Customer Privacy Notice

1. Who We Are

Papaya Software Ltd ("we", "us", "our") is the Data Controller for personal data collected through our website and the Data Processor for employee data held within the Papaya HR platform. We are registered in England and Wales.

2. Data We Collect

We collect personal data in the following circumstances:

• Account registration: name, work email, company name, employee headcount, chosen plan.
• Platform use: employee records, absence data, payroll data — as input by you and your administrators.
• Website usage: IP address, browser type, and pages visited via standard server logs.
• Communications: content of enquiries submitted via our contact form.

3. How We Use Your Data

• To provide, operate, and improve the Papaya HR service.
• To manage your account and process billing.
• To respond to support requests and enquiries.
• To send service-related communications (e.g. invoices, maintenance notices).
• To comply with our legal obligations.

We do not sell or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

We process your personal data under the following lawful bases (UK GDPR Article 6):

• Contract: to fulfil our subscription agreement with you.
• Legitimate interests: to improve the service and ensure its security.
• Legal obligation: to comply with applicable law.

5. Data Storage and Security

All data is stored in Microsoft Azure data centres located in the United Kingdom. We implement industry-standard encryption at rest (AES-256) and in transit (TLS 1.2+). Access to production data is restricted to authorised personnel only.

6. Data Retention

We retain account and platform data for the duration of your subscription plus 90 days, after which it is securely deleted. You may request earlier deletion at any time. Log data is retained for 12 months.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Request erasure ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us via our contact form. We will respond within 30 days.

8. Cookies

Strictly necessary cookies. We use these for authentication and session management. They are required for the service to work and are set without asking, as the law allows.

Analytics cookies. We use Microsoft Clarity on this website to understand which pages are read and where visitors run into difficulty, so that we can improve them. Clarity records page views, clicks, scrolling and mouse movement, and sets the cookies _clck and _clsk. Text you type into form fields is masked by default and is not captured.

Clarity is loaded only if you accept. Until you do, no analytics script is downloaded and no analytics cookie is set. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a decline and do not ask.

We use no advertising cookies, and we do not sell or share analytics data for marketing. You can change your answer at any time using the Cookie settings link in the footer of any page.

9. Third-Party Sub-processors

We use a small number of trusted sub-processors to deliver the service, including Microsoft Azure (hosting) and Microsoft Clarity (website analytics, with your consent — see section 8). Each is bound by appropriate data processing agreements. A full list is available on request.

10. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to This Notice

We may update this Privacy Notice from time to time. We will notify active subscribers of material changes by email at least 14 days before they take effect.