Privacy Policy

1. Who we are

Clearpath HR is operated by Black Sheep Software Ltd, a company registered in England and Wales. We provide HR management software to small and medium-sized businesses.

For the purposes of UK data protection law, Black Sheep Software Ltd is the data processor acting on behalf of each customer organisation, which is the data controller for the personal data of its employees held within the platform.

Contact: privacy@clearpathhr.example

2. What data we collect

We collect and process the following categories of personal data on behalf of customer organisations:

• Identity data — full name, preferred name, employee number
• Contact data — work email address, personal email, phone number, home address
• Employment data — job title, department, start date, contract type, working pattern, salary/rate information
• Leave and absence data — holiday requests, sickness records, return-to-work interviews
• Emergency contact data — name, relationship, and phone number of a nominated contact
• Onboarding data — task completion status for new starter checklists
• Training data — training records, certifications, and expiry dates
• Document data — files uploaded to employee profiles (e.g. contracts, right-to-work documents)
• Account data — email address and authentication credentials for platform users
• Usage data — audit log of actions taken within the platform

We do not collect special category data (health, ethnicity, religion, etc.) unless explicitly provided as part of sickness or document records. Customers are responsible for ensuring a lawful basis exists before recording such data.

3. How we use your data

Personal data is used solely to provide the Clearpath HR service to the employing organisation. Specifically:

• To display employee records and HR information within the platform
• To send transactional emails (portal invitations, leave notifications, onboarding welcome)
• To send HR reminder digests to authorised HR administrators
• To maintain an audit log of platform activity
• To support the functioning of leave, onboarding, training, and policy modules

We do not sell personal data to third parties. We do not use personal data for advertising.

4. Legal basis for processing

As a data processor, we process personal data under the instructions of each customer organisation (the data controller). Customers must have a lawful basis for processing employee data — typically:

• Contract — processing necessary for the employment contract
• Legal obligation — e.g. statutory leave records, right-to-work checks
• Legitimate interests — e.g. training records, organisational management

5. Data storage and security

All data is stored in the European Union (Ireland) using Supabase (Postgres). Data in transit is encrypted using TLS 1.2+. Data at rest is encrypted at the database level.

Access to personal data is restricted by role — employees can only see their own records; managers can see their direct reports; HR admins see their organisation only. Platform administrators (Black Sheep Software staff) can access organisation data for support purposes and are bound by confidentiality obligations.

We maintain a complete audit log of all data access and modification events within the platform.

6. Data retention

Data is retained for as long as a customer organisation holds an active subscription. On account termination, customer data is retained for 30 days to allow for export, then permanently deleted. Customers may request immediate deletion at any time.

Audit log entries are retained for 2 years to support compliance requirements.

7. Third-party services

We use the following sub-processors:

• Supabase Inc. — database and authentication hosting (EU region)
• Vercel Inc. — application hosting (edge, UK/EU region)
• Resend Inc. — transactional email delivery

All sub-processors are required to maintain appropriate data protection standards.

8. Your rights

Employees whose data is held in Clearpath HR should direct data subject requests (access, rectification, erasure, portability) to their employer (the data controller), who is responsible for responding.

Customer organisations wishing to exercise rights or make a complaint should contact privacy@clearpathhr.example. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

Clearpath HR uses a single session cookie to maintain your authenticated session. This cookie is strictly necessary and is set when you sign in. No tracking, advertising, or analytics cookies are used.

10. Changes to this policy

We will notify customer administrators by email of any material changes to this policy. The current version is always available at this URL.