BM Connect is proud to partner with cloud-based payroll provider, Paycircle. Coupled with our advanced tech-enabled outsourced management reporting and accounting solutions, Paycircle’s intuitive and user-friendly payroll platform enables clients to access their information and send employers messages about their payroll, at the click of a button, all via their own portal.
Here we ask and answer some of your key questions relating to the Paycircle’s Data Protection, Regulation and Privacy practices:
Where is the data (including backups) geographically stored?
All data is stored within the EEA. Paycircle’s application servers are located in South UK and the Netherlands. It’s a similar story with respect to the storage of backups which is additionally geo-replicated to Ireland.
Does Paycircle share data with any third party?
No. Other than when acting on an explicit request from you, the data controller, or implicitly with respect to transmission to HMRC, pension providers, etc. as part of Paycircle’s agreed and requested service.
Please confirm your policy on deleting personal data
Paycircle manages personal data in accordance with GDPR and as such supports data access rights on your instruction (as data controller) including deletion requests.
Does Paycircle follow any data protection specific codes of conduct?
As well as awareness training. Paycircle’s employee handbook includes guidance on management of personal data. Paycircle is able to satisfy data access requests within ICO-mandated timelines.
Does Paycircle provide ongoing data protection awareness to their own team members?
Paycircle takes data protection very seriously. They have ongoing awareness training for all employees – a compulsory module in their induction process followed by refresher courses at least annually.
What is your legal basis for holding and processing personal data?
Paycircle is registered with the ICO under the Data Protection Act. Any personal data added on the system (in the playground, in test mode, or live) falls within the scope of GDPR and is governed by the DPA. In the context of the GDPR, when you enter into an agreement with BM Connect, Paycircle is a data processor of the information that you (as Data Controller) enter and manage in the application. In the absence of a contractual agreement, such as in a trial, users of the system should only use representative or generated data. Such dummy data can be deleted from the system once its purpose has been served. Paycircle is a Data Controller of the information we need to set you up and maintain you as a customer.
Can reports be downloaded to a non-corporate asset?
By definition, Paycircle’s applications can be accessed by any device that passes the user and location authentication steps outlined above. It is your responsibility to manage devices in your own environment and to implement GDPR controls therein.
Does the application require data to be stored or cached on client devices?
No data is stored or cached locally on the client device
Who within your company (or any external party) has access to customer data?
The only people who would have access to customer data would be those authorised by the customer to provide support services whilst using Paycircle’s platform.
Please confirm your ability to report any data breaches in respect of employee or client data after becoming aware of such a breach
Naturally, reporting of any data breach to the relevant authority, and likewise informing the subject, would be compatible with the applicable regulatory regime e.g. GDPR.
Has Paycircle’s technology or company had any known data breaches?
No
Paycircle’s true cloud technology offers better data security, enhanced processing power, faster calculation engines, beautiful user interfaces, powerful automation tools and hugely effective collaboration. Find out more about how BM Connect in partnership with Paycircle can help your business improve payroll efficiency and future-proof your payroll function securely and scalably.
