Privacy Policy

1. When the Customer is in charge

Employers ("Customers") use EmployeeCore to keep records about their employees and job applicants. For those records the Customer is the controller and we are its processor: we handle the data only on the Customer's instructions, under a Data Processing Agreement. If you are an employee and want to see, correct or delete your data, please contact your employer, who can export everything held about you from EmployeeCore.

Those records can include identity and contact details, nationality, immigration status, right-to-work checks, passport and visa documents, employment, pay and absence details.

2. When we are in charge

We are the controller for: details people send through the contact or demo form on https://employeecore.co.uk (name, organisation, email, phone and message); account details of Users (name, email, role, sign-in times, network address) that we need to run and secure the service; and records of how the service is used, for security and support.

We use this data to reply to enquiries, provide and secure the service, keep records we must keep by law, and improve the service. Our lawful bases are our legitimate interests in running and securing our business and service, taking steps at your request before entering a contract, performing our contract with the Customer, and legal obligations.

3. Who we share it with

We use a small number of service providers (sub-processors): Namecheap, Inc. for web hosting, storage and email delivery. We don't sell personal data and don't use it for advertising. We may disclose data where the law requires, or to protect our rights.

4. Where it is stored

The service is hosted on servers in the United States operated by Namecheap, Inc. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we assess the transfer's risks. Customers can ask us for details.

5. How we protect it

Connections are encrypted (HTTPS with HSTS). Documents are stored privately and are only served to signed-in Users of the Customer's own site; every view and download is logged. Passwords are stored as salted scrypt hashes; two-step sign-in is available and can be required. Each Customer has a separate site and database. Backups are made daily and kept for 14 days.

6. How long we keep it

Enquiries: up to 2 years after our last contact. Customer Data: for the subscription, then 30 days for export and up to 30 more days in backups. Customers set their own retention periods for employee records within the service.

7. Your rights

Under UK GDPR you have rights to access, correct, delete, restrict or object to the use of your personal data, and to data portability, in some circumstances. For data we control, email contact@resourcewise.co.uk. For records your employer keeps, contact your employer. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

8. Changes

We will update this policy when our practices change and show the date of the latest version at the top.