Skip to content
Zetta HR
Try it free
FeaturesSponsor compliancePricingSign in

Privacy policy

Last updated 2026-10-22. Draft: pending review by a qualified lawyer.

1. Who we are and our two roles

Zetta HR is operated by Arise Media Technology Ltd (company number 17153497), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU. We are registering with the Information Commissioner’s Office (ICO); this page will show our registration number once confirmed. Contact for anything in this policy: privacy@zettahr.com.

We act in two different roles, and your rights depend on which one applies:

  • Controller of the data about the people who use Zetta HR and pay for it: account, billing, security and website data (sections 2 to 6).
  • Processor of the data a customer puts into Zetta HR about its own workforce, candidates and sponsored workers (section 7). The customer is the controller and decides what is collected and why. Our processing terms are in the Data Processing Agreement.

2. What we collect as controller

  • Account data: name, work email address, password (stored only as a salted hash by our authentication provider), organisation name, your role and permissions.
  • Billing data: organisation billing details and subscription status. Card details are entered with Stripe and never reach our systems; we hold Stripe’s customer and subscription identifiers.
  • Usage and security data: audit records of actions taken in your account (who, what, when), sign-in events, IP addresses and request metadata in network and security logs, and error logs.
  • Communications: messages you send us and the service emails we send you (for example sign-in confirmation, password reset, billing and compliance reminder emails).
  • Website data: we use only the cookies needed to keep you signed in (see the cookie notice). We do not run advertising or analytics trackers.

3. Why we use it and our lawful basis (UK GDPR Art. 6)

  • To create your account, provide and support the service, and take payment: contract.
  • To secure the service, detect abuse and fraud, keep audit trails, prevent unauthorised access and fix faults: legitimate interests (keeping a service that holds sensitive HR data secure and reliable).
  • To keep accounting and tax records and to respond to lawful requests: legal obligation.
  • To send service and compliance-reminder emails you have configured, and to reply to your enquiries: contract and legitimate interests.

We do not sell personal data, do not use customer content for advertising, and do not use customer HR data to train AI models. We do not make decisions about individuals by solely automated means that have legal or similarly significant effects.

4. Who receives personal data (our processors)

We use a small number of service providers, each bound by a data processing agreement. They are listed, with their purpose and location, on our sub-processors page: Cloudflare (hosting, file storage, network security), Supabase (database and sign-in), Stripe (payments) and Resend (email delivery). We may also disclose data where the law requires it, and to professional advisers under duties of confidentiality. If our business is sold or reorganised, data may transfer to the successor, which will be bound by this policy.

5. International transfers

Our database is hosted in the United Kingdom (London) and document files are stored in the European Union. Some providers (and their own sub-processors) may process data in other countries, including the United States. Where personal data is transferred outside the UK, we rely on a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as set out in each provider’s data processing terms.

6. How long we keep it (controller data)

  • Account data: while your account is open, then deleted when the organisation is closed and erased (section 7), except what we must keep below.
  • Billing and accounting records: six years from the end of the financial year to which they relate, to meet tax and company law duties.
  • Security and network logs: kept for a short rolling period set by our providers (typically weeks to months) unless needed to investigate an incident.
  • Enquiries: for as long as needed to resolve them, then deleted within a reasonable period.
  • Backups: deleted data may remain in provider backups until they expire on a short rolling cycle; backups are not used for any other purpose.

7. Data customers put into Zetta HR (we are the processor)

Customers use Zetta HR to record information about employees, workers, candidates and sponsored workers. This can include identity and contact details, employment and pay details, leave, right to work and immigration status records, passport or visa documents, and Home Office sponsorship records. Some of this is special category or otherwise sensitive data. We process it only on the customer’s documented instructions, to provide the service, as set out in the DPA.

  • Isolation: each organisation’s data is separated by database access rules, and documents are held in private storage reachable only through short-lived, permission-checked links.
  • Export and deletion: an organisation owner can export the organisation’s records from the product at any time. When an account is closed, or on written request, we permanently erase the organisation’s data, including linked sign-in accounts that belong only to that organisation and stored documents, within 30 days, subject to the backup note in section 6.
  • If you are an employee or candidate of one of our customers: your employer decides how your data is used and is responsible for telling you about it. Please send rights requests to your employer. If you contact us, we will pass your request to the customer without undue delay and will not respond to it ourselves unless the customer instructs us to.

8. Your rights

As an individual whose data we control, you have the right to be informed, and to access, correct, erase, restrict, port and object to the use of your data, and to withdraw consent where we rely on it. To exercise a right, email privacy@zettahr.com. We may need to confirm your identity, and will respond within one month (extendable by up to two further months for complex requests, in which case we will tell you). Rights are not absolute; we will explain if we cannot comply in full.

9. Complaints

Please tell us first so we can put things right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10. Security

Data is encrypted in transit and at rest, access is controlled by role and by organisation, files are private, administrative access is restricted and logged, and sensitive actions are recorded in an audit log. See our security overview. No system is perfectly secure. If a personal data breach occurs we will notify affected customers without undue delay, and the ICO within 72 hours where the law requires.

11. Children

Zetta HR is a business service and is not directed at children. Customers may record data about employees aged 16 and 17 where lawful.

12. Changes

We will update this policy as the service or the law changes and show the date at the top. For material changes affecting customers we will give notice by email or in the product.