WPC HR Privacy Policy

How WPCHR LTD uses personal data and cookies

Version 1.0 | Effective date: 1 November 2026

WPCHR LTD | Company number 14812456

1. Who we are

1.1WPC HR is the brand of WPCHR LTD, a company registered in England and Wales with company number 14812456, whose registered office is at 112-116 Whitechapel Road, 2nd Floor, Unit 5-6, London E1 1JE. In this policy "we", "us" and "our" mean WPCHR LTD.

1.2We provide the WPC HR software (HRMS Employer and HRMS Employee, delivered through the web application and the WPC HR Employer and Employee apps) and related HR compliance services to employers in the UK.

1.3We are the controller of the personal data described in this policy, except where section 3 says that we act only as a processor for an employer. Our data protection contact is info@wpchr.co.uk, or you can write to us at the address above.

1.4We are registered with the Information Commission (formerly the Information Commissioner’s Office, ICO), reference ZC150997.

2. Who this policy covers

Website visitors to wpchr.co.uk.
Enquirers: people who contact us or ask for a call, a demo or a quote.
Client contacts: people at organisations that use, or are thinking of using, WPC HR.
Users: anyone with a login credential to the WPC HR web application (https://hrms.workpermitcloud.co.uk/) or to the WPC HR Employer or Employee apps for Android (Google Play) and iPhone and iPad (Apple App Store), for the login itself: signing in, security and messages they send us.

If you deal directly with Work Permit Cloud, WPC Lawyers, WPC Accountants, WPC Jobs or WPC AI, that organisation’s own privacy notice applies to its services.

3. If you are an employee of one of our clients

3.1Your employer uses WPC HR to keep your staff records. Your employer is the controller of that information and decides how it is used; we process it only for your employer and on its instructions, under section 14 of our Terms and Conditions. Your employer’s privacy notice explains how it uses your information.

3.2If you ask us about your HR information, we pass your request to your employer and help them answer it, and we tell you we have done so.

3.3We are the controller only of your WPC HR Employee login, its security records and any messages you send us directly.

4. What we collect

Type	Examples	Where it comes from
Identity and contact	Name, job title, organisation, work email, phone number, business address	You, your organisation, the person who referred you, Companies House and other public business records
Account and sign-in	Login email, password (stored only in secure form), role, multi-factor settings	You and your organisation
Security and technical	Sign-in times, IP address, device type, app version, notification token	Our systems, when you use WPC HR
Agreements	Which version of our terms an Account Owner accepted, and when	Our systems
Billing	Plan, invoices, payment status, last four digits of a card. Full card and bank details stay with Stripe and GoCardless	You, Stripe and GoCardless
Communications	Emails, WhatsApp messages, call notes, support requests, complaints, marketing choices	You and our staff
Free-trial check	Company number, Account Owner’s email and email domain	You, at sign-up
Website use	Pages visited, clicks, scrolling, a recording of how the page was used (Clarity) and visit statistics (Google Analytics), only if you accept analytics cookies; your cookie choice	Microsoft Clarity and Google Analytics on wpchr.co.uk, and our cookie banner

The apps may ask permission to use your camera, photos or files (to upload a document), notifications and location. Location is used only if your employer turns it on for clock-in, and only at the moment you clock in or out; the app never tracks you continuously. If you sign in with Face ID or a fingerprint, the check happens on your phone and we never receive it.

5. Why we use it

Purpose	Lawful basis
Answering enquiries, demos and quotes	Legitimate interests (responding to people who contact us), or steps before a contract for sole traders
Setting up and running your organisation’s account and services, including calls and messages about set-up, payments and renewals	Contract with your organisation (legitimate interests for its staff)
Billing, payments and financial records	Contract; legal obligation for tax and accounting records
Signing you in and keeping accounts and data secure	Legitimate interests (security)
Checking whether an organisation has already had a free trial	Legitimate interests (preventing misuse)
Recording acceptance of our terms	Legitimate interests (showing what was agreed)
Service messages, such as changes to terms, failed payments and security alerts	Contract; legal obligation where the law requires us to tell you
Telling business contacts about our services	Legitimate interests (direct marketing); see section 6
Website analytics with Microsoft Clarity and Google Analytics, to improve our website	Your consent, given in the cookie banner; you can withdraw it at any time under "Cookie settings"
Sharing with a group firm when your organisation asks for or is referred to one of its services	Legitimate interests (arranging the service)
Complaints, legal duties and disputes	Legal obligation; legitimate interests (legal claims)

You can object to any use based on legitimate interests (section 12).

6. Marketing

We send marketing about WPC HR and related WPC group services only to business contacts. Every marketing email has an unsubscribe link, and you can tell us at any time at info@wpchr.co.uk. Sole traders and partnerships receive marketing emails only with their consent or about services similar to those they bought. Service messages are not marketing. We never sell personal data.

7. Cookies

7.1Cookies are small files a website stores on your device. Similar technologies, such as a website’s local storage and the storage an app uses on your phone, work in the same way, and this section covers them too.

7.2Your choice on our website. When you first visit wpchr.co.uk, a banner asks for your choice. "Accept all" allows analytics cookies; "Reject non-essential" allows only the cookies the website needs to work. Until you choose, only those essential cookies are used, and Microsoft Clarity and Google Analytics do not load.

7.3We remember your choice for 6 months, then ask again. You can change it at any time with the "Cookie settings" link at the bottom of every page. If you withdraw your consent, Clarity and Google Analytics stop collecting data and we delete their cookies on wpchr.co.uk; withdrawing does not affect data already collected.

7.4Microsoft Clarity. With your consent, Clarity records how you move through our website (clicks, scrolling and the pages you visit) and produces heatmaps, so we can improve the site. It is set to hide what you type into forms. Microsoft is a separate controller of Clarity data, uses it for its own purposes too, including advertising, and stores it in the USA; see the Microsoft Privacy Statement.

7.5Google Analytics. With your consent, Google Analytics counts visits and shows us which pages are used, so we can improve the site. Google processes this data for us and may do so in the USA; Google’s privacy policy also applies.

7.6Essential cookies need no consent because the website and the web app cannot work or stay secure without them. You can still block or delete cookies in your browser, but parts of the site may then not work.

7.7The signed-in WPC HR web application and the WPC HR apps use only essential cookies and storage, so they do not ask for a choice. They contain no analytics, advertising or session recording.

7.8If we change the cookies we use, we update this section and, where consent is needed, ask you again.

Name	Where	What it does	How long
Cookie choice	Website, always	Remembers your cookie choice	6 months
_clck	Website, only if you accept	Microsoft Clarity: keeps a Clarity ID so visits from the same browser can be linked	1 year
_clsk	Website, only if you accept	Microsoft Clarity: links the pages you view into one session	1 day
MUID, CLID and other Microsoft cookies	Website, only if you accept	Set by Microsoft on its own domains; Microsoft also uses MUID for advertising	Up to 1 year
_ga	Website, only if you accept	Google Analytics: tells returning visitors apart so visits can be counted	2 years
_ga_ followed by an identifier	Website, only if you accept	Google Analytics: keeps the state of your visit	2 years
Sign-in session	Web app	Keeps you signed in securely	Until you sign out or after a period without activity
Form protection	Web app	Protects forms against attacks	Your session
_GRECAPTCHA	Web app sign-in page	Google reCAPTCHA checks that you are a person, not an automated attack. Google’s privacy policy also applies	Up to 6 months
persist:hr (local storage)	Website	Keeps the website working while you use it	Until you clear your browser
Sign-in token and settings	Employer and Employee apps	Keep you signed in and remember your settings	Until you sign out or delete the app

8. Who we share it with

We share personal data only as far as each recipient needs, and our service providers process it for us under written terms. These are also the sub-processors for client data under our Terms and Conditions (section 14).

Recipient	What for	Where
Amazon Web Services	Hosting the WPC HR system, files and backups	UK (London region)
Microsoft	Our staff email and documents; website analytics (Clarity, only with your consent; Microsoft is a separate controller of Clarity data)	UK and EU; Clarity data in the USA
Google	Website analytics (Google Analytics, only with your consent) and protecting the sign-in page from automated attacks (reCAPTCHA)	USA
Stripe and GoCardless	Card and Direct Debit payments	UK, EU and USA
monday.com	Managing enquiries sent through our website	EU
WhatsApp (Meta)	Messages with client contacts who use WhatsApp	USA
Email delivery and push notification providers	Sending system emails and app notifications (notifications show a title only, never HR details)	UK, EU and USA
Our group companies: Work Permit Cloud, WPC Lawyers, WPC Accountants, WPC Jobs and WPC AI	When your organisation asks for, or is referred to, one of their services: only what that task needs	UK
Our group company WPC Global DMCC	Account management and client support for WPC HR	United Arab Emirates
Professional advisers, auditors and insurers	Advice, audits and insurance	UK
UKVI, the Home Office, courts, HMRC, the Information Commission and other authorities	Only where the law requires it, or for legal claims	UK
A buyer of our business	If we sell all or part of our business, under the same protections	UK

Stripe, GoCardless, Microsoft (Clarity), Google (reCAPTCHA) and Meta also use some data for their own purposes, as their own privacy policies explain.

9. Data used outside the UK

9.1Our systems and data are hosted in the UK. Some of the people who work on WPC HR do so from outside the UK: members of our development and technical support team in Bangladesh, and the staff of our group company WPC Global DMCC in the United Arab Emirates (and, at times, Malaysia). They access our UK systems remotely, only as far as their work needs, under the same security rules and confidentiality duties as our UK staff.

9.2Some of the providers in section 8 process data outside the UK. Where the country (including the EU and EEA), or for the USA a company certified to the UK Extension to the EU-US Data Privacy Framework, is covered by UK adequacy regulations, we rely on those. Otherwise we use the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, which are approved under UK law, together with any assessment the law requires. We keep records of these safeguards.

9.3You can ask us for more information about these safeguards at info@wpchr.co.uk.

10. How long we keep it

Data	How long
Website analytics: Microsoft Clarity	Recordings normally 30 days; heatmaps and click data 13 months
Website analytics: Google Analytics	Up to 14 months
Your cookie choice	Remembered for 6 months; the record that you made it is kept for 2 years
Enquiries that do not lead to an account	2 years from our last contact
Client contact, account and communications records	While your organisation is a client, and 6 years after it leaves
Invoices, payments and records of acceptance of our terms	6 years
Security records of logins	12 months
A user’s login	Until it is deleted, or until the organisation’s account is closed and its data deleted
Marketing opt-outs	As long as needed to make sure you are not contacted again

When the period ends we delete the data or make it anonymous. We may keep data longer while a dispute or claim needs it.

11. Deleting your login

Any user except the Account Owner can delete their login in the app or on the web under Settings → Account, or by emailing info@wpchr.co.uk. Your employer keeps your employment records. Only the Account Owner can close an organisation’s account, as our Terms and Conditions explain.

12. Your rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it deleted or its use restricted in some cases, to object to uses based on legitimate interests and at any time to marketing, to receive data you gave us in a machine-readable format, and to withdraw consent where we rely on it. Email info@wpchr.co.uk; it is free. We may ask you to confirm your identity, and we reply within one month (up to two more months for complex requests, in which case we tell you). If your request is about HR information your employer holds, see section 3.

13. Complaints

If you are unhappy with how we use your personal data, please tell us first at info@wpchr.co.uk. We acknowledge every complaint within 30 days and look into it without undue delay. You also have the right to complain to the Information Commission (formerly the ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

14. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. At sign-up our system checks automatically whether an organisation has already had a free trial; if it has, the account starts without one. You can ask for a person to review this at info@wpchr.co.uk.

15. Changes to this policy

We may update this policy. The current version is always at wpchr.co.uk/legal/privacy, with its date. If a change significantly affects how we use your data, we tell client Account Owners before it applies.