Payroll data, handled like payroll data.

The employer is the data controller for its payroll data. Netto acts solely as a processor, on documented instruction, under an Article 28 data processing agreement signed at registration. Netto never uses employee data for its own purposes.

Issuing an itemised pay statement is a legal obligation of the employer, and the employment contract is the basis for processing the underlying payroll data. Because employee consent is rarely freely given, Netto does not rely on it for the payslip itself. Netto does rely on a recorded opt-in for the WhatsApp channel and for any optional service such as earned wage access, and every opt-in and opt-out is timestamped in the audit log.

Replying STOP on WhatsApp ends delivery immediately and is recorded in the audit trail. The employer is notified so it can fall back to its previous delivery method. Opting out of the channel never affects the employee's right to receive a payslip.

No. Netto explains payslips; it does not recalculate them, does not change pay, and does not make decisions about a person. Every figure in an answer is cited back to the source line on the payslip so the employee can verify it. Article 22 does not apply.

No. Payslip data is sent to the model at inference time only, under a zero-retention, no-training configuration. Model outputs are grounded in the supplied payslip and are not used to improve any model.

The minimum to deliver and explain a payslip: name, employee reference, mobile number, job title, and the payslip itself. Netto does not require bank account numbers, national insurance or social security numbers, or home addresses, and identifiers that are not needed can be stripped at import.

Employee records, payslips and audit logs are held at rest in the EU. Message delivery and model inference involve sub-processors that may process data in the United States, covered by the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, with a transfer risk assessment on file.

Payslip content is retained on a rolling period agreed with the employer — 13 months by default — after which it is deleted. Consent and delivery audit records are kept for the longer of the pilot term or the employer's statutory retention period, because they evidence that the payslip was issued. Retention is configurable per client and deletion on termination is contractual.

Requests are made to the employer as controller. Netto supports the employer within 72 hours: records can be exported or deleted per employee from the console, and the audit log shows exactly what was delivered and when.

Netto notifies the employer without undue delay after becoming aware, with the facts known at that point, so the employer can meet its own 72-hour regulatory deadline. Netto supports the employer's assessment and any communication to affected employees.

Most employers will, because this is systematic processing of employee data through a new channel. Netto provides a pre-filled DPIA template covering the processing described here, which the employer completes and owns.

Yes, and we encourage it. The DPA, sub-processor list, DPIA template and a walkthrough of the employee experience are available before any data is loaded, and pilots can start with a volunteer group.