Privacy Policy | Sterling Payroll Solutions

1. Who We Are

Sterling Payroll Solutions is a UK-based payroll bureau operating as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO).

Registered address: United Kingdom
Contact: info@sterlingpayrollsolutions.co.uk

2. What Data We Collect

We collect and process the following categories of personal data:

Client business contacts: name, email address, phone number, business name, and registered address.
Employee payroll data: full name, date of birth, National Insurance number, home address, bank account details, salary/hourly rate, tax code, student loan plan, pension enrolment status, and starter declarations.
Identity verification data (AML): government-issued photo ID and proof of address for beneficial owners with 25%+ ownership.
Financial data: bank sort codes, account numbers, and invoice payment records.
Website usage data: IP addresses and browsing behaviour collected via cookies (where applicable).

3. Why We Process Your Data

We process personal data for the following lawful purposes:

Contract performance: to provide payroll bureau services, calculate pay, file RTI submissions with HMRC, process pensions, and produce P60/P45 documents.
Legal obligation: to comply with HMRC PAYE regulations, the Proceeds of Crime Act 2002, anti-money laundering legislation, and pension auto-enrolment duties.
Legitimate interests: to manage client accounts, issue invoices, respond to support queries, and maintain service continuity.
Consent: to send marketing communications or non-essential cookies (where you have opted in).

4. Anti-Money Laundering (AML) Obligations

As a payroll bureau, Sterling Payroll Solutions is subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. We are legally required to verify the identity of our clients and their beneficial owners before commencing services and to retain those records for a minimum of five years from the end of the business relationship.

5. Who We Share Data With

HMRC: RTI payroll submissions, P60s, P45s, and CIS returns as required by law.
Pension providers: auto-enrolment contribution files as directed by your chosen pension scheme.
Payment processors: Stripe, Inc. for secure invoice payment processing. Stripe is PCI-DSS compliant.
Cloud infrastructure: our platform uses secure cloud services within the UK/EEA or under standard contractual clauses.
Professional advisors: accountants or legal advisors where necessary, bound by confidentiality obligations.

We do not sell personal data to third parties.

6. Data Retention

Payroll records: retained for a minimum of 3 years from the end of the tax year (HMRC requirement), or 6 years for broader legal compliance.
AML identity records: retained for 5 years after the end of the business relationship.
Invoices and financial records: retained for 6 years for HMRC and Companies Act compliance.
Marketing opt-ins: retained until withdrawn.

7. Your Rights

Under UK GDPR you have the right to:

Access a copy of your personal data.
Rectification of inaccurate data.
Erasure ("right to be forgotten") where no legal retention obligation applies.
Restriction of processing in certain circumstances.
Portability of data you have provided to us.
Object to processing based on legitimate interests.
Withdraw consent at any time where consent is the lawful basis.

To exercise any right, contact us at info@sterlingpayrollsolutions.co.uk. We will respond within 30 days. If you are unsatisfied, you may lodge a complaint with the ICO at ico.org.uk.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted storage, access controls, TLS in transit, and regular security reviews. Employee payroll data is only accessible to authorised Sterling Payroll Solutions staff directly involved in your account.

9. Cookies

Our website uses strictly necessary cookies to enable core functionality such as authentication sessions. We do not currently use tracking or advertising cookies. If this changes, we will update this policy and seek your consent where required.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active clients via email or the client portal. The latest version will always be available at sterlingpayrollsolutions.co.uk/privacy.