Privacy policy

smplr is operated by Smplr LTD (company number 17196814), registered at 66 Paul Street, London, EC2A 4NA. In this policy, "we" and "us" mean that company.

Controller or processor

smplr handles personal data in two different roles, and almost every question about your data has a different answer depending on which one applies.

We are the controller for people we deal with directly: visitors to our website, people who ask us about the product, and the person at a customer who administers their account. We decided to collect that data and we decide what happens to it. This policy governs it.

We are a processor for the employee records inside a customer's account. If your employer uses smplr, your leave requests, sickness absence, contracts, right-to-work checks and pay data are held here — but your employer is the controller. They decide what is collected, why, and how long it stays. We act on their instructions and nothing else.

That distinction matters most when you want something done. If your employer uses smplr and you want your data corrected or erased, ask your employer: they hold the decision and we are not permitted to overrule them. The "Your rights" section below explains both routes.

When we are the controller

What we collect, and why

We do not buy contact data, we do not sell or share personal data for anyone else's marketing, and we do not use it to build advertising profiles. There is no advertising or analytics tracking on our website — see the cookie notice.

How long we keep it

Enquiries that do not become customers: two years from the last contact, then deleted. Account and billing records: for the life of the account and six years after it closes, which is the period UK accounting rules require. Support correspondence: three years. Application logs: 30 days, except where a log is attached to a security investigation. Sign-in records — successful and failed attempts, the address tried and the IP it came from, which we keep so an account takeover can be investigated: one year, then deleted automatically.

When we are a processor

Everything a customer's account holds about their staff is processed on that customer's instructions under a written contract — our data processing agreement, which forms part of our terms of service.

Depending on which parts of smplr a customer uses, that can include: name and contact details, date of birth, National Insurance number, nationality, emergency contacts, job title, department, manager, start and leaving dates, leave requests and balances, sickness absence records, contracts and other HR documents and their electronic signatures, right-to-work check outcomes and expiry dates, qualifications, probation outcomes, policy acknowledgements, shifts and the hours people work, how each person's holiday builds up, objectives and one-to-one and review records including notes a manager has written but not yet shared, pay rate and salary history, and gender, which the reporting features use. Where a customer uses equality monitoring, it also holds what each person chooses to tell their employer about their ethnicity, disability, religion, sexual orientation and gender identity. Where a customer buys HR Services from us, it holds the request and our correspondence about it.

Sickness records are data about health, and equality monitoring answers are about ethnicity, health, religion and sexual orientation. Under UK GDPR all of these are special category data under Article 9, and it is the customer's responsibility as controller to identify the Article 9 condition they rely on (for sickness, usually Article 9(2)(b) — obligations in the field of employment law). We hold it under their instruction and apply the protections described below. Pay and gender are used for equal pay and gender pay gap reporting.

Equality monitoring answers get more protection than anything else. Only the person can enter or change their own answers, and nobody else — not their manager and not their employer's administrators — is shown what one person said. The employer sees whether someone has answered and totals across the organisation, and the totals are withheld altogether when a group is small enough that they could identify someone. Withdrawing consent deletes the answers.

We do not use any of it for our own purposes. We do not mine it, sell it, share it, or train anything on it. We access a customer's account data only to provide support they have asked for, to investigate a fault, or where the law requires it — and every such access is recorded.

How long it stays

smplr anonymises a leaver's record automatically once it passes a set period — currently 2555 days (7 years), counted from the day that person's access ends rather than from their last working day. That period is one we set for the whole service, not something a customer configures per organisation. When an account closes, we delete or return the data as described in the data processing agreement.

Holiday records are kept longer, because the law asks employers to keep them for 6 years: the holiday each person was given or built up, what they took and carried over, what was owed when they left, and the hours worked that their holiday was based on. Anonymising a leaver keeps these under a pseudonym, and smplr deletes them 6 years after the end of the leave year the person left in.

Where data is held

The application and its database run in London, United Kingdom (Fly.io lhr). Uploaded documents are stored in London, United Kingdom (AWS eu-west-2). Some of the suppliers who help us run the service — for error monitoring and uptime monitoring — may process limited technical data outside the UK; each is listed on the sub-processors page, with its location and the safeguard relied on for any transfer.

How we protect it

These are the measures actually in place, not an aspiration:

• Encryption in transit. Everything is served over HTTPS, with HSTS.
• Encryption at rest. Personal data fields are encrypted in the database with keys held outside it, so a copy of the database alone does not disclose them. Backups are encrypted.
• Separation between customers. Each customer has their own subdomain, and every query the application makes is bound to a single organisation. A session is only valid on the organisation it was issued for.
• Access by invitation only. A customer's administrator invites each person. Nobody can add themselves to a customer's organisation, by any route; creating an organisation of your own gives you access to that one and to nothing else.
• Card details never reach us. The page where a card is entered is served by Stripe on their own domain, not by us. What comes back is a reference that can only be used to charge that one account, and there is nowhere in our systems a card number could be stored even by mistake.
• Two-factor authentication. Anyone can turn on a second factor — a code from their phone on top of their password — and it is required, not optional, for accounts that can reach every record in an organisation. A stolen password on its own is not enough to sign in as one of those.
• Least privilege inside an account. What each person can see is decided by their role, explicit permission grants, and their place in the management chain.
• An audit trail. Changes to a person's record are recorded automatically — what changed, who changed it, and when.
• Monitored and backed up. The service is monitored continuously, database backups are automated with point-in-time recovery, and restores are rehearsed rather than assumed.

Sub-processors

We use a small number of suppliers to run the service. Each is listed, with what they do and where they are, on the sub-processors page. Customers are given at least 30 days' notice before we engage a new one.

Your rights

Under UK GDPR you have the right to be told what personal data is held about you, to get a copy, to have it corrected, to have it erased in some circumstances, to restrict or object to its processing, and to receive it in a portable form.

If your employer uses smplr, exercise those rights with your employer. They are the controller and the decision is theirs. You can download a copy of your own record at any time from your account, under Your data in Settings.

For data we hold as controller — you enquired about the product, you administer an account, or you have corresponded with us — write to trust@smplr.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by phone on 0303 123 1113. We would rather you raised it with us first, but you are not obliged to.

Data protection contact

Patrick McDonnell is responsible for data protection here. Write to trust@smplr.co.uk, or to Smplr LTD, 66 Paul Street, London, EC2A 4NA.

We are registered with the Information Commissioner's Office under ZC244196.

To report a security problem, write to trust@smplr.co.uk. We will acknowledge it and we will not pursue anyone who reports a genuine issue in good faith.

Changes to this policy

When we change this policy we update the effective date at the top. If a change materially affects how we handle personal data, we tell account administrators by email before it takes effect rather than relying on you to notice.