Privacy Policy
How TeamPay Payroll Limited handles personal data on this website.
Who we are
This website is operated by TeamPay Payroll Limited, a company registered in England and Wales (company number 17197586), registered office C/O Williams Stanley And Co, 144 Great Portland Street, London, W1W 6QT, United Kingdom. We trade as TeamPay and are part of the same group as Williams, Stanley and Co Limited.
For the personal data described in this policy, we are the data controller. We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator.
You can reach us about anything in this policy at hello@team-pay.co.uk.
Important: this policy covers the website, not your payslip
If your employer uses TeamPay to run payroll, then your employer — not us — decides how your payroll data is used. They are the data controller for it and we act as their processor under a separate agreement. Ask your employer for their privacy notice, or use the login area of the TeamPay app.
This policy is about the marketing website at team-pay.co.uk: the enquiry form, and the Nora chat widget.
What we collect, and why
When you submit the enquiry form
We collect your first name, last name, email address, company name (if you give one), the message you write, and whether you ticked the box asking for occasional TeamPay updates. We use it to respond to your enquiry and to send you a confirmation that we received it.
Your enquiry is also stored as a record in our own database and synced to our CRM (HubSpot) so the team can follow it up and see the history of the conversation. If you ticked the updates box, that preference is stored on the same record — we don't pass you to a separate mailing-list provider.
When you chat with Nora
We process the messages you type. If you ask to be put in touch with a person, Nora will ask for your email address and pass it, your name (if given) and a short summary of the conversation to our team so they can follow up.
Technical information
Our hosting provider records standard server logs. We also process your IP address to apply rate limits — this is how we stop the site and the Nora assistant from being abused or run up as a cost against us. We do not use it to build a profile of you.
Nora, and what happens to what you type
Nora is an AI assistant. To generate a reply, the messages in your conversation are sent to Anthropic, who provide the Claude AI model we use. That means your messages leave our systems and are processed by Anthropic on our behalf.
Please don't type sensitive personal information into the chat — National Insurance numbers, bank details, dates of birth, health information, or anyone else's pay details. Nora doesn't have access to any payroll account and never needs them. If your question requires that kind of detail, ask Nora to put you in touch with a person and we'll take it somewhere appropriate.
We do not keep a database of chat transcripts. Your conversation exists in your browser for as long as the widget is open, and we do not store it.
The one exception is a hand-off. If you ask Nora for a person, she takes your email address and sends the team a short summary of what you need — and that hand-off is kept: as an email, as a record in our database, and as a contact in our CRM, so somebody actually follows it up. Only the hand-off is kept this way, never the wider conversation.
Cookies and tracking
This website sets no cookies and uses no analytics or advertising trackers. There is nothing here to consent to, which is why you have not been shown a cookie banner. Your light or dark theme preference is applied in the page itself and is not stored or transmitted.
Our lawful bases
- Legitimate interests — responding to an enquiry you chose to send us, answering your questions through Nora, and keeping the site secure and available. We think this is fair because you initiated the contact and the data involved is limited.
- Legal obligation — where we have to keep records, for example for tax or accounting purposes.
You can object to processing based on legitimate interests at any time using the contact details above.
Who else is involved
We use the following providers to run this website. They process personal data only on our instructions and under contract.
| Provider | What they do | Where |
|---|---|---|
| Vercel | Website hosting, content delivery and server logs, including edge rate limiting. | United States and European Union |
| Anthropic | Provides the Claude AI model that generates Nora's replies. Messages you send to Nora are transmitted to Anthropic to produce a response. | United States |
| Resend | Sends transactional email — the notification of your enquiry to our team, and your confirmation email. | United States |
| Neon | Hosts the Postgres database that stores enquiry records (name, email, company, your message and your newsletter preference). | United Kingdom (London region) |
| HubSpot | Our CRM. Enquiry details are synced here as a contact record so the team can follow up and keep track of the conversation. | European Union and United States |
| Upstash / Redis | Stores short-lived counters used to rate limit the site and prevent abuse. Counters are keyed to a hashed request identifier, not to your identity. | European Union |
We do not sell your personal data, and we do not share it for advertising.
Transfers outside the UK
Some of the providers above process data outside the UK, including in the United States. Where that happens we rely on appropriate safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies.
How long we keep things
- Enquiries— we keep the email correspondence, the database record and the CRM contact for as long as we're in contact with you, and for a reasonable period afterwards as a business record. If you ask us to delete it, we will — across all three.
- Nora conversations — not stored by us. If Nora handed you off, that hand-off record is treated exactly like an enquiry above.
- Rate-limit counters — short-lived, and expire automatically within hours.
- Server logs — retained by our hosting provider for a limited period on a rolling basis.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to processing based on our legitimate interests;
- ask us to transfer it to you or another provider.
Email hello@team-pay.co.uk and we'll respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd rather have the chance to put things right first.
Changes to this policy
If we change how we handle personal data on this website, we'll update this page and the date at the top. If the change is significant we'll make that clear rather than quietly editing it.