HULO Global Limited is responsible for this website and the PayrollOS service, also described as HULO HR. We are registered in England and Wales under company number 17134928. Our registered office is Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE. Our ICO registration reference is ZC158327.
For privacy questions or requests, email [email protected] or write to our registered office, marking your message “Privacy”.
What this notice covers
For our separate Vendure plugin licensing service, please also see its privacy policy and plugin terms. The PayrollOS notices do not change existing plugin contracts.
This notice covers visits to our websites, business enquiries, support correspondence and information used to administer access to our services. HULO Global Limited is the controller of that information: we decide why and how it is used.
The PayrollOS service uses contact and account information to administer access to the organisation’s enabled services. Only upload information required by those services. Employee payroll, bank, health and identity-document information must not be uploaded until the organisation is authorised for payroll processing and the applicable data-processing agreement is in place. See the PayrollOS privacy notice for details of service accounts and organisation access.
Before employee payroll processing is enabled for an organisation, we will provide the applicable data-processing agreement and service-specific information about providers, processing locations and retention. An employer normally decides how its employee information is used. Its privacy notice will explain that use; HULO’s processing responsibilities will be set out in its agreement with the employer or authorised service customer.
Information we use and why
| Information | Purpose | Lawful basis |
|---|---|---|
| Name, business email, company and information you include in an enquiry | Respond to your request and discuss the service or project | Taking steps at your request before a contract where you are the prospective contracting individual; otherwise our legitimate interest in responding to business enquiries |
| Account details, organisation memberships, permissions and authentication information | Create and administer authorised service access | Performance of a contract with an individual customer, or our legitimate interests in providing the contracted service and managing business-user access |
| Support messages and information needed to investigate an issue | Resolve problems and maintain a record of the assistance provided | Our legitimate interests in supporting the service; performance of a contract where applicable |
| Network address, browser information, request details, security challenge results and relevant access or audit events | Deliver the website, prevent spam and unauthorised access, investigate faults and protect users; the contact enquiry email also records the sender’s network address, browser user agent and receipt time | Our legitimate interests in operating a secure and reliable service |
| Business contract, invoice and payment-status records, when a paid service is supplied | Administer the contract, reconcile charges and keep required business records | Performance of a contract where applicable, our legitimate interests in business administration and compliance with legal accounting obligations |
We receive information directly from you, from your browser, and, for organisation accounts, from the administrator who invites or manages you. Where a supported Companies House lookup is used, relevant company details come from that public register. HMRC data is accessed only through an enabled, authorised connection for a stated purpose; visiting this website does not connect an HMRC account.
Providing enquiry details is voluntary, but we need a means of replying to answer you. Required account fields are necessary to administer access. Please provide only what is needed and keep sensitive payroll records, passwords, recovery codes, API keys and card details out of contact forms and ordinary support email.
We do not use enquiry messages for marketing. We do not make solely automated decisions with legal or similarly significant effects about website enquirers. Automated security checks may block suspected abusive requests; you can contact us by email if you cannot use a form.
Who receives information
Authorised HULO personnel access information where needed for their work. Website delivery, security, hosting and email providers also process information needed to operate those services. This means that information is not confined to HULO’s staff alone.
The website runs on infrastructure operated for HULO and uses Cloudflare for website delivery and security, including its Turnstile service for contact-form spam protection. Cloudflare receives technical browser and request information to perform those checks. The server sends the challenge response and network address to Cloudflare for verification. See Cloudflare’s privacy policy.
Contact-form messages are delivered to our contact mailbox through Google’s email service. The email contains the submitted name, email, company and message, together with the network address, browser user agent and received time. Google processes the message in delivering and storing email. See Google’s privacy information. The contact form does not create a separate customer database entry in the website application.
When Stripe billing is enabled for a paid service, Stripe processes payment details on its hosted pages. We receive the billing and subscription information needed to administer your account. Card entry is handled by Stripe; do not send card details to HULO. Stripe’s own processing is described in its privacy policy. Paid enrolment is not currently open.
We may disclose relevant information to professional advisers or public authorities where needed to meet a legal obligation, respond to a lawful request or establish, exercise or defend legal claims. We do not sell personal information.
Processing outside the UK
Cloudflare and Google operate international services. Cloudflare says that, by default, some cookie data may be processed in the United States; Google’s privacy information explains that it uses servers around the world. Their privacy information describes their international-transfer arrangements. We do not represent that all website or email information stays in the UK. You can request information about the applicable recipients and transfer safeguards by contacting us.
We will identify approved payroll processing locations, providers and applicable international-transfer safeguards before customer payroll data is accepted.
How long information is kept
Retention depends on the reason the information is held. Contact messages remain in our email correspondence rather than being automatically deleted by the website. They are needed while we answer the request, perform any resulting work and resolve related follow-up or complaints. The website temporarily holds a network-address-based rate-limit record in server memory; the default window is ten minutes, with expired entries cleared in a sweep every five minutes. Account information is needed while the account is in use and to handle closure and relevant security investigations. Contracts and accounting records may need to be kept for applicable legal record-keeping periods. A specific legal claim, investigation or preservation obligation may require relevant records to be kept longer.
Payroll record-retention periods are governed by the applicable service agreement and the employer’s instructions. Supplied example records may be reset or deleted and are not a records-retention service. Ask us for the period or criteria applying to a particular record if you need more detail.
Your choices and rights
Depending on the circumstances, you can ask to access, correct or delete your personal information, restrict its use, object to processing based on legitimate interests, or receive portable information. Where consent is used, you can withdraw it without affecting earlier lawful processing. These rights can be subject to legal conditions and exceptions.
Email [email protected] with your request. We may need enough information to confirm your identity and locate the relevant records. If your request concerns information controlled by an employer, we will explain the appropriate route and assist that employer where required.
You can complain directly to the Information Commissioner’s Office, the UK’s data-protection regulator. You do not have to complain to us first, although we welcome the opportunity to resolve a concern.
Changes and related information
We will update this notice when our processing changes and provide further information before using information for a materially different purpose. See our cookies notice for browser storage and our support and security page for reporting a concern.