Privacy Policy
1. Who we are
ComplyHR is operated by Click Design Ltd (Company No. 13679389), Peter House, Oxford Street, Manchester, M1 5AN, United Kingdom. For anything in this policy, contact mahmood@clickdesign.uk.
2. Two kinds of personal data
Account data — your name, email address and company details when you register. For this data we are the controller. We use it to provide the Service, send service emails (such as compliance digests and password resets), and handle billing.
Employee records — the data your organisation stores about its employees: personal details, National Insurance numbers, visa and immigration records, right to work evidence and identity documents. For this data your organisation is the controller and we are your processor: we store and process it only on your instructions, to provide the Service, and never use it for our own purposes.
3. How employee records are protected
- Identity documents are stored encrypted at rest, under randomised names, outside the web-accessible area of our servers.
- Every document download is recorded in your account's audit log.
- Access within your account is limited by the roles you assign — the Viewer role cannot download identity documents.
- All traffic between your browser or app and our servers is encrypted (HTTPS).
4. Where data is stored and who helps us
Data is stored on servers under our control in the United Kingdom/EEA. We use a small number of service providers to run ComplyHR: our hosting provider, Paddle.com for payment processing (Paddle receives your billing details, never your employee records), and an email delivery provider for service emails. We do not sell personal data or share it with advertisers.
5. How long we keep data
Employee records are kept until you delete them or close your account. The Service flags records that pass the UKVI retention point (one year after sponsorship ends) so you can review them — deletion is always your decision as controller. When you delete your account, your organisation's records, documents and users are permanently deleted from the Service. Backups expire on a rolling schedule shortly afterwards.
6. Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. For account data, contact us. For employee records, employees should contact their employer (the controller); we will assist the employer in meeting those requests. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
7. Cookies
The Service uses only the cookies and browser storage needed to keep you signed in and operate the app. We do not use advertising or cross-site tracking cookies.
8. Changes
We may update this policy from time to time. Significant changes will be notified by email or in the app before they take effect.