Privacy Notice

1. Who we are and how to contact us

Direct Payments HR is provided by Usayd Latif, trading as Direct Payments HR, of Novella Apartments 301, 15 Stanley Street, Salford, M3 5GT.

For privacy questions, requests or complaints, contact:

• Email: support@directpayments.app
• Post: Direct Payments HR, Novella Apartments 301, 15 Stanley Street, Salford, M3 5GT

2. When we are controller and when we are processor

Our role depends on why information is being used.

When we are controller

We are the controller when we decide why and how personal information is used for:

• setting up and administering user accounts;
• managing subscriptions, billing and contractual records;
• securing, maintaining and improving the Service;
• providing support and responding to enquiries or complaints;
• sending service communications and permitted marketing; and
• meeting our own legal and regulatory obligations.

This Privacy Notice applies directly to that processing.

When we are processor

An individual employer, Direct Payment recipient or authorised representative normally decides why and how PA and employment information is used inside their employer workspace. For that information, they are normally the controller and we process it on their instructions as their processor.

Examples include PA profiles, timesheets, holiday and absence records, expenses, employment documents, payroll-preparation records and audit history. The controller should provide PAs and other affected people with their own privacy information explaining how they use those records. Our data-processing obligations to the controller are set out in our Terms of Service.

If you are a PA and your question concerns employment information entered or controlled by your employer or their representative, contact them first. You may also contact us, and where appropriate we will refer the request to the relevant controller and help them respond.

3. Personal information we collect

The information we process depends on how you use the Service.

Account and contact information

• name, email address and contact details;
• account role, status and workspace membership;
• authentication identifiers and security settings; and
• subscription plan and account preferences.

We do not receive your password in readable form.

Recipient and representative information

• recipient name or preferred name;
• address, postcode and council or Direct Payment configuration;
• representative name, contact details, relationship and authority; and
• information needed to configure the employer workspace.

You do not need to provide a medical diagnosis to create an account. We do not use account information to infer, profile or advertise based on a person's health or disability.

PA and employment information

Information entered by an employer, representative or PA may include:

• identity and contact details;
• employment dates, job information, contracted hours and work patterns;
• clock-in and clock-out entries, breaks and timesheets;
• holiday requests, decisions and balances;
• sickness and other absence records;
• expenses, mileage and supporting receipts;
• payroll-preparation information and payroll contact details;
• employment, right-to-work and other supporting documents;
• workflow statuses, notifications, approvals and audit history; and
• leaver details and employment notes.

Some Customer Content may contain special-category information, such as health, disability or sickness information, or particularly sensitive identity and right-to-work documents. When we hold this information solely to provide the employer workspace, we act as processor and the employer or other controller is responsible for establishing the lawful basis, any UK GDPR Article 9 condition, transparency and retention rules.

Users should enter only information that is necessary for a supported HR purpose. Do not upload criminal-offence information, detailed medical records, bank account details or identity documents unless a supported workflow genuinely requires them and the controller has confirmed that doing so is lawful and appropriate.

Billing and transaction information

• billing name and address;
• subscription, invoice, payment status and transaction references; and
• limited information about failed, refunded or disputed payments.

Card and bank details are collected and processed by our payment-services provider. We do not store complete payment-card details.

Communications

• support enquiries and complaint correspondence;
• account invitations and service emails;
• delivery and response status for relevant messages; and
• communications that an authorised user asks the Service to send to a configured PA, payroll provider or Direct Payments contact.

Technical, usage and security information

• IP address, browser and device type;
• session, authentication and access information;
• date, time and approximate location derived from an IP address;
• error, performance and security events generated when the Service operates;
• limited diagnostic logs needed to investigate faults; and
• records of consent and preference choices.

We use this information to deliver and protect the Service and diagnose faults. We do not currently use analytics or advertising tracking on the website or in the Service.

4. Where the information comes from

We may receive personal information:

• directly from you when you create an account, use a workflow, contact us or make a payment;
• from an employer, Direct Payment recipient, nominated person or authorised representative;
• from a PA who accepts an invitation or submits information;
• from our service providers, such as confirmation of a payment or email-delivery status; and
• automatically from your browser, device and use of the Service.

The Service may derive administrative values from information users provide—for example, calculating worked minutes from recorded start, finish and break times. It does not independently verify that the source information is correct.

If you provide information about another person, you must have authority and a lawful reason to do so. Where required, you must give that person appropriate privacy information.

5. Why we use personal information and our lawful bases

Where we act as controller, we use personal information as follows:

Our legitimate interests include providing and improving a useful service, securing accounts and systems, preventing fraud and misuse, supporting users, communicating about the Service and protecting legal rights. We consider whether those interests are necessary and proportionate and whether they are overridden by the rights of the people concerned.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.

Special-category information when we are controller

We do not require health or disability details for our own account, billing or marketing purposes. Please do not include unnecessary health or other special-category information in a support request.

If special-category information is genuinely required for us to deal with a particular matter as controller, we will identify an appropriate Article 9 condition. This will normally be your explicit consent where we ask for it, or necessity for the establishment, exercise or defence of legal claims. If such information is sent unnecessarily, we will delete or redact it where reasonably possible.

6. Who we share information with

We share personal information only where necessary for the purposes described in this notice.

People authorised within the Service

Information may be visible to authorised users according to their role and relationship, including the relevant employer, Direct Payment recipient, representative and PA. Account Owners are responsible for choosing who to invite, assigning appropriate access and removing access when it is no longer needed.

Payroll providers, councils and other recipients selected by users

An authorised user may instruct the Service to export or send reviewed information to a payroll provider, council Direct Payments contact or another recipient they configure. We act on the user's instruction and do not decide whether that recipient should receive the information. Users must check the recipient and contents before sending.

Suppliers acting for us

We use carefully selected suppliers to provide functions such as:

• cloud hosting, database and private file storage;
• authentication and account security;
• transactional email and message delivery;
• subscription billing and payment processing;
• error monitoring, service diagnostics and security protection; and
• customer support and professional advice.

Most of these suppliers act as processors and may use personal information only to provide their contracted services to us, subject to appropriate confidentiality, security and data-protection obligations. A supplier may instead act as a separate controller for a limited purpose where it is required to make its own decisions—for example, a payment provider carrying out fraud prevention or meeting its legal obligations. Its own privacy notice will apply to that processing.

We may change suppliers as the Service develops without naming each supplier in this notice, but we will continue to assess their role, terms and safeguards.

Other disclosures

We may disclose information:

• to professional advisers, insurers and auditors where reasonably necessary;
• to courts, regulators, law-enforcement bodies or public authorities where required by law or a valid legal process;
• where necessary to establish, exercise or defend legal claims or protect a person's vital interests; or
• in connection with a genuine sale, reorganisation or transfer of the Service, subject to appropriate confidentiality and notice where required.

We do not sell personal information. We do not share Customer Content with advertisers or use it for advertising profiles.

7. Where information is stored and international transfers

Direct Payments HR is based in the United Kingdom. Our primary production database and private file storage are configured in a London, United Kingdom hosting region. This is where Customer Content—including PA records, timesheets, holiday and absence information, expenses and uploaded employment documents—is primarily stored.

Limited operational information may still be processed by another technical supplier where necessary to deliver the Service. For example, a hosting provider may handle an IP address and request metadata, an email-delivery provider must handle the recipient's email address and the message being sent, and a payment provider must process billing and transaction information. These providers do not have general access to the employer-workspace database; they process only the information needed for their particular function. If an authorised user asks the Service to send workflow information by email, that message must pass through the email-delivery provider.

If a supplier stores or accesses personal information outside the United Kingdom, we will use a lawful transfer mechanism where required. Depending on the recipient and destination, this may include:

• UK adequacy regulations;
• the UK Extension to the EU–US Data Privacy Framework for an eligible participating organisation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU standard contractual clauses; or
• another safeguard permitted by UK law.

We also consider whether additional contractual, organisational or technical protections are appropriate. Contact us if you would like information about the location or safeguard relevant to a particular type of processing.

8. How long we keep information

We keep personal information only for as long as reasonably needed for the relevant purpose. The periods below are our standard maximum periods; we may delete information sooner when it is no longer needed or retain it longer where a legal obligation, active dispute, fraud investigation, safeguarding concern or regulator requires this.

The employer or other controller decides how long PA and employment records should be kept while an employer workspace is active. Closing a subscription should not be treated as a substitute for deciding which employment records the employer is legally required to retain. Account Owners should export required records before the 30-day export window expires.

9. Security

We use proportionate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or access. These include measures such as:

• authentication and access controls;
• role and employment-based permissions;
• protected database and document storage;
• encrypted network connections;
• time-limited access to private files where appropriate;
• validation and limits for supported uploads;
• logging of important security and workflow events;
• supplier due diligence and contractual safeguards; and
• processes for investigating and responding to suspected incidents.

No internet service can guarantee absolute security. Keep passwords and invitation links private, use a unique password, protect access to your email account and sign out of shared devices. Contact support@directpayments.app promptly if you suspect unauthorised access.

Do not send passwords or sensitive documents through ordinary support email. Contact us first so we can agree an appropriate way to handle the issue.

10. Cookies and similar technologies

We do not currently use analytics cookies, advertising cookies or other non-essential tracking technologies.

The account area may use cookies or similar browser storage that are strictly necessary to authenticate users, maintain secure sessions, remember essential preferences and provide requested functionality. These technologies are used only where needed to deliver or secure the Service.

If we introduce analytics, advertising or another non-essential technology in future, we will update this notice and, where UK law requires consent, keep that technology disabled until you make a choice through an appropriate consent mechanism. You will be able to withdraw consent as easily as you gave it.

Your browser may allow you to block or delete cookies, but blocking strictly necessary cookies may prevent account login or other core functions from working.

11. Service emails and marketing

We send operational messages needed to run the Service, such as account confirmation, security alerts, invitations, password-reset messages, workflow notifications, billing messages and important changes. These are not marketing, and some cannot be disabled while the relevant account or workflow remains active.

We will send optional marketing only where permitted by law. Every marketing email will include a way to opt out. You may also opt out by contacting support@directpayments.app. Opting out of marketing will not stop essential service messages.

12. Automated decisions

The Service uses user-provided information and configured rules to generate administrative calculations, records and statuses, such as worked minutes or holiday information.

We do not make solely automated decisions about individuals that produce legal or similarly significant effects. Employers and authorised representatives remain responsible for checking information and making employment decisions.

13. Your data-protection rights

Your right to object

You have the right to object at any time to our use of your personal information for direct marketing. You may also object to processing based on our legitimate interests. If you object to direct marketing, we will stop using your information for that purpose. For other legitimate-interest processing, we will consider your circumstances and stop unless we have compelling lawful grounds to continue or the processing is needed for legal claims.

Depending on the circumstances and applicable law, you may have the right to:

• be informed about how your information is used;
• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask for information to be erased;
• ask us to restrict how information is used;
• receive certain information in a portable format;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent where processing relies on consent; and
• ask for human intervention in relation to certain automated decisions.

These rights are not absolute. For example, information may need to be retained to comply with law, protect another person's rights or establish, exercise or defend a legal claim.

To exercise a right relating to processing for which we are controller, email support@directpayments.app. Please identify the relevant account or communication and describe your request. We may ask for reasonable information to confirm your identity and authority. We will normally respond within one month, subject to any lawful extension.

Where the information is controlled by your employer, the Direct Payment recipient or their representative, they are primarily responsible for responding. We will assist them where we act as processor.

14. Children and people represented by another adult

People under 18 may not create their own account. However, an adult with appropriate authority may use the Service to administer an employer arrangement involving a child or a person who is represented or supported by another adult.

The Account Owner is responsible for confirming their authority, respecting the person's rights and giving required information in a clear and accessible form. Where we merely host that information within the employer workspace, we act as processor for the relevant controller.

15. Information you must provide

We need certain account, contact and billing information to create and administer a paid account. Without it, we may be unable to enter into or perform the subscription contract, authenticate you or provide the Service.

Fields that are not required will normally be identified as optional. The employer or representative decides what PA and employment information is necessary for their HR administration and legal obligations.

16. Complaints

Please contact us first at support@directpayments.app so we can investigate and try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the United Kingdom's data-protection regulator:

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you live outside the United Kingdom, you may also have the right to contact the data-protection authority where you live, although the Service is intended for UK use.

17. Changes to this notice

We review this Privacy Notice when the Service, our processing activities or applicable law changes. We will publish the updated notice on this page and change the date at the top.

If a change materially affects how we use personal information, we will bring it to affected users' attention before the new use begins where reasonably possible and seek consent where the law requires it.

For the contractual rules that apply to the Service, see our Terms of Service.