Privacy Notice

AssistHR provides HR software for small and medium-sized employers in the United Kingdom. We are based in the United Kingdom.

For questions about this notice or about how your data is used, contact info@assisthr.co.uk.

Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles personal data on someone else's instructions. Which role applies depends on the circumstances.

• We are normally the controller for personal data about website visitors, prospective customers, demo requests, contact enquiries, account administrators and billing contacts.
• Customer employers are normally the controller for employee and worker data entered into the AssistHR platform, and we normally act as their processor for that data. In that case the employer's own privacy notice explains how the data is used, and our processing is governed by our Data Processing Addendum.
• There are limited situations where we act as controller for service data even inside the platform, for example security logs, audit records and billing information that we need to run and protect the service.

If you are an employee of one of our customers and want to exercise your rights over your HR records, please contact your employer first. We will support them in responding.

Information you give us on this website

Our contact form and demo request form ask for details such as your name, work email address, company name, phone number where you provide it, and the message or requirements you write. We also record which form you used and when you submitted it.

Technical information

When you load a page, our hosting and infrastructure providers process standard technical information such as your IP address, browser type, the pages requested and timestamps. This is needed to deliver the site and to protect it from abuse.

Account and service data

If your organisation uses the AssistHR platform, we handle account details for your users, such as name, work email, role and permissions, along with records of activity in the product, including audit log entries.

Support information

If you contact us for help, we handle the content of your messages and any information you choose to share. Where you consent to send a diagnostic report from the product, that report is designed to exclude form values, tokens, cookies, local storage contents and request headers.

Payment-related information

Subscription payments are handled by our payment provider through hosted checkout. We receive information such as the billing contact, subscription status and payment outcome. We do not store full card details.

Employee data in the platform

Employers decide what they record. Depending on their configuration this can include identification and contact details, employment terms and job details, leave and absence records, working time and timesheets, HR documents and e-signature records, and other categories the employer chooses to store. Employers should not enter special category data or criminal offence data unless they have a valid basis under data protection law for doing so.

Where we act as controller, we rely on the following lawful bases under the UK GDPR. Where a customer employer is the controller, the employer identifies its own lawful basis.

Where we rely on legitimate interests, we consider whether the use is fair and expected, and whether it could unreasonably affect you. You can ask us about that assessment.

We use a small number of service providers to run AssistHR. They act on our instructions and are bound by contract terms covering confidentiality and data protection. Current providers are listed on our Subprocessors page and cover hosting and database services, authentication, file storage, transactional email, subscription billing, the HR Help AI feature and leaked-password screening.

We may also share personal data:

• with a customer organisation, where the data relates to that organisation's account and users
• with our professional advisers, such as accountants and lawyers, where needed
• with regulators, courts or law enforcement where we are legally required to do so
• with a buyer or successor if we reorganise or transfer part of our business, subject to appropriate protections

We do not sell personal data.

Some of our providers may process personal data outside the United Kingdom. Where that happens, we rely on a transfer mechanism recognised under UK data protection law, such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with any additional safeguards that the transfer requires.

Processing locations depend on how each provider is configured, so we do not state a single hosting location in this notice. If you need the current position for your account, including the safeguards in place, email info@assisthr.co.uk and we will confirm it.

We keep personal data only for as long as we need it, then delete it or reduce what we hold. Because retention depends on the account and on legal duties, we set out the criteria we apply rather than promising exact deletion deadlines that our systems do not currently enforce.

• Enquiry and demo request details: kept while we are in contact with you and for a reasonable period afterwards so we can pick up the conversation, then deleted when there is no longer a business reason to keep them.
• Customer account and platform data: kept for the life of the customer's subscription. After termination it is handled in line with the Data Processing Addendum and the customer's instructions, including export and deletion requests.
• Billing and financial records: kept for the period required by tax and accounting law.
• Security, audit and system logs: kept for a limited period appropriate to investigating incidents and protecting the service.
• Support messages and consented diagnostic reports: kept for as long as needed to resolve the issue and to understand recurring problems.

If you would like to know what we hold about you and when we expect to delete it, ask us and we will tell you what applies to your situation.

The AssistHR platform includes an HR Help assistant powered by a third-party AI model accessed through our AI gateway provider. The feature is built with data-minimisation and redaction controls, so the input sent to the model is sanitised and restricted to the fields the feature needs rather than passing across whole records.

The assistant produces general guidance and drafting help. It is not used to make solely automated decisions about employment that have legal or similarly significant effects for an individual. Decisions about people remain with the employer and involve human judgement.

The assistant does not replace professional advice. Employers remain responsible for the decisions they take.

We take reasonable technical and organisational measures to protect personal data, including workspace isolation with row level security, role-based access controls, audit logging, private document delivery through short-lived signed links in normal workflows, rate limiting and leaked-password screening. Our Security page explains these in more detail.

No online service can be completely secure. Security is a shared responsibility, so please keep your credentials private, use strong unique passwords and tell us straight away if you think an account has been compromised.

Depending on the circumstances, you have the right to ask us to give you access to your personal data, correct it, delete it, restrict how we use it, or provide it in a portable format. You can object to processing based on legitimate interests, and you can withdraw consent where we rely on it.

To exercise a right, email info@assisthr.co.uk. We may need to confirm who you are before we act. We aim to respond within one month and will tell you if we need longer.

If your request relates to HR records held by your employer in the AssistHR platform, we will normally direct you to your employer, because they control that data.

You can also complain to the UK Information Commissioner's Office. See how to make a data protection complaint. We would like the chance to put things right first.

AssistHR is a business tool and is not directed at children. We do not knowingly collect data about children through this website. Employers are responsible for deciding whether records about young workers are entered into the platform and for having a valid basis to do so.

We may update this notice as the service or the law changes. The date at the top shows when it was last updated. Where a change materially affects how we use personal data, we will take reasonable steps to tell affected customers.