Privacy Policy

1. Scope and Application

This Privacy Policy applies to the collection and processing of personal information through hr-payroll.net and its associated HR, payroll, timekeeping, attendance, and other employment-related functions, as applicable.

It applies to individuals whose information is processed through the services, including employees, authorized representatives, customers, administrators, applicants, and website visitors, where applicable.

Depending on the service arrangement, the organization that determines why and how employee information is processed may be the personal information controller, while the provider operating the application may act as a personal information processor. These roles depend on the actual processing arrangements and applicable law.

This Policy should be read together with any applicable customer agreement, employee privacy notice, or other notice that explains how a particular category of personal information is processed.

2. Information We Collect

The categories of information processed depend on the features enabled, the organization's requirements, and the information provided to or generated by the application.

2.1 Identification and Contact Information

• Full name and employee identification number.
• Contact details, including email address and telephone number.
• Residential address and other contact information, where required.
• Employment status, department, position, and organizational details.

2.2 Employment and Timekeeping Information

• Employment records and work assignments.
• Work schedules, attendance, time records, and overtime entries.
• Leave requests, approvals, and leave balances.
• Timesheets, payroll adjustments, and related approvals.

2.3 Payroll and Financial Information

• Salary, wages, allowances, bonuses, and other compensation.
• Payroll deductions, contributions, and withholding information.
• Bank account details used for salary payments, where applicable.
• Tax and other statutory payroll records.

2.4 Government and Sensitive Information

Where required for legitimate employment, payroll, or statutory purposes, the application may process government-issued identifiers, including SSS, TIN, Pag-IBIG, and PhilHealth numbers.

The application may also process other sensitive personal information or protected records when necessary and lawfully authorized, subject to appropriate safeguards and access restrictions.

2.5 Account and Technical Information

• Usernames, authentication records, and account permissions.
• System activity, audit trails, and transaction history.
• IP addresses, browser information, and diagnostic logs, where collected.
• Information submitted through support requests or contact forms.

We aim to collect only information that is adequate, relevant, and necessary for the stated purposes of processing.

3. How We Use Personal Information

Personal information may be processed for the following purposes:

• Creating and maintaining employee and user accounts.
• Administering employment records and organizational information.
• Calculating and processing payroll and authorized deductions.
• Managing attendance, shifts, overtime, leave, and timesheets.
• Preparing employment, payroll, accounting, and statutory reports.
• Supporting compliance with applicable legal and regulatory obligations.
• Authenticating users and managing access permissions.
• Maintaining system availability, troubleshooting, and improving services.
• Detecting, investigating, and preventing fraud, misuse, and security incidents.
• Responding to authorized requests, inquiries, and disputes.
• Establishing, exercising, or defending legal claims when necessary.

We will not use personal information for a new purpose that is incompatible with the original purpose unless the processing is otherwise permitted by applicable law and any required notice or consent has been obtained.

4. Lawful Basis for Processing

Personal information will be processed only when there is a lawful basis for doing so under applicable data protection law. Depending on the circumstances, the basis may include:

• The data subject's valid consent, where consent is required.
• The necessity of processing to perform a contract or take steps requested before entering into a contract, where applicable.
• Compliance with a legal obligation.
• Protection of vital interests or other grounds recognized by applicable law.
• Legitimate interests, where permitted by law and where those interests are not overridden by the rights and interests of the data subject.
• Other lawful grounds specifically permitted under applicable data protection legislation.

Consent is not the only possible lawful basis for processing. Where processing is based on consent, the data subject may withdraw consent subject to applicable law. Withdrawal does not invalidate processing lawfully performed before withdrawal, and other lawful grounds may continue to apply.

5. Employee and Payroll Information

HR and payroll information is processed to support employment administration, compensation, attendance, timekeeping, statutory reporting, and related business operations.

Because payroll records may contain financial information and government identifiers, access should be limited to authorized personnel who need the information to perform their assigned duties.

Depending on the organization's configuration and applicable law, authorized users may include designated HR personnel, payroll personnel, managers, system administrators, auditors, and other personnel with a legitimate business or legal need.

Users must handle employee records confidentially and must not access, disclose, export, or use such information outside their authorized responsibilities.

Customers and employers remain responsible for ensuring that information entered into the system is accurate, lawfully obtained, and processed for authorized purposes, subject to the respective responsibilities of the parties under applicable law and their service agreements.

6. Disclosure and Third-Party Processing

We do not treat personal information as public information. Personal information may be disclosed only where necessary for an authorized purpose and subject to applicable law and appropriate safeguards.

Depending on the services used, information may be made available to:

• The employer or customer responsible for the relevant HR and payroll processing.
• Authorized HR, payroll, finance, management, and administrative personnel.
• Hosting, infrastructure, maintenance, and technical support providers engaged to operate or support the application.
• Banks, payment providers, government agencies, and statutory institutions where required for authorized payroll or legal purposes.
• Professional advisers, auditors, or service providers where necessary and lawfully permitted.
• Courts, regulators, law enforcement authorities, or other recipients when disclosure is required or authorized by law.

Where third parties process personal information on our behalf, appropriate contractual, organizational, and technical measures should be used to protect that information.

We do not authorize third-party service providers to use personal information for unrelated purposes merely because they have access to it for service delivery.

We do not sell employee payroll records or government identifiers as a business practice.

7. Cookies and Advertising

7.1 Essential Cookies and Similar Technologies

The website may use cookies or similar technologies to support authentication, maintain sessions, protect accounts, remember preferences, and support other essential application functions.

7.2 Analytics and Advertising

If analytics or third-party advertising services are enabled, those providers may collect technical information about browser activity and interactions with the website using cookies or similar technologies, subject to their own policies and the applicable consent requirements.

Third-party providers may process information in accordance with their own privacy policies. Their collection and use of information are not entirely controlled by this website.

You can review Google's policies using the following official links:

• Google Privacy Policy
• Google Advertising Technologies

You can manage available cookie and advertising preferences through your browser and the controls offered by the relevant service provider. Disabling essential cookies may affect some application functions.

Third-party advertising or analytics services should be enabled only if they are actually used and configured in accordance with applicable privacy requirements.

8. Data Security and Confidentiality

We take appropriate measures to protect personal information against unauthorized access, disclosure, alteration, loss, destruction, and other unlawful processing. These measures are selected based on the nature of the information, the processing activities, and the associated risks.

Depending on the system and deployment, safeguards may include:

• Encryption of sensitive information at rest and, where appropriate, in transit.
• Role-based access controls and least-privilege permissions.
• Authentication and appropriate account security measures.
• Audit logs and monitoring of relevant system activity.
• Backups and recovery procedures.
• Security updates, vulnerability management, and testing.
• Confidentiality requirements and appropriate personnel training.
• Incident response procedures for security events.

The HR and payroll application is designed to safeguard sensitive employee information, including addresses, bank account details, SSS numbers, TINs, Pag-IBIG numbers, and PhilHealth numbers, through encryption and access restrictions where implemented.

No electronic system or method of transmission can be guaranteed to be completely secure. We therefore cannot promise absolute security, but we aim to maintain reasonable and appropriate safeguards and address identified risks.

9. Data Retention and Deletion

Personal information will be retained only for as long as necessary to fulfill the declared purposes of processing, comply with applicable legal and regulatory obligations, support legitimate business needs, or establish, exercise, or defend legal claims.

Retention decisions may take into account:

• The nature and sensitivity of the information.
• The purpose for which the information was collected.
• Applicable employment, payroll, tax, accounting, and other legal requirements.
• Pending investigations, disputes, audits, or legal claims.
• Contractual obligations and legitimate operational requirements.

When personal information is no longer required and no lawful retention obligation or other valid reason applies, it will be securely deleted, destroyed, anonymized, or otherwise disposed of using appropriate measures.

Deletion requests may be subject to legal retention requirements, legitimate grounds for continued processing, backup cycles, and technical limitations. Where immediate removal from backups is not reasonably practicable, the information should remain protected and should not be restored or used except as necessary for authorized recovery or other lawful purposes.

Customers using the application should establish appropriate retention schedules for their own employee records and ensure that the system's retention practices are consistent with applicable requirements and service agreements.

10. Rights of Data Subjects

Subject to applicable law and any relevant exceptions, individuals may exercise rights concerning their personal information, including the following:

Right to Be Informed

To receive information about the collection, purposes, scope, and processing of their personal information.

Right to Access

To request access to personal information concerning them, subject to applicable legal limitations.

Right to Rectification

To request correction of inaccurate or incomplete personal information, where appropriate.

Right to Erasure or Blocking

To request erasure, blocking, or removal of personal information when the applicable legal requirements are satisfied.

Right to Object

To object to certain processing activities where the right applies under applicable law.

Right to Data Portability

To request a copy of eligible personal information in a structured and commonly used electronic format where the legal requirements for portability are met.

Right to Complain and Seek Remedies

To lodge a complaint with the appropriate authority and seek remedies available under applicable law.

These rights are subject to applicable conditions, exceptions, and limitations. They do not necessarily require deletion of records that must be retained under the law.

To submit a request, please contact the organization responsible for your information or use the Contact Us form on this website. We may need to verify your identity and authority before processing a request.

11. Security Incidents and Data Breaches

We aim to maintain procedures for identifying, investigating, documenting, containing, and responding to security incidents that may affect personal information.

If a personal data breach occurs, the responsible personal information controller will assess the nature and extent of the incident, the information affected, the risks to individuals, and the applicable notification requirements.

Where notification is legally required, the appropriate authorities and affected individuals will be notified within the timeframes and in the manner prescribed by applicable law. This may include notification to the Philippine National Privacy Commission and affected data subjects within the applicable 72-hour period when the legal notification requirements are met.

Notifications will provide information required by law, which may include the nature of the incident, the types of information involved, mitigation measures, recommended protective steps, and contact details for further assistance.

12. Account Security and Acceptable Use

Users must take reasonable steps to protect their accounts and credentials. Users must not share passwords, attempt unauthorized access, or use another person's account without authorization.

Users must not use the website to:

• Publish unlawful, threatening, harassing, hateful, or abusive content.
• Distribute spam or unsolicited messages through the service.
• Upload malicious software or attempt to compromise system security.
• Access, disclose, modify, or extract records without authorization.
• Violate another person's privacy or intellectual property rights.
• Submit information that is knowingly fraudulent or misleading.

Users should provide accurate information and access only the data and functions permitted by their assigned roles. Each user should generally maintain only one active account unless multiple accounts are expressly authorized.

Where permitted by applicable law and contractual arrangements, violations may result in account restrictions, suspension, removal of prohibited content, or other appropriate action.

These acceptable-use provisions supplement the privacy provisions of this Policy. They do not replace any separate terms of service or employment policies that may apply.

13. Children's Privacy

This HR and payroll service is intended primarily for employment-related and business use. It is not designed specifically to target children.

If information about a child is processed in a legitimate employment, dependent-benefit, or other authorized context, it must be handled only where legally permitted and with appropriate safeguards and any required authorization.

14. International Data Transfers

Depending on the hosting environment and third-party services used, personal information may be stored or processed outside the location where it was collected.

Where personal information is transferred across borders, the responsible organization must ensure that the transfer and subsequent processing comply with applicable law and are subject to appropriate safeguards.

The locations of hosting infrastructure and third-party processing services should be verified against the actual deployment and applicable service agreements.

15. Changes to This Policy

This Privacy Policy was originally effective in December 2026. We may update it from time to time to reflect changes in our services, processing practices, security measures, contractual arrangements, or applicable legal requirements.

The revised policy will be published on this page with an updated effective or revision date. Where required by law, material changes will be communicated to affected individuals and any required consent will be obtained.

We encourage users to review this page periodically. Any continued use of the service remains subject to applicable law and does not substitute for consent or other legal requirements where these apply.