For data you upload about your employees and contractors, your organization (the tenant) is the data controller. Helia HR is the data processor, acting on documented instructions captured in your subscription. For data we collect about your admins to operate the service (sign-in email, IP, audit log actor), we are the controller. Contact: privacy@heliahr.com.
2. What we collect
Account identifiers — your work email, display name, and tenant role.
Tenant data — anything your HR team uploads: employee records, time-off requests, compensation, performance reviews. Treated as customer data.
Audit log — actor, IP, action, target row id, timestamp. Required for GDPR Article 30 records of processing.
Operational telemetry — error rates, request latency, feature-flag state. Aggregated; not linked to individuals.
3. What we DO NOT collect
No third-party analytics or session-replay tools.
No advertising trackers. We don't sell, share, or rent personal data — ever.
No biometric data, no precise geolocation, no behavioural fingerprinting.
4. Where data lives
Production data is hosted in EU data centres (Frankfurt or Dublin, depending on region selected at tenant creation). Backups stay in the same region. Data is never transferred outside the EU/EEA without explicit operator consent and a Standard Contractual Clauses agreement.
5. How long we keep it
Active tenant data — for the lifetime of your subscription.
Backups — encrypted, 30 days rolling.
Audit log — 7 years (statutory record-keeping requirement in most EU jurisdictions).
Magic-link tokens — 15 minutes; deleted after use or expiry.
6. Your rights (GDPR)
EU/UK residents have the right to access, rectify, erase, restrict, port, and object to processing of their personal data. Employees of a Helia HR tenant should direct these requests to their organization (the controller). For data Helia HR holds as controller — your operator account — email privacy@heliahr.com. We respond within 30 days.
7. Self-service exports
Owners and admins can export the full tenant bundle as JSON from Settings → Tenant data export. Per-employee Article 15 exports are available from each employee detail page. Both are operator-driven, audit-logged, and capped at standard rate limits.