WinkeyHR Privacy Policy

WinkeyHR is operated by 12-M Enterprise. WinkeyHR is an HR and payroll SaaS platform available through https://winkeyhr.com and related web, mobile, portal, API and integration experiences.

This Privacy Policy explains how we handle personal data in our own capacity when you visit the website, contact us, create or manage an account, request a demo, or use platform-related support and administration services.

Depending on how WinkeyHR is used, we may process: a. contact and identity information such as names, email addresses, phone numbers, job titles and organisation details; b. employee and applicant information entered by a customer, including employee numbers, employment details, recruitment applications, supporting documents, attendance, leave, performance or workplace records where configured; c. payroll and salary information, including earnings, deductions, benefits, tax configuration, payslip and payroll approval information; d. tax and social-security identifiers where a customer enters them for lawful payroll or employment administration; e. bank and payment information needed for payroll or billing workflows, subject to the customer's configuration and applicable integration; f. account, role, permission, company, facility, activity and support information; and g. technical information such as browser, device, IP address, log data, security events and service usage information.

We ask customers to avoid entering information that is not needed for their selected WinkeyHR workflows.

The public website and platform may use cookies, local storage or similar technologies that are necessary for security, session handling, preferences, authentication and service operation. Where analytics or monitoring tools are enabled, they may collect general usage, device and performance information to help us understand and improve the website and Services.

Browser settings may allow you to control some cookies. Disabling necessary technologies may affect site or account functionality.

We may use personal data to: a. provide, secure, maintain and improve WinkeyHR; b. create and administer accounts, companies, facilities, roles and permissions; c. support HR, payroll, attendance, leave, recruitment, approval, reporting and employee self-service workflows requested by a customer; d. provide support, onboarding, demonstrations and service communications; e. process billing, subscriptions, payment, accounting and integration requests; f. detect, investigate and prevent security events, misuse, fraud and unauthorised access; g. comply with legal obligations and respond to lawful requests; and h. manage our business, records and contractual rights.

For employee, applicant and workforce information entered by a customer, the customer generally decides why and how the information is processed. The customer is generally the controller or equivalent organisation responsible for lawful collection, notices, permissions, accuracy, retention and use, while 12-M Enterprise generally acts as a processor or service provider.

We may act as a controller for website enquiries, account administration, billing, direct communications, platform security, fraud prevention, legal compliance and our own business administration. A separate data-processing agreement may apply where required.

We process personal data in accordance with applicable legal obligations and the agreements that govern the relevant service. Customers remain responsible for complying with employment, payroll, tax, social-security, privacy and records requirements that apply to their organisations and workforce.

WinkeyHR provides software and configuration capabilities. It does not replace professional legal, tax, accounting, employment or privacy advice.

We may use service providers for cloud hosting, database services, authentication, email and messaging, monitoring, security, support, file storage, payments and other infrastructure needed to operate WinkeyHR. We use providers and configurations appropriate to the service, but this Policy does not name a provider unless that provider is confirmed in the applicable service documentation or configuration.

QuickBooks Online and other accounting integrations are enabled by a customer and may receive the data needed for the selected accounting workflow. The connecting customer is responsible for selecting the correct accounting organisation, reviewing mappings and authorising the integration. Third-party providers process data under their own terms and policies.

Personal data may be processed or stored outside the country where you or the customer are located when our service providers, integration providers, support personnel or infrastructure operate across borders. Where required, we use appropriate contractual, technical and organisational safeguards for that processing. Customers are responsible for providing required notices and obtaining required permissions for workforce data they submit.

We use reasonable technical and organisational measures designed to protect personal data, including authentication and role-based access, company separation, access controls, protected credentials, encryption in transit, logging, monitoring, backups and security updates where applicable. No online service can be guaranteed to be completely secure or continuously available.

Customers must protect account credentials, assign suitable roles, remove unnecessary access and report suspected compromise or misuse promptly.

We retain personal data for as long as needed to provide the relevant Services, operate accounts, meet contractual and legal obligations, resolve disputes, maintain security, prevent fraud, support audits and enforce our rights. Customer-controlled workforce data is also subject to the customer's instructions, settings and retention obligations.

Subject to the applicable agreement, technical availability, outstanding obligations and reasonable transition requirements, customers may request exports and deletion of customer data. We may retain or anonymise limited information where required by law or reasonably needed for security, audit, fraud prevention or dispute purposes.

Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. When the relevant data was submitted by a customer, requests should normally be directed to that customer first because the customer controls the employment or applicant relationship. We will provide reasonable assistance to a customer where required by our agreement and applicable law.

You may contact us at info@12mapp.com about our own processing or if you are unsure where to direct a request. We may need to verify identity and authority before responding.

WinkeyHR is intended for organisations and workforce administration. It is not directed to children, and we do not knowingly seek to collect children's data through the public website. If you believe a child has provided personal data to us improperly, contact info@12mapp.com.

We may update this Privacy Policy when our Services, legal obligations or processing practices change. We will publish the updated version on this page and show the effective date. Material changes may also be communicated through the website, platform or account contact details where appropriate.

12-M Enterprise Platform: WinkeyHR Website: https://winkeyhr.com Privacy contact: info@12mapp.com