Loading page
What we collect, why we process it and what you can ask us to do with it. Written to be read rather than skimmed past.
Last updated: 1 August 2026
KormoPay provides HR and payroll software to employers. This policy explains what we do with personal data when you visit our website, evaluate the product, or use it as a customer.
When an employer uses KormoPay to run payroll, that employer is the controller of their employees' data and we act as a processor on their instructions. Our agreement with them, not this policy, governs that data.
Contact details you give us — name, work email, company, phone number and anything you type into a demo or contact form.
Account data if you become a customer, including your users' names, roles and authentication identifiers.
Usage data such as pages viewed, features used, browser type and approximate location derived from IP address.
Employee data uploaded by a customer into their workspace. We only process this to provide the service.
To provide, secure and support the service, including running payroll calculations and generating the documents you ask for.
To respond to enquiries, arrange demos and send service messages about your account.
To improve the product using aggregated usage patterns. We do not use customer payroll data to train models.
To meet legal, tax and audit obligations that apply to us as a company.
Where GDPR applies, we rely on: performance of a contract for account and service data; legitimate interests for product improvement and security; consent for marketing email, which you can withdraw at any time; and legal obligation where a law requires us to retain records.
Marketing and enquiry data is kept for 24 months from your last interaction unless you ask us to delete it sooner.
Customer workspace data is retained for the life of the subscription and deleted within 90 days of termination, except where a statutory retention period requires us to keep payroll records for longer.
Audit logs are retained according to the plan on your contract.
Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal data, and to object to processing based on legitimate interests.
If your data sits in an employer's KormoPay workspace, ask your employer first — we will refer your request to them as the controller.
To exercise a right in relation to data we control, email privacy@kormopay.example. We respond within 30 days.
Data may be processed in a region other than your own. Where it is, we rely on standard contractual clauses or an adequacy decision, and Enterprise customers can pin their workspace to a specific region.
We will post any material change on this page and, for customers, give notice through the product or by email before the change takes effect.