Privacy Notice

Who is responsible

For workforce information in an employer’s workspace, the employer normally decides why and how information is used and acts as controller. HutchHR processes information under the employer’s instructions. Your employer’s privacy notice explains its employment-related purposes and retention rules.

For website enquiries, business contacts, billing administration and service security, HutchStack determines the relevant purposes. Our business address is Block 5B Vivabella 1, Off Orchid Road, Lekki, Lagos, Nigeria. The provider’s registered legal identity must be confirmed in the customer agreement. Send privacy questions to our general business contact below with the subject Privacy request; a dedicated privacy inbox has not yet been designated.

Information and sources

We receive information directly from you, from your employer and its authorized users, and through operation of the service. Enquiries may contain your name, contact details, company, role and message. Account operations involve identity, authentication, support, technical and security records.

Workspaces may contain employment and reporting-line records, contact details, leave requests, goals, performance answers, feedback, 1-on-1 notes, documents, compensation, bank details and payroll records. The categories depend on the employer’s configuration. Leave and uploaded documents may contain health or other sensitive information; employers should limit it to what is necessary and lawful.

Purposes and legal grounds

We use business-contact information to respond to enquiries, arrange demonstrations, administer contracts and provide support. Depending on the relationship and applicable law, this relies on steps requested before a contract, contractual necessity or legitimate interests in operating and supporting the service. We use records where necessary to meet legal obligations and legitimate security interests, subject to individuals’ rights.

Where consent is the applicable basis, it must be specific and can be withdrawn without affecting earlier lawful processing. Employer processing is governed by the employer’s legal basis and instructions; consent is not assumed simply because an employee uses HutchHR. Sensitive information requires an additional condition where applicable law requires one.

Recipients and international processing

Information is available to authorized workspace users according to permissions and feature visibility rules. Infrastructure, storage and email suppliers process information needed to deliver the service. Professional advisers, authorities and a successor in a business transaction may receive information where justified and subject to appropriate safeguards.

Provider locations may involve international processing. Applicable agreements must identify locations and required transfer safeguards before a transfer takes place. Ask us for the processing schedule relevant to your organization. A supplier’s presence on our website is not confirmation that every international transfer requirement has been satisfied.

Retention and protection

Retention depends on the purpose, customer instructions, the contract, legal record-keeping requirements and whether information is needed for a dispute or security investigation. Workforce information follows the agreed processing and deletion schedule. Business enquiries are retained while needed for the enquiry and any resulting relationship; financial and security records may require different periods.

Account closure does not necessarily erase records immediately. Restricted backups and legally required records follow their applicable expiry. Contact us for the schedule that applies to your information. Access controls and other safeguards reduce risk, but no service can guarantee absolute security.

Rights and complaints

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, and withdraw consent where processing relies on it. Send workforce-data requests to your employer; HutchHR assists under its processing agreement. For information we control, contact us directly. We may request proportionate identity verification and will explain any lawful limitation.

You may complain to the data protection authority responsible for your location. In Nigeria, this is the Nigeria Data Protection Commission (ndpc.gov.ng). Raising a concern with us does not prevent you from contacting a regulator.

Browser storage, decisions and updates

The Cookie and Browser Storage Notice describes browser technologies. The current website release does not initialize Microsoft Clarity analytics or session recording. An enquiry submitted using a mail link is also handled by your chosen email application and provider.

HutchHR tools calculate and display information for authorized human users. Employers are responsible for explaining any automated decision-making they introduce. Proposed AI or meeting integrations are not described here as active services. The service is intended for workplace use, not marketing to children.

We date revisions and provide additional notice of material changes where required. Do not include passwords, bank information or full employee records in an initial privacy email.