Privacy Policy

Scope and roles

Effective date: [EFFECTIVE DATE]. This policy covers personal information processed through HutchHR’s website and Service. For workforce data submitted by a Customer, that Customer generally acts as controller/employer and HutchHR acts as processor under the DPA. HutchHR may act as an independent controller for website visitors, account contacts, billing contacts, security events, and direct support communications.

Information processed

Depending on the Service configuration, this can include employer and administrator identity/contact details; employee profile, employment, manager, department and organizational details; authentication and account-security information; device, technical, log, and usage data; leave, attendance where configured, performance, feedback and reporting information; compensation, payroll, statutory and bank-detail information; uploaded documents; and support communications.

Purposes and lawful bases

We process information to provide and administer the Service, authenticate users, apply role-based access, store and retrieve Customer Data, generate requested outputs, provide support, protect security, prevent misuse, meet legal obligations, and improve the Service. Applicable legal bases are [JURISDICTION-SPECIFIC LAWFUL BASES PLACEHOLDER], including processing on Customer’s instructions where we are processor.

Sharing and international transfers

We share information with authorized Customer users, vendors that help deliver the Service, professional advisers, authorities where legally required, and successors in a permitted corporate transaction. Current verified service providers are listed on the Subprocessors page. We do not sell personal information in exchange for money.

Transfers outside a person’s jurisdiction may occur where infrastructure or vendors process data. Appropriate transfer mechanism(s), including [STANDARD CONTRACTUAL CLAUSES PLACEHOLDER] where required, must be confirmed by legal review.

Retention, security, and rights

We retain information for the period needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements; Customer-controlled workforce data is handled under the DPA and applicable configuration. Retention periods are [RETENTION SCHEDULE PLACEHOLDER].

HutchHR uses measures designed to protect information, including authentication, role-scoped access and audit logging where implemented. No system can guarantee absolute security. Individuals may have rights to access, correct, delete, restrict, object, port, or complain to a competent data-protection authority, depending on applicable law. Workforce-data requests should ordinarily be directed to the employer/controller; we will assist Customers as required by the DPA.

Children, cookies, and updates

The Service is intended for workplace use and is not directed to children. Do not submit children’s information unless Customer has a lawful basis and appropriate notices. See the Cookie Policy for cookies and controls.

We may update this policy and will post the revised version. Privacy contact: [DATA PROTECTION OFFICER EMAIL / CONTACT EMAIL].