Privacy Policy

RealtouchHR is a product of Realtouch Research and Consulting, a brand of Realtouch Global Ventures Ltd ("we", "us", "our"). We operate the RealtouchHR platform, a cloud-based human resources and payroll management service designed for UK small and medium-sized businesses. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our website at realtouchhr.com and our associated services (collectively, the "Service").

We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our Service, you acknowledge that you have read and understood how we process your personal data.

RealtouchHR Ltd is the data controller for the personal data of account holders (administrators and owners) and is a data processor in relation to the employee personal data that your organisation inputs into the platform.

If you are an employee whose data has been entered into RealtouchHR by your employer, your employer is the data controller for your personal data and you should contact them directly with any enquiries.

You can contact our Data Protection Officer at: privacy@realtouchhr.com

We collect and process the following categories of personal data:

Account and Registration Data

• Full name and email address
• Password (stored as a one-way cryptographic hash)
• Company name and registration number
• Role and permissions within the platform

Employee Data (entered by your organisation)

• Full name, date of birth, National Insurance number
• Contact details (home address, personal email, phone number)
• Right to work status and visa/immigration details (where applicable)
• Employment details: job title, department, start date, salary, contract type
• Bank account details for payroll processing
• Tax codes and payroll history
• Leave entitlements and absence records
• Performance and training records
• Documents and certifications
• Profile photographs (if uploaded)

Usage and Technical Data

• Log data: IP address, browser type, pages visited, timestamps
• Device information
• Session tokens and authentication data
• Feature usage analytics (aggregated and anonymised where possible)

Third-Party Sign-In

If you sign up or log in using Google OAuth, we receive your name and email address from Google. We do not receive your Google password.

We use the personal data we collect for the following purposes:

• Providing the Service: To create and manage your account, process payroll, manage employee records, generate compliance reports, and deliver all platform features.
• Communications: To send you service-related emails such as account creation confirmations, password resets, and important platform notifications. We will not send marketing emails without your explicit consent.
• Customer Support: To respond to your queries, troubleshoot issues, and improve the Service.
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, abuse, and security incidents.
• Legal Compliance: To comply with our legal obligations under UK employment law, tax law, and data protection law.
• Service Improvement: To analyse usage patterns and improve our platform (using anonymised and aggregated data where possible).
• Billing: To process subscription payments and manage your account.

Under UK GDPR, we process your personal data on the following legal bases:

• Performance of a Contract (Article 6(1)(b)): Processing necessary to deliver the RealtouchHR Service to you under our Terms of Service.
• Legal Obligation (Article 6(1)(c)): Processing required to comply with UK law, including payroll tax obligations under HMRC rules.
• Legitimate Interests (Article 6(1)(f)): Processing for security, fraud prevention, service improvement, and audit logging where our interests are not overridden by your rights.
• Consent (Article 6(1)(a)): Where we rely on your consent (for example, for optional marketing communications), you may withdraw consent at any time.

For special category data (such as right-to-work documents containing immigration status), we rely on Article 9(2)(b) UK GDPR (processing necessary for employment law obligations) and Article 9(2)(g) (substantial public interest).

We do not sell your personal data. We share data only with trusted third-party service providers ("processors") who assist us in operating the Service, under strict data processing agreements:

We may also disclose data to law enforcement or regulatory authorities where required by law, or to protect the rights and safety of our users.

Some of our third-party processors are based outside the UK or the European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses
• Transfers to countries with an adequacy decision from the UK Secretary of State

You can request details of the specific safeguards in place by contacting us at privacy@realtouchhr.com.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal and regulatory requirements:

• Account data: For the duration of your subscription plus 7 years (to comply with HMRC record-keeping requirements).
• Payroll records: 7 years from the end of the relevant tax year (HMRC requirement).
• Right to work documents: 2 years after the end of employment.
• Audit logs: 7 years.
• Deleted account data: Purged within 90 days of account closure, except where retention is required by law.

When data is no longer required, it is securely deleted or anonymised.

You have the following rights regarding your personal data:

• Right of Access (Article 15): You can request a copy of the personal data we hold about you (a Subject Access Request).
• Right to Rectification (Article 16): You can ask us to correct inaccurate or incomplete data.
• Right to Erasure (Article 17): You can ask us to delete your data in certain circumstances ("the right to be forgotten").
• Right to Restrict Processing (Article 18): You can ask us to suspend processing of your data in certain circumstances.
• Right to Data Portability (Article 20): You can request your data in a structured, machine-readable format.
• Right to Object (Article 21): You can object to processing based on legitimate interests.
• Rights in Relation to Automated Decision-Making (Article 22): You have the right not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, contact us at privacy@realtouchhr.com. We will respond within one calendar month. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Bcrypt hashing for passwords
• JWT-based session tokens with secure HttpOnly cookies
• Role-based access control
• Audit logging of all data access and changes
• Two-factor authentication (2FA) option for accounts
• Regular security assessments

Despite these measures, no method of transmission over the internet is 100% secure. If you believe your account has been compromised, please contact us immediately at security@realtouchhr.com.

We use cookies and similar technologies to operate the Service and improve your experience:

• Strictly Necessary Cookies: Session tokens required for authentication. These cannot be disabled without affecting your ability to use the Service.
• Preference Cookies: Store your theme and display preferences (light/dark mode).
• Analytics Cookies: Used to understand how the Service is used (where consent has been obtained).

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in.

The RealtouchHR Service is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at privacy@realtouchhr.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and by posting a notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after that date constitutes acceptance of the updated policy.

The date at the top of this document indicates when this policy was last updated.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

For complaints, you may also contact the UK Information Commissioner's Office (ICO):