Privacy Policy

StaffPlace ("we", "our", "us") is a people management platform operated by Geospatial Technology Services Limited. This privacy policy explains how we collect, use, store, and protect personal data when you use our platform.

1. Data We Collect

We collect and process the following categories of personal data:

• Account Data: Name, email address, password (hashed), organisation name
• Employee Data: Full name, date of birth, gender, employee ID, department, job title, hire date, phone number, address, emergency contacts
• Financial Data: Salary information, bank account details, tax ID, pension ID, expense claims
• Performance Data: Appraisal scores, KPIs, training records, competency assessments
• Document Data: Uploaded files (certificates, ID copies, contracts)
• Usage Data: Login times, IP addresses, browser information (for security and audit purposes)

2. How We Use Your Data

We use personal data solely for the purpose of providing our HR platform services:

• Processing payroll and generating payslips
• Managing employee records and profiles
• Facilitating appraisals, training, and leave management
• Sending transactional emails (password resets, claim notifications, etc.)
• Maintaining audit trails for compliance
• Improving our platform and fixing issues

3. Data Controller & Processor

StaffPlace acts as a Data Processor on behalf of our customers (the Data Controllers). Each organisation that signs up to StaffPlace is the Data Controller for their employees' data. We process data only as instructed by the Data Controller and in accordance with our Data Processing Agreement.

4. Legal Basis for Processing

We process personal data based on:

• Contractual necessity: To provide the services you signed up for
• Legitimate interest: To maintain security, prevent fraud, and improve our platform
• Legal obligation: To comply with tax, employment, and data protection laws
• Consent: For optional features like public CV sharing

5. Data Storage & Security

We implement robust security measures to protect your data:

• All data encrypted in transit via SSL/TLS (Cloudflare)
• Passwords stored using BCrypt hashing (never plaintext)
• Database access restricted to authenticated application queries only
• Multi-tenant architecture with strict data isolation between organisations
• Role-based access control with audit logging
• Regular automated backups

6. Data Retention

We retain personal data for as long as your organisation's account is active. Upon account termination:

• Active data is retained for 30 days (grace period for reactivation)
• After 30 days, all organisation data is permanently deleted
• Audit logs are retained for 12 months for compliance purposes
• Backup data is purged within 90 days of account deletion

7. Your Rights

Under applicable data protection laws (including NDPR and GDPR), you have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Export your data in a machine-readable format
• Restriction: Request that we limit processing of your data
• Objection: Object to processing based on legitimate interest

To exercise any of these rights, contact us at [email protected].

8. Sub-Processors

We use the following third-party services to deliver our platform:

• Cloudflare: SSL/TLS encryption, CDN, DDoS protection (US/Global)
• Server hosting: VPS infrastructure (data stored in secure data centres)

We do not share personal data with any other third parties.

9. International Transfers

If your data is transferred outside your country of residence, we ensure adequate safeguards are in place, including standard contractual clauses where required by law.

10. Children's Data

StaffPlace is a B2B platform for workforce management. We do not knowingly collect personal data from children under 16.

11. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email or in-platform notification.

12. Contact

For privacy-related queries or to exercise your data rights:

Data Protection Officer
Geospatial Technology Services Limited
Email: [email protected]