PRIVACY POLICY
Privacy Policy
How we process personal data, your rights under the GDPR, and how to exercise them.
If your employer set you up in PersoHR
Your employer is the controller of the HR records it manages in PersoHR, and PersoHR processes those records on its behalf. Contact your employer or HR administrator about that processing. PersoHR also operates your personal sign-in account, which can connect to more than one workspace, and processes data for its own account-security, customer-relationship, billing, support and website purposes. Contact privacy@persohr.eu about those activities. If you close your personal account, the records each employer holds about you stay with that employer, which decides whether to erase or keep them (sections 10 and 11). The sections below distinguish these purposes; using a self-service tool does not remove a controller's obligation to assess a request.
1. Introduction
Labb Holding Ltd ("we", "us", "our") operates the PersoHR HR-management service. This privacy policy explains how we collect, use, share and protect personal data in connection with PersoHR and our public website, in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Cypriot Law 125(I)/2018 implementing it.
2. Who is the controller of your data
Your employer determines the purposes of its HR processing, for which we act as processor under the Data Processing Agreement at /legal/dpa. We determine the purposes of operating the shared PersoHR sign-in account, securing our service, managing our business relationships and running our website, and act as controller for those activities. Your personal account and workspace memberships are distinct: an account may belong to several workspaces. Your name, email address, date of birth and telephone number serve both your account and the HR records of each workspace you belong to. Once you close your account, we hold the details on your account on behalf of those employers, as their processor, and use them ourselves only to confirm your request. When you sign up for PersoHR directly (for example, as the account owner during company registration), when you contact us, or when you use our public website, the controller is Labb Holding Ltd, a Cyprus private company limited by shares with its registered office at Anthipolochagou Georgiou M.Savva 26, Shop 1-2, 8201 Paphos, Cyprus, registered under HE 424230, VAT CY 10424230D, represented by its sole director Michael Delamere. You can reach us at privacy@persohr.eu.
3. Privacy contact
Privacy enquiries should be addressed to privacy@persohr.eu. We assess whether a Data Protection Officer is required under Article 37 GDPR and applicable national law in light of the nature, scale and purposes of our processing. Any designated DPO's contact details will be published here. This contact arrangement does not limit your rights or our statutory response obligations.
4. Categories of personal data we process
Identification and contact data: name, email, phone, postal address, profile photo, date and place of birth, and emergency-contact details. Employment data: job title, department, employment type, start and end dates, working hours, manager. Leave and absence data: leave requests, balances, public holidays. Time-tracking data: clock-in and clock-out events, timesheets and overtime. Salary and payroll-preparation data: salary records, IBAN where supplied, tax and social-security identifiers where supplied, nationality, gender, marital status, number of children, health-insurance provider and type, and church-tax denomination. Performance and development data: objectives, reviews, feedback, training records. Recruitment data: applications, CVs, interview notes, references. Document content: files uploaded by you or your employer. Communication and chat data within the platform. Authentication and security data: login timestamps, IP addresses, browser/device user-agent information and device-session records, two-factor authentication state. Support correspondence. Billing data when you are the account owner: name, billing address, VAT identifier, payment-method tokens (raw card data is held by Stripe, not by us). Church-tax denomination can reveal religion. Disability status, sickness absence, medical-certificate information and some other HR records can reveal health or other special-category data, even without a medical document being uploaded. Your employer must establish an Article 6 basis and any additional Article 9 condition for that processing. Signing workflows can process signer details, signatures and evidence of the signing event. Company legal details: a customer's legal name, legal form, registry number and registered address, and the name, position and email address of the data protection contact it names, entered at registration or in the settings and recorded with its acceptance of our Data Processing Agreement. We receive data from you, from employers or authorised workspace users who invite or record information about you, from connected services, and from your use of the service. Required account and security details enable sign-in and account protection; without them we may be unable to provide those functions. Optional profile details and their sharing controls are identified in the application. Your employer explains which HR information it requires and the consequences of not providing it.
5. Lawful basis for processing
For processing where we are the controller, Article 6(1)(b) applies where the individual is a party to the contract or asks us to take steps before entering it. For people representing a business customer, we rely on Article 6(1)(f) for administering that relationship and corresponding with them, subject to balancing their rights against our interests. We also rely on legitimate interests for operating and protecting shared user accounts, service security, abuse prevention, responding to enquiries and measuring use of our public pages and subscription service, subject to the applicable balancing assessment and any separate consent requirement for terminal access, and Article 6(1)(c) for applicable tax, accounting and other legal obligations. Where consent is the basis, it may be withdrawn. Your employer determines and explains the bases for its HR processing. Employment does not provide a blanket basis for every use of personal data; special-category and criminal-conviction data require the additional conditions in Articles 9 and 10 respectively.
6. How we use your data
We process HR records on the customer's instructions for HR management, and account, contact and technical data for the platform and business purposes described in this policy: maintaining employee records, managing leave and absence, organising the company structure, supporting performance and development, running recruitment, preparing payroll exports, storing documents, enabling internal communication, shared user accounts, billing, support, abuse prevention, security, and public-page and subscription-event measurement. We do not sell your data, do not share it with advertising networks, and do not use it for marketing without your separate opt-in consent.
7. AI-assisted features
AI features include the HR assistant, onboarding suggestions, setup-wizard content generation, document analysis, review drafting, employment-reference drafting and requested text translations. PersoHR uses Mistral AI for these features. AI is enabled by default in workspace settings. The individual AI opt-out is not applied to setup-wizard generation or requested free-text translation. The employee processing-restriction flag is not checked by document analysis or review drafting. Setup-wizard generation can send the owner's name and company description. Inputs may include your prompt, relevant employee or review context assembled by the feature, and contents of documents submitted for analysis. Responses may contain personal data and may be saved as part of the relevant workflow. Only include information appropriate for the task and supported by your employer's lawful basis. AI controls do not automatically remove references to a person from documents or text supplied by other users. Provider processing and transfer details are described in the sub-processor list. Do not assume that EU incorporation alone determines every processing location or retention setting.
8. Sub-processors and recipients
We use service providers for customer HR processing and for our own controller activities. A provider is a sub-processor under the DPA only to the extent it processes customer personal data on our behalf. Stripe also acts as an independent controller for specified payment, fraud-prevention and legal-compliance purposes under its own privacy information. Customer-enabled chat and signing services may receive the content and recipient details needed for the requested operation; their role depends on who selects and contracts with the provider. The current list, including each sub-processor's role, location and data-protection mechanism, is published at /legal/sub-processors. We inform the account owner at least 30 days before adding or replacing a sub-processor and offer the right to object on reasonable data-protection grounds.
9. International transfers
Core HR hosting is provided through Hetzner in Germany. AI, email, security SMS, analytics and billing involve the providers listed at /legal/sub-processors. Provider headquarters, storage locations and onward processing are different parts of the data flow. Stripe billing can involve processing outside the EEA; customer-enabled integrations may also disclose data to providers chosen by the customer. Where we arrange transfers outside the EEA, they must be covered by an applicable adequacy decision or appropriate safeguards under Chapter V GDPR, with supplementary measures where needed. Contact privacy@persohr.eu for information about the safeguards applicable to your data and how to obtain a copy.
10. Retention periods
Your employer is responsible for determining how long its HR records may lawfully be retained, taking account of their purpose, applicable employment and tax law, and justified legal holds. The current erasure tools and automatic deletion schedules do not give the employer complete control over those decisions. Ending employment or cancelling a subscription does not itself delete every record. Data return and deletion at the end of processing are governed by section 13 of the DPA. An in-app company-workspace deletion request has a 30-day cancellation window. Closing your personal account is a different procedure, which takes effect at once and cannot be undone. We immediately delete your sign-in and security details, sessions, account preferences, the support requests stored in the application with their screenshots, and your conversations with the AI assistant. The copy of each in-app support request that reached our support mailbox is kept like other support correspondence, as described below. The HR records your employers hold about you stay in their workspaces until the employer erases them or the workspace is deleted. An employer's erasure can still leave records the law requires it to keep, such as a working-time register kept under your name, until their retention period ends or the workspace is deleted. A workspace that is already being deleted erases your records in the nightly run after your employer's final copy of its data is complete, or at deletion if that comes first, so they are part of any final copy your employer receives. The copy we hold is deleted with the workspace. The name, email address, date of birth and telephone number on your account stay on file on your employers' behalf, because their records use them, and are anonymised once every workspace you belonged to has erased your membership or been deleted. Until then the email address stays with the closed account, so registering it again or inviting it to any workspace is refused. We write to that address only to confirm your request, to tell you an employer's decision, to deliver notices your employer is required by law to give you, and to send a workspace's final copy of its data when no other owner of that workspace can receive it. If you accepted our legal terms or a template disclaimer on behalf of a workspace, when registering it or when downloading a policy template, the record of that acceptance is kept for the life of the workspace as contract evidence, and the IP address and browser details stored with it are removed after two years or when your identity details are anonymised, whichever comes first. The company legal details a workspace enters are kept while the workspace exists and deleted with it. The copy recorded with its acceptance of our Data Processing Agreement is kept for the life of the workspace as contract evidence, and a contact email address in it is removed when that person's PersoHR identity details are anonymised. When the workspace is deleted, we keep its legal name, legal form, registry number and registered address with the record of that acceptance for up to seven years, as evidence of whom the contract was with. Audit records are subject to scheduled retention and separate retention for specified legal-hold records; they are not promised indefinitely. Authentication records are retained according to their security purpose and expiry rules. We retain billing records for the applicable tax and accounting obligations and support correspondence for handling the request and necessary follow-up or legal claims. These periods depend on the record and applicable obligation, not a single GDPR-mandated number of days or years. Contact us for the retention criteria applicable to a particular record. Data no longer needed for a lawful purpose is deleted or anonymised.
11. Your rights
You may request access, correction, erasure, restriction and, where applicable, portability, or object to processing under Articles 15 to 22 GDPR. These rights have conditions and exceptions: required legal records may need to be retained, and portability applies to data you provided that is processed automatically on consent or contract grounds. You may withdraw consent without affecting earlier lawful processing. Contact your employer for HR-data requests and privacy@persohr.eu for processing we control. Available account and HR tools can assist, but not every right or record is fully covered by self-service. You can close your personal account in the application. Closing it deletes your sign-in details and the other account data listed in section 10, and passes your erasure request to every workspace you belong to, because each employer is the controller of its HR records and decides whether to erase or keep them. We confirm your request by email and write again when an employer records its decision, or when your records are erased because a workspace is being deleted. If an employer keeps your records, your account stays closed. An employer can invite you afresh only once every workspace you belonged to has erased your membership or been deleted. Export your account data before you close the account, since the export needs you to be signed in. If you are the only owner of a workspace that is not being deleted, closing your account makes its longest-serving active HR administrator an owner. If the workspace has no active HR administrator, your account cannot be closed until the workspace has another active owner or an active HR administrator, or until the workspace is being deleted. After closure, send corrections to your name, email address, date of birth or telephone number to privacy@persohr.eu. We pass the request to each employer that holds a record of you and make the correction on its instruction. The responsible controller must respond without undue delay and within one month; a permitted extension of up to two further months must be explained within the first month. You may complain to a supervisory authority or seek a judicial remedy if a request is refused.
12. Automated decision-making
PersoHR's AI features assist users with HR tasks. Customers must review outputs before relying on them and must not use them as the sole or decisive basis for significant employment decisions, as set out in the Terms. This is a requirement on use, not a claim that every workflow technically enforces human approval. The Service also runs rules-based HR workflows, including leave-balance calculations, carry-over notices and expiry or preservation of carried leave. These functions can affect recorded entitlements. Your employer is responsible for explaining the applicable rules and any automated decision-making or profiling it carries out, assessing whether its use is covered by Article 22 GDPR, and providing any required safeguards and opportunity to contest a decision. Applicable AI legislation must also be considered for AI features.
13. Security of processing
Application safeguards include role-based access, tenant-scoped controls, passwordless authentication, time-limited tokens, two-factor requirements for privileged roles, encryption of selected sensitive fields and audit records for supported actions. The security annex at /legal/security explains their scope. These features support our obligation to maintain security appropriate to the processing risk; they do not constitute a guarantee that incidents cannot occur.
14. Data breach notification
When we process HR data for an employer, we notify that controller without undue delay after becoming aware of a personal data breach and assist with its response. For processing we control, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours unless the breach is unlikely to result in a risk to individuals' rights and freedoms. Where required by Article 34 GDPR, we also communicate a breach likely to result in high risk to affected individuals without undue delay.
15. Cookies and similar technologies
PersoHR uses browser storage for sign-in, language preferences, in-progress workflows and interface settings. The refresh-token cookie is HttpOnly, so page JavaScript cannot read it; this does not prevent every consequence of a script-injection attack. The marketing site uses a language cookie and Plausible cookieless analytics. Browser analytics covers public website pages and public app authentication and legal pages. Authenticated workspace pageviews are not sent. When enabled, the backend also sends checkout and payment events with plan, billing cycle, amount and, for checkout, company country; those event payloads do not include names, email addresses or tenant identifiers. Stripe may use its own cookies during checkout. See /legal/cookies for the inventory and purposes. Whether a storage operation requires consent depends on its purpose and the applicable rules; being first-party or cookieless alone does not establish a legal exemption.
16. Support requests
When you use the in-app contact form or write to support@persohr.eu, your message and any attached screenshot reach our support team. The in-app form also includes context such as your company, plan, name, email and current page to help investigate the request. Avoid including unrelated personal data in messages or screenshots. The website contact form processes your name, email, optional company and message and sends them to us by email. It uses IP-based rate limiting to prevent abuse. Delivery and the resulting mailbox correspondence involve our configured email services. We retain correspondence for resolving the request and necessary follow-up, subject to applicable legal obligations or claims. When you close your personal account, the application deletes the requests you sent through the in-app form and their screenshots. The copy each request sent to our support mailbox is retained like other correspondence.
17. Right to lodge a complaint
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement, if you consider that our processing of your personal data infringes the GDPR. The supervisory authority in Cyprus, where Labb Holding Ltd is established, is the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy). A list of all national supervisory authorities is published by the European Data Protection Board at edpb.europa.eu.
18. Changes to this policy
We may update this policy to reflect changes in the service, applicable law or our processing activities. Material changes are notified to the account owner by email at least 30 days before they take effect. The version and last-updated date are shown at the top of this document; any separate future effective date is identified in the change notice. Where we act as controller, we also inform affected individuals of material changes as required by applicable law. A privacy notice explains processing; acknowledging it does not itself supply consent or waive data-protection rights. The previous version remains accessible on request to privacy@persohr.eu.
19. Contact
For privacy-related enquiries, please email privacy@persohr.eu or write to Labb Holding Ltd, Anthipolochagou Georgiou M.Savva 26, Shop 1-2, 8201 Paphos, Cyprus. You may also contact your company administrator for matters relating to data your employer controls. For requests to exercise GDPR rights concerning processing we control, the response periods and permitted extensions in section 11 apply.