What we hold, why we hold it, and for how long.

For payroll data, the employer is the data controller and Netto is a processor. We process employee data only on the employer's documented instruction, under an Article 28 data processing agreement signed before any data is loaded. We do not use employee data for our own purposes, and we do not sell data.

For our own website visitors, prospective clients and business contacts, Netto is the controller. That is a small amount of data: the details you send us and basic, aggregate site analytics.

• Name, employee reference and job title
• Mobile number, for WhatsApp delivery
• The payslip itself — gross pay, deductions, tax, net pay and related lines
• Consent and delivery records: opt-in, opt-out, sent, delivered, read
• Questions asked and the answers given, so the employer has an audit trail

We do not require bank account details, national insurance or social security numbers, or home addresses, and identifiers that are not needed to deliver or explain a payslip can be stripped at import.

Issuing an itemised pay statement is a legal obligation of the employer, and the employment contract is the basis for processing the underlying payroll data. Because consent given by an employee to an employer is rarely freely given, we do not rely on consent for the payslip itself.

We do rely on a recorded opt-in for the WhatsApp channel and for any optional service such as earned wage access or savings. Every opt-in and opt-out is timestamped. Replying STOP on WhatsApp ends delivery immediately; opting out never affects the employee's right to receive a payslip by another method.

Netto explains payslips; it never recalculates them, never changes pay, and never makes a decision about a person. Every figure in an answer is cited back to its source line so it can be checked. There is no automated decision-making producing legal or similarly significant effects.

Payslip data is sent to the model at inference time only, under a zero-retention, no-training configuration. Client data is not used to improve any model.

Only the sub-processors needed to run the service. The current list, with purpose, location and transfer safeguard, is published on our security page: Twilio, Meta Platforms (WhatsApp), Supabase, Google (Gemini models, via AI gateway), Lovable / Cloudflare, Resend. Employers are notified before a new sub-processor is added and may object as set out in the DPA. We also disclose data where we are legally required to.

Employee records, payslips and audit logs are held at rest in the EU. Message delivery and model inference may involve processing in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses together with the ICO's International Data Transfer Addendum for UK data, supported by a transfer risk assessment and the supplementary measures described on the security page.

Payslip content is retained for a rolling period agreed with the employer — 13 months by default — and then deleted. Consent and delivery audit records are kept for the longer of the pilot term or the employer's statutory retention period, because they evidence that the payslip was issued. On termination, data is deleted or returned within the period set in the DPA.

Employees have the right to access, rectify, erase, restrict, port and object. Because the employer is the controller, requests should go to the employer in the first instance — usually HR or payroll. Netto supports the employer within 72 hours, and can export or delete an individual record from the console.

If you would rather contact us directly, email privacy@gnetto.com. You also have the right to complain to your supervisory authority — in the UK, the Information Commissioner's Office.

Data is encrypted in transit and at rest, access is segregated per organisation and enforced at the database layer, and every administrative action is written to an audit trail. Details are on the security page. Report a suspected vulnerability to security@gnetto.com.

In the event of a personal data breach we notify the employer without undue delay, so they can meet their own 72-hour regulatory deadline.

We update this notice when our processing changes and revise the date at the top. Material changes affecting employers are notified in advance under the DPA.