Who we are
The Payroll Portal is a trading name of Buffalo Payroll Ltd, a company registered in England and Wales (company number 13407933). Our registered office is Bartle House, 9 Oxford Court, Manchester, M2 3WQ. We're registered with the Information Commissioner's Office (ICO) under registration number ZB480603.
In this notice, "we", "us" and "our" mean Buffalo Payroll Ltd trading as The Payroll Portal. For any question about this notice or your data, email hello@thepayrollportal.co.uk or write to us at the address above.
Our two roles
- Controller for this website and the waitlist. When you visit thepayrollportal.co.uk, join the waitlist or contact us, we decide how your data is used and we're responsible for it.
- Processor for the portal. When a payroll bureau uses The Payroll Portal, the bureau is the controller of the data it puts into it, such as its clients' details, pay run records, documents and messages. We process that data only on the bureau's instructions under a written agreement. If you're an employer client or accountant partner of a bureau, the bureau's own privacy notice explains how it uses your data, and you should contact the bureau first about your rights.
What we collect and why
| Data | What we use it for | Lawful basis |
|---|---|---|
| Waitlist form: your name, work email, bureau or firm, number of client payrolls, payroll software and anything you tell us about your month-end | To tell you when places open, consider you as a design partner if you ask, and shape what we build | Legitimate interests: responding to your interest in the product |
| Your choice to receive the month-end playbook and updates | To send you the playbook and occasional emails about The Payroll Portal | Consent, which you can withdraw at any time |
| Emails and messages you send us | To reply and keep a record of our conversation | Legitimate interests |
| Portal login details: name, email, role and a record of sign-ins | To give you secure access to the portal and keep it secure | Contract with your bureau and our legitimate interests in security |
| Technical data: IP address, browser type, pages requested and error logs | To run, secure and fix the website and portal | Legitimate interests |
We don't use analytics, advertising or tracking tools on this website, and we don't sell personal data. We don't make decisions about you using only automated processing.
Who we share it with
We use a small number of service providers to run the website and portal. They can only use the data to provide their service to us.
- Supabase (database and file storage). Our databases are hosted in Supabase's London region.
- Vercel (website hosting and delivery). Vercel is a US company and may process technical data, such as your IP address, outside the UK.
- Microsoft 365 (email). We use it for our own email, and bureaus can connect their own Microsoft 365 account so the portal can send and receive email for them.
- Xero (accounting), where a bureau connects its own Xero account for billing.
- Fontshare (web fonts). When a page loads, your browser fetches our fonts from Fontshare's servers, which receive your IP address.
We may also share data with our professional advisers, or where the law requires it.
International transfers
Where a provider processes personal data outside the UK, we make sure there are appropriate safeguards in place, such as a UK adequacy decision, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the EU standard contractual clauses.
How long we keep it
- Waitlist sign-ups: until you ask us to remove you, or 24 months after our last contact with you, whichever comes first.
- Marketing consent: until you withdraw it. We keep a record that you opted out so we don't contact you again.
- Emails with us: up to 2 years after our last contact, unless they become part of a customer relationship.
- Portal data: as set out in our agreement with your bureau, and deleted or returned when that agreement ends.
- Technical logs: for a short period, usually no more than 30 days, unless needed to investigate a security issue.
How we protect it
Data is encrypted in transit, access is limited to the people who need it, and each bureau's data in the portal is kept separate from other bureaus' data using row-level security in the database.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that's wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data
- object to us using your data on the basis of legitimate interests
- withdraw your consent to marketing at any time, by using the unsubscribe link in any email or by emailing us
- ask for your data in a portable format, where this applies
To use any of these rights, email hello@thepayrollportal.co.uk. We'll reply within one month. If your request is about data a bureau holds in the portal, we'll pass it to that bureau and help them respond.
Complaints
If you're unhappy with how we've used your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies
We only use cookies and browser storage that the website and portal need to work. See our cookie notice for the full list.
Changes to this notice
We'll update this notice when how we use data changes. The date at the top shows when it was last updated.