Privacy Policy

Amity Solutions Limited (company number 04675066, registered in England and Wales) is the data controller for the personal data we hold about our clients and website visitors.

In respect of employee data processed on behalf of our clients, we act as a data processor — our clients remain the data controllers for that data.

This policy explains what personal data we collect, how we use it, and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect and process the following categories of personal data in the course of providing payroll services:

We do not collect any special category data (such as health information) unless this is strictly necessary for payroll purposes and you have provided it with explicit consent.

We use personal data for the following purposes:

• Processing monthly payroll and generating payslips
• Submitting Real Time Information (RTI) returns to HMRC
• Managing auto-enrolment and pension reporting obligations
• Processing new starters and leavers, including P45s
• Completing year-end submissions and issuing P60s
• Invoicing clients for services rendered
• Communicating with you about your payroll
• Complying with our legal and regulatory obligations

We do not use your data or your employees' data for marketing purposes, and we do not sell data to third parties.

We rely on the following lawful bases under UK GDPR:

• Contract — processing is necessary to perform the payroll services you have engaged us to provide
• Legal obligation — certain processing is required to comply with HMRC reporting requirements and employment law
• Legitimate interests — for general business administration and communication relating to your account

Where we process employee data on your behalf, you (as the data controller) are responsible for ensuring you have an appropriate lawful basis for sharing that data with us.

We do not sell or share personal data with third parties for commercial purposes. We may share data in the following limited circumstances:

• HMRC — RTI submissions and year-end returns are submitted directly to HMRC as required by law
• Pension providers — auto-enrolment and pension reporting data may be shared with your designated pension provider where required
• Payroll software providers — data is processed using secure, reputable payroll software. These providers act as data processors and are bound by appropriate data processing agreements
• Legal or regulatory bodies — where we are required by law to disclose information

All third parties with whom we share data are required to handle it securely and in accordance with applicable data protection law.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations.

Payroll records are generally retained for a minimum of six years in accordance with HMRC requirements and standard accounting practice. This includes payslips, RTI submissions, and year-end documentation.

Where you terminate your engagement with us, we will securely delete or anonymise personal data that is no longer required, subject to any legal retention obligations.

Under UK GDPR, you have the following rights in relation to your personal data:

We take the security of personal data seriously. We use appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration, or disclosure. These include:

• Use of reputable, UK-based or adequately protected payroll software
• Password protection and access controls on all systems
• Secure, encrypted email where possible for transmitting payroll documents
• Regular review of our data handling practices

In the event of a personal data breach that is likely to pose a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, affected individuals without undue delay.

This website does not use tracking cookies or analytics software. We do not collect any personal data through the website beyond what you voluntarily provide when contacting us by email.

If you contact us by email via a link on this site, we will retain your email address and any information you provide for the purpose of responding to your enquiry and, if you become a client, for the purposes described in this policy.

This website is hosted on a secure server. We do not use third-party advertising or share any visitor data with advertisers.

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. Where changes are material, we will notify existing clients by email.

The current version of this policy is always available on our website. The date at the top of this page indicates when it was last updated.