Who we are
HR Heaven operates HRHeaven, a UK-focused HR document generation, compliance membership, dashboard storage, and employer workflow service.
Our contact details are: HR Heaven (HRHeaven), Bradford Chamber Business Park, Laisterdyke, Bradford BD4 8BX. Email: support@hrheaven.co.uk. Phone: 0871 234 0832.
For privacy, data protection, or account-data questions, contact us at support@hrheaven.co.uk.
Scope of this policy
This policy explains how we handle personal data when you visit our website, create an account, use a builder, purchase documents, use dashboard storage, subscribe to Compliance Membership, contact support, or interact with our emails and analytics tools.
Customers using HRHeaven for their business are responsible for deciding what employee, worker, contractor, or company information they enter into the platform. Where you enter information about another person, you must have a lawful basis and authority to do so.
Personal data we may collect
Account and contact data, such as your name, email address, company name, billing contact details, support messages, and login activity.
Business profile data, such as company address, company registration number, industry, workplace profile, signatory details, branding choices, document preferences, membership status, and dashboard settings.
Document-builder data, such as role, employment type, start date, working pattern, workplace rules, policy selections, custom policy text, and other answers you choose to enter for document generation.
Employee or worker data that customers enter into generated documents, such as names, job titles, workplace details, addresses, start dates, and employment particulars.
Payment and transaction records, such as order IDs, Stripe payment references, product purchased, price, currency, payment status, refund status, and invoice or receipt metadata. Full card details are processed by Stripe and are not stored by HRHeaven.
Technical and usage data, such as IP address, device/browser information, pages visited, search terms within the site, builder progress, checkout events, error logs, analytics events, cookie preferences, and security audit logs.
Uploaded or generated files, such as logos, generated PDFs, signature records, certificates, and document files stored in your dashboard where those features are enabled.
How we use personal data
To provide accounts, authentication, dashboard access, builder flows, document generation, PDF downloads, e-signature handoff where available, support, and Compliance Membership features.
To process payments, issue receipts, reconcile Stripe payment status, prevent fraud, handle refund requests, and maintain accounting and tax records.
To store customer dashboard records, version history, document files, activity logs, entitlement records, membership status, and service emails linked to your account.
To improve the product, monitor conversion funnels, understand search and builder drop-off, diagnose errors, protect security, measure SEO performance, and maintain service reliability.
To send service communications, such as account access, payment confirmation, document availability, membership status, security, support, and compliance-related notices.
To send marketing or optional analytics only where permitted by law and, where required, where consent has been collected.
Lawful bases for processing
Our processing is intended to comply with the UK GDPR, the Data Protection Act 2018 and other applicable UK data-protection requirements.
Contract: to provide the service you request, generate documents, process orders, maintain your dashboard, and manage memberships.
Legal obligation: to keep accounting records, tax records, fraud-prevention evidence, and records needed to comply with applicable law.
Legitimate interests: to secure the platform, prevent misuse, improve products, maintain audit trails, support customers, analyse non-sensitive commercial performance, and protect our rights.
Consent: for non-essential cookies, optional analytics, marketing communications, or other processing where consent is legally required.
Special category or sensitive data should only be entered where necessary for your HR purpose and where you have an appropriate lawful basis and condition under data protection law.
Processors and service providers
We use carefully selected providers for hosting, database services, authentication, file storage, payments, email delivery, analytics, error monitoring, and support operations.
Examples may include Stripe for payments, Supabase or equivalent providers for authentication/database/storage, Vercel or equivalent providers for hosting and analytics, Google Analytics where configured, Microsoft Clarity where configured, and email providers for transactional email.
Processors are used to deliver the service and are expected to process data only under appropriate contractual and security arrangements.
International transfers
Some service providers may process data outside the UK. Where this happens, we aim to use appropriate safeguards, such as UK adequacy regulations, standard contractual clauses, data processing agreements, or equivalent transfer protections.
Payment, hosting, analytics, and storage providers may operate global infrastructure. Their own privacy notices may explain additional processing they perform as independent controllers or processors.
Cookies and analytics
Our use of cookies and similar technologies is intended to comply with the Privacy and Electronic Communications Regulations (PECR) and applicable UK GDPR consent and transparency requirements.
Strictly necessary cookies and similar technologies are used for security, login, checkout, account sessions, and core site operation.
Analytics and marketing technologies, such as Google Analytics or Microsoft Clarity, should only be used where configured and where valid consent is collected if required.
See our Cookie Policy for more detail about cookies, analytics, and managing preferences.
Retention
We keep personal data only for as long as reasonably needed for the purpose collected, including providing the service, maintaining your account, meeting legal obligations, resolving disputes, keeping audit trails, and protecting the platform.
Payment, tax, accounting, entitlement, and fraud-prevention records may be kept for longer where required by law or legitimate business need.
Generated documents and files may remain available in your dashboard while your account remains active or while we need to preserve records for support, compliance, legal, or audit purposes. You can contact us to request deletion where applicable.
Security
We use technical and organisational measures designed to protect personal data, including access controls, authentication, audit logging, secure payment providers, and separation of customer records.
No online service can guarantee absolute security. You are responsible for keeping account credentials secure, using strong passwords, controlling who accesses your dashboard, and ensuring information entered into HRHeaven is accurate and authorised.
Your rights
Depending on the circumstances, you may have rights to access, rectify, erase, restrict, object to processing, request portability, withdraw consent, and complain to a supervisory authority.
To exercise a right, contact support@hrheaven.co.uk. We may need to verify your identity and may need to consider legal, security, accounting, or contractual reasons before completing a request.
If you are an employee or worker whose data was entered by an HRHeaven customer, we may direct you to that customer where they are the controller of your employment information.
Complaints
Please contact us first if you have a data protection concern so we can try to resolve it.
You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
Controller and processor roles
HR Heaven is generally the controller of account, billing, security, website, support, marketing-consent and service-usage data that we collect for our own purposes.
Where an employer enters employee, worker, applicant or contractor information into HRHeaven to create or store an HR document, that employer normally decides why and how that information is used. The employer is responsible for its controller obligations, notices, lawful basis, accuracy, retention and responses to data-subject requests.
Where we process that employer information only to provide the requested service, we act as a processor or service provider under the employer's instructions. Our service terms, security controls and applicable data-processing arrangements govern that processing.
Sources of personal data
We collect information directly from you when you create an account, complete a builder, upload a logo or file, submit a payment, request support, use a dashboard or communicate with us.
We may receive limited information from payment, authentication, hosting, email, analytics, fraud-prevention and integration providers, such as payment status, login confirmation, delivery events, device signals or error diagnostics.
If you provide information about another person, you must make sure that person has been given any privacy information required by UK data-protection law and that you have authority to provide it.
AI-assisted features and automated processing
Some builders and HR workflows use automated rules, document-generation logic or AI-assisted features to organise answers, suggest policies, identify missing information, summarise uploaded material or draft wording.
These features support your review and do not remove your responsibility to check the facts, suitability, fairness and legality of a document before using or sharing it. HRHeaven does not make employment decisions about your employees on your behalf.
Do not upload information that is unnecessary for the requested task. Where a provider processes data to support an AI feature, we require appropriate contractual, security and confidentiality controls and use the data only for the configured service purposes.
Data protection incidents
We maintain incident-management processes for suspected loss, unauthorised access, disclosure, alteration or destruction of personal data.
If we identify an incident requiring notification under applicable law, we will assess it and notify the appropriate organisation or customer within the required timeframe. Customers remain responsible for assessing and reporting incidents in their own controller environment where required.
Report suspected account compromise, accidental disclosure or unsafe document access immediately to support@hrheaven.co.uk with the relevant account and document details.
Children and vulnerable people
HRHeaven is intended for employers and business users. It is not directed at children and we do not knowingly collect children's data for marketing purposes.
If an employer's lawful HR process requires information about a young worker or vulnerable person, the employer must ensure that the information is necessary, proportionate, handled fairly and protected by appropriate safeguards.
Changes to this policy
We may update this policy as the platform, legal requirements, suppliers, or processing activities change.
The latest version will be published on this page with the updated date shown above.