Privacy Policy

Draft. This policy is a working draft and must be reviewed by a solicitor before launch. Details in [brackets] need completing.

Last updated: [date]. [Legal entity name and address] ("SyncFlowHR", "we") provides the SyncFlowHR application. This policy explains what personal data we hold and how we use it.

Two different roles

Customer HR data. Everything a customer puts into its workspace (employees, leave, documents, pay and so on) is that customer's data. For it, the customer is the data controller and SyncFlowHR is its processor, acting on the customer's instructions under our Terms and a data-processing agreement, which we can provide on request. If you are an employee and want to see or correct your data, please ask your employer's HR administrator.

Account and website data. For the information described below about customers and website visitors, SyncFlowHR is the controller.

What we hold as controller

Account owners: name, work email, company name, workspace address, plan, billing status, headcount (a number, not names) and the dates of key account events.
Billing: handled by Stripe. Card details go directly to Stripe and are never stored by us. We keep the Stripe customer and subscription identifiers.
Contact forms and support requests: what you write and the email address you give.
Technical logs: request logs and error messages needed to run and secure the service.

Why we use it, and our legal basis

To provide the service and manage your subscription (performance of a contract).
To send account, security and billing emails (performance of a contract; legitimate interests).
To answer your questions and give support (legitimate interests).
To keep the service secure and prevent abuse (legitimate interests).
To meet legal, tax and accounting obligations (legal obligation).

We do not sell personal data, and we don't use advertising or analytics trackers on this website. See our cookie notice.

Counting visits to this website and the demo

To see how many people visit this website and try the demo, each page you open sends one small request to our own server; no cookies, no browser storage and no other company is involved. We count you once a day using a code made from your IP address, browser type and a random value that we keep only in memory and replace every day, so the code can't be turned back into your address or linked to your visits on other days. We store only that day's code (deleted after 2 days) and daily totals, such as visitors, pages opened, the website that linked to us (its name only) and which parts of the demo were opened. Your IP address and browser details are never stored. If your browser sends Do Not Track or Global Privacy Control, your visits are not counted at all.

Separation of customers' data

Each workspace has its own database and uploads folder. Sign-in sessions are valid for one workspace only. See Security.

Who else handles data

Stripe (payments), our hosting provider [name, location] and our email provider [name]. Each acts as a processor or independent controller under its own terms. [List sub-processors and transfer mechanisms.]

How long we keep it

Account data is kept while your subscription is active and for [period] afterwards for accounting and dispute purposes. Cancelled workspaces are kept read-only for [30/60/90] days, then deleted, unless you ask us to delete them sooner. Support messages are kept for [period].

Your rights

You can ask for access to, correction, deletion or portability of your personal data, object to or restrict certain processing, and complain to the Data Protection Commission. Contact us at [email protected].

Security

We use technical and organisational measures appropriate to the risk, including separate storage per customer, hashed passwords, two-factor sign-in for privileged users, and an audit log.

Changes

We'll post updates here and, for material changes, email workspace owners.