Privacy Notice

HarmoniHRM is a workforce operating system used by organisations around the world to manage their people, structure, pay, leave and related operations. This notice explains what personal information we handle, why we handle it, and the choices and rights available to you. It applies to our public website and to the HarmoniHRM application.

In most cases your employer (or the organisation that gave you access) is the controller of the workforce data held in HarmoniHRM, and HarmoniHRM acts as a processor on their behalf. For our public website, account sign-up and billing, HarmoniHRM is the controller. Where your employer is the controller, please also refer to their own privacy notice.

We collect the following categories of personal information:

• Account and contact details: name, work email, phone number, job title, role and organisation.
• Workforce records (as a processor for your employer): employment history, reporting lines, compensation, leave, attendance, documents, performance and compliance data that the organisation chooses to store.
• Usage and device data: log-ins, pages viewed, actions taken, IP address, browser and device type, collected to operate, secure and improve the service.
• Billing data for paying customers: company details and limited payment metadata. Card details are handled directly by our payment processor and are not stored by us.
• Communications: messages you send to our support and sales teams.

We use personal information to:

• Provide, maintain and secure the HarmoniHRM service and its features.
• Authenticate users and protect against fraud, abuse and unauthorised access.
• Provide customer support and respond to enquiries.
• Process billing and manage subscriptions.
• Improve and develop the product, including reliability, performance and new features.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use the workforce content stored by our customers to train general-purpose models.

Where data protection law requires a legal basis, we rely on one or more of the following, depending on the context and the jurisdiction in which the work takes place:

• Performance of a contract, to deliver the service you or your employer have signed up for.
• Legitimate interests, to secure, operate and improve the service in a proportionate way.
• Legal obligation, where the law requires us to retain or disclose information.
• Consent, where we ask for it, for example certain optional cookies or marketing.

Because HarmoniHRM is used globally, the precise legal basis and protections that apply depend on local law. Our intention is to meet a high common standard everywhere we operate.

We keep personal information only for as long as it is needed for the purposes described here, or for as long as the controlling organisation instructs. Workforce records are retained according to the customer organisation’s configuration and instructions, and are deleted or returned at the end of the relationship in line with our agreement. Account, billing and security logs are retained for the periods required to run the business and to meet legal and accounting obligations, after which they are deleted or anonymised.

We use a small set of trusted service providers to host infrastructure, send transactional email, process payments and provide analytics and support. These providers act on our instructions under contract and are not permitted to use the data for their own purposes. A current list is maintained on our Sub-processors page, and our commitments when handling customer personal data are set out in our Data Processing Addendum.

HarmoniHRM is operated globally, and information may be processed in countries other than the one in which you are based. Where we transfer personal information across borders, we use appropriate safeguards recognised by the relevant law, such as standard contractual clauses or equivalent mechanisms, and we apply consistent security controls regardless of location. Customers can ask about the regions in which their data is hosted.

Subject to local law, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data protection authority.

If your data is held in HarmoniHRM by your employer as the controller, please direct requests about that workforce data to your employer in the first instance. We will support our customers in responding to such requests. For data we control, contact us using the details below.

Every organisation on HarmoniHRM also has its own privacy request page, which current staff, former staff and job applicants can use without an account. Start at our privacy request page to find it.

HarmoniHRM is a workplace product intended for use by organisations and their staff. It is not directed at children, and we do not knowingly collect personal information from children.

We may update this notice from time to time as the product and the law evolve. When we make material changes we will update the date at the top of this page and, where appropriate, notify customers through the service or by email.

For privacy questions, or to exercise a right we control, contact our privacy team at hello@harmonihrm.com. We aim to respond within the time required by applicable law.