Where your payroll data sits, and who can see it

Why this page exists

Choosing a payroll bureau means handing over the bank details, salaries, home addresses and National Insurance numbers of everybody who works for you. It is probably the most sensitive single transfer of data your organisation makes.

Most providers answer questions about it when asked, reluctantly, in a procurement questionnaire, weeks into a process. We would rather put the answers in one place and let you read them before you speak to anybody.

If something here is not clear, or you need it in a particular format for your own records, ask us.

Where your employees’ data is held

What	Where it is held
The payroll platform	Employment Hero, on Amazon Web Services. Some data is processed or backed up outside the UK, covered by the UK Addendum to the European Commission’s standard contractual clauses and by the EU standard contractual clauses
The client portal, where you send us changes and files	Changepen, in Microsoft Azure’s United Kingdom data centre
Email, documents and correspondence	Microsoft 365, United Kingdom data centres
This website and its enquiry records	Hostinger, United Kingdom data centres

No payroll processing happens outside the United Kingdom. We do not use offshore processing teams and we do not subcontract payroll to another bureau. Every payroll we run is run by our own team, here.

The one place data leaves the UK is within the payroll platform’s own infrastructure, and that is governed by its data processing addendum. We will provide a copy of it on request.

Who is responsible for what

This distinction matters more than it sounds, and it decides who you go to with a question.

You are the controller of your employees’ data. You decide that payroll is run, what gets paid, and how long records are kept. It is your data.

We are your processor. We handle it on your instructions, to deliver the service, under a written agreement with you. We do not use it for our own purposes and we never use it for marketing.

The data processing agreement

We provide one as standard, rather than waiting to be asked for one or asking you to send yours.

It is a proper agreement rather than a paragraph. It covers what we may do with your data and what we may not, the duty of confidence on everybody who touches it, the security measures we apply, the sub-processors we use and your right to object to new ones, how we help you answer requests from your employees, what happens when there is a breach, your right to audit us, and what happens to the data when we part company.

It is signed as part of onboarding. Ask and we will send you a copy to read before you commit to anything.

The companies that sit behind us

Anybody who handles your payroll data on our behalf is listed here. We keep this list current and we tell clients in writing at least 30 days before it changes, so there is time to object.

Who	What they do
Employment Hero	The payroll platform the service runs on
Changepen	The client portal you use to send us changes, files and messages
Microsoft	Email, document and file storage, through Microsoft 365
Quaytech Systems	IT support for our systems, which can involve access to the systems holding payroll data

That last entry is on the list because an IT supplier who can reach the systems counts, whether or not they ever open a payslip. Some providers leave that one off. We would rather you saw the whole list.

On contingency cover the list is shorter, because that service runs inside your own Employment Hero environment on your own licence, so nothing passes through ours.

Who at LitE can see your payroll

Two different questions, and they have different answers.

Can other clients see your data?

No. Each client’s payroll is held as a separate business within the platform. One client’s records are not combined with another’s.

Who at LitE can see it?

The people who need to. Payroll administrators are given access only to the payrolls they actually process, not to the whole client base. Account wide administrative access is held by two named people, the payroll manager and a director.

We would rather give you that answer than a vaguer one that sounds better. A bureau whose staff can all see every client is not unusual, and if that mattered to you, you would want to know.

How we protect it

Multi factor authentication is in place on all the systems we use to deliver the service. Access is granted on the principle of least privilege and removed promptly when somebody leaves or changes role. Data is encrypted in transit. Named user accounts are used rather than shared logins, so there is always an audit trail of who did what.

Payroll reports are never sent as email attachments. You receive an email containing a secure link, generated by the payroll platform, from which the reports are downloaded. Emailing an unencrypted payroll report is one of the most common ways a whole workforce’s salary data ends up with the wrong person, usually through nothing more dramatic than autocomplete choosing the wrong name. We do not do it.

We do not publish the detail of our security arrangements, and we would be wary of a supplier who did. Published specifics are a map for anybody looking for one. The full set of technical and organisational measures is set out in the data processing agreement and we will provide it on request, under confidentiality if you prefer.

If something goes wrong

We will tell you within 24 hours of becoming aware of a breach affecting your data, and in practice as soon as we know.

That matters because the clock that counts is yours. As controller you have 72 hours to notify the Information Commissioner’s Office where notification is required, and that clock does not start until you know. A supplier who commits only to telling you “without undue delay” is leaving you to discover how long that turns out to mean.

We will tell you what happened, who and what is affected, what we have done about it, and who to speak to. Where we do not have the full picture at once we will tell you what we know and keep you updated rather than waiting until the story is complete. The decision whether to notify the ICO is yours, because you are the controller, and we will help you make it.

When you leave

At the end of the contract we return your data to you or delete it, whichever you ask for, within 30 days of your instruction. If you ask for it back you get it in a format you can actually use.

No exit fee, and no holding your data hostage while an invoice is discussed. The only thing we keep is anything the law requires us to keep, and we will tell you what that is.

Complaints

If you are unhappy with how we have handled personal information, tell us. Not a form, not a process: an email or a phone call is fine. We will acknowledge it within 30 days and tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office at any time, whether or not you come to us first. We will not take it personally.

Registrations

Things we will not claim

Worth saying, because the absence of a claim is usually harder to spot than a claim.

Encryption at rest is the platform’s control, not ours. Employment Hero and Microsoft encrypt stored data. We do not operate that control, so we do not present it as one of our security measures. If it matters to you, ask for their documentation rather than ours.

We are not certified to ISO 27001. Some bureaus are. We are not, and we are not going to imply otherwise by listing adjacent credentials.

We cannot promise no supplier will ever be breached. Nobody can. What we can tell you is who those suppliers are, what safeguards sit behind them, and exactly what we will do and how quickly if it happens.