for payroll or accommodation purposes, processed under explicit consent or a legal basis established by your organisation.
• Emergency contacts — name and phone number of an employee’s designated emergency contact.

2.3 Usage and Technical Data

• IP addresses, browser type and version, operating system.
• Pages and features accessed, timestamps, session duration.
• Audit logs recording actions taken within the platform (e.g., who viewed or modified a record).
• Error and diagnostic logs for support and security purposes.

Legal Bases for Processing

We and your organisation rely on the following legal bases depending on the context:

• Contract — processing necessary to provide the Services under our agreement with you, including account management, billing, and payroll calculations.
• Legal obligation — processing required to comply with applicable employment law, tax law, social security regulations, and financial reporting obligations.
• Legitimate interests — improving platform security, preventing fraud, generating aggregated analytics, and maintaining audit trails for accountability.
• Consent — where we or your organisation rely on consent (e.g., optional analytics cookies or processing special category health data), you or your employees may withdraw consent at any time without affecting the lawfulness of prior processing.

How We Use Personal Data

• Provisioning and managing your tenant account and user access.
• Processing payroll runs, generating payslips, and calculating deductions.
• Managing leave requests, approvals, and balances.
• Recording and reporting time and attendance.
• Generating HR reports and analytics for your organisation.
• Sending transactional notifications (payslip ready, leave approved, password reset).
• Processing subscription payments and issuing invoices.
• Maintaining security audit logs and detecting unauthorised access.
• Providing customer support and resolving technical issues.
• Complying with legal and regulatory obligations.
• Improving and developing the platform (using aggregated, de-identified data only).

We never sell personal data to third parties. We do not use employee data for advertising or profiling unrelated to your organisation’s HR purposes.

Data Sharing and Sub-Processors

We engage the following categories of sub-processors to operate the Services. All sub-processors are bound by data processing agreements and are required to implement appropriate technical and organisational security measures.

We may also disclose personal data (i) when required by law, court order, or regulatory authority; (ii) to enforce our agreements; or (iii) to protect the rights, property, or safety of ProtoHR, our customers, or others.

Employee Data — Your Organisation's Responsibilities

As the data controller for your employees’ personal data, your organisation is responsible for:

• Providing employees with a privacy notice explaining that their data is processed in ProtoHR.
• Establishing and maintaining an appropriate legal basis for processing each category of employee data.
• Ensuring that special category data (e.g., health information) is collected only with explicit consent or under another valid legal basis.
• Honouring employee data subject rights requests (access, correction, erasure) within statutory timeframes.
• Maintaining accurate records of processing activities as required by applicable data protection law.
• Notifying ProtoHR promptly if an employee exercises a right that requires our technical assistance.

Sensitive and Special Category Data

Certain HR processes may require processing of special category personal data under GDPR Article 9 or equivalent national law, including:

• Health and disability data — for sick leave management, reasonable adjustments, or occupational health records.
• Biometric data — if your organisation uses biometric time-and-attendance hardware integrated with the platform.
• Religious or belief data — where recorded for leave entitlement purposes (e.g., religious public holidays).

ProtoHR applies encryption at rest and strict role-based access controls to all special category fields. Your organisation must ensure a valid legal basis exists before entering such data into the platform.

Payroll Data Security

Payroll data — including bank account details, salary information, and tax identifiers — is treated as highly sensitive. We apply the following controls specifically to payroll data:

• Column-level AES-256 encryption for bank account numbers and national ID / tax numbers at rest.
• Access restricted to users with the explicit "Payroll" role assigned by your tenant administrator.
• All payroll-related actions (view, edit, run, export) are recorded in an immutable audit log.
• Payslips are delivered to employees via encrypted in-app access; bulk exports require administrator authorisation.
• We do not transmit raw bank details to any third party; payroll disbursement integrations use tokenised references only.

Access Controls and Authentication

Access to data within ProtoHR is governed by role-based access control (RBAC). Roles are assigned by your tenant administrator and determine which modules and employee records each user can view or modify. We support:

• Multi-factor authentication (MFA) — available and recommended for all users, mandatory for tenant administrators.
• Single sign-on (SSO) — SAML 2.0 and OAuth 2.0 integrations with your identity provider.
• Session timeouts and automatic logout after periods of inactivity.
• Forced password change on first login for provisioned accounts.
• Audit logging of all authentication events including failed login attempts.

Data Retention

We retain data according to the following schedule:

Your organisation may configure shorter retention periods within the platform. Statutory minimum periods cannot be shortened where they apply.

International Data Transfers

ProtoHR may process data in countries outside your jurisdiction. For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on one or more of the following safeguards:

• European Commission Standard Contractual Clauses (SCCs) incorporated into our sub-processor agreements.
• Adequacy decisions where applicable.
• Binding Corporate Rules where relevant.

For transfers involving employee data subject to other national data protection laws (e.g., PDPA, POPIA, PDPL), we apply equivalent contractual safeguards. A copy of our transfer mechanism documentation is available upon request.

Security Measures

We implement the following technical and organisational measures:

• Encryption in transit — TLS 1.2+ for all data in motion.
• Encryption at rest — AES-256 for databases, object storage, and sensitive fields.
• Tenant isolation — each organisation’s data is logically separated; cross-tenant access is not possible by design.
• Vulnerability management — regular dependency audits, automated scanning, and a responsible disclosure programme.
• Backup and recovery — daily encrypted backups with point-in-time recovery capabilities.
• Incident response — documented procedures for detecting, containing, and notifying affected parties of data breaches.
• Access reviews — periodic reviews of internal staff access to production systems.
• Penetration testing — conducted at least annually by independent third parties.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, ProtoHR will:

• Notify affected tenant administrators without undue delay and within 72 hours of becoming aware, where required by applicable law.
• Provide sufficient information to enable your organisation to meet its own notification obligations to supervisory authorities and affected data subjects.
• Document all breaches internally, including those not meeting the notification threshold.

Your organisation remains responsible for notifying the relevant supervisory authority and affected employees in accordance with applicable data protection law.

Cookies and Tracking

We use the following categories of cookies:

• Strictly necessary — session authentication cookies required for the platform to function. These cannot be disabled.
• Functional — cookies that remember your preferences (e.g., language, theme). You may disable these without affecting core functionality.
• Analytics — aggregated, anonymised usage data to help us improve the product. You may opt out via our cookie banner or your browser settings.

We do not use advertising or cross-site tracking cookies.

Your Rights as a Data Subject

Depending on your location and the applicable data protection law, you (or your employees) may have the following rights:

• Right of access — obtain a copy of the personal data held about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention requirements.
• Right to restriction — request that we limit processing in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or similarly significant effects.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint — with your local data protection supervisory authority.

Employee requests should be directed to your HR department in the first instance. For requests relating to our own processing, contact us at [email protected]. We will respond within 30 days (or the statutory period applicable in your jurisdiction).

Automated Processing and Profiling

ProtoHR does not use employee data for automated profiling or make automated decisions that produce legal or similarly significant effects on individuals. All HR decisions (performance ratings, disciplinary actions, terminations) are made by authorised human users within your organisation.

Third-Party Integrations

If your organisation connects ProtoHR to third-party services (e.g., accounting software, payroll bureaus, identity providers), data shared with those services is governed by their own privacy policies. Your organisation is responsible for ensuring that any integration is compliant with applicable data protection law and that employees are informed of such sharing where required.

Children's Privacy

The Services are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor’s data has been submitted to the platform, please contact us immediately at [email protected].

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the Services. We will notify tenant administrators of material changes by email and by posting an updated version on this page with a revised “Last updated” date at least 30 days before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

Contact and Data Protection Officer

For any questions, requests, or concerns regarding this Privacy Policy or our data processing practices, please contact:

If you are located in the EU/EEA and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant EU supervisory authority).