Privacy policy

1. Who is responsible for what

For your employees’ payroll data, your organisation is the data controller and we are the processor: you decide what is held and why, we process it on your instructions to run the service.

For your own account data — the people who sign in, billing records, support conversations — we are the controller. That controller is Novalss Technology Solutions, [registered address], reachable at hello@novalss.com.

2. What we hold

Account data

• Name, email address, phone number and hashed password for each user.
• Organisation name, contact details and role assignments.
• Sessions, sign-in events and an audit log of sensitive actions.
• Subscription, invoice and payment records. Card numbers are held by Paystack, not by us.

Employee data your organisation enters

• Identity and contact details, employment dates, branch, department and position.
• Salary, allowances, deductions, loans and their history.
• Bank account number, TIN and SSNIT number — each encrypted at rest with AES-256-GCM.
• Attendance, leave requests and balances.
• Payslips and the calculation behind each one.

3. Why we hold it

To calculate pay and statutory deductions, produce payslips and filing schedules, enforce access control, keep an audit trail, bill you, and support you when something goes wrong. We do not profile individuals, we do not advertise, and we do not sell data to anyone.

4. Who else processes it

• Our hosting and database provider — stores the application and its data.
• Object storage — holds generated payslip PDFs and uploaded files.
• Resend — delivers transactional email, including payslip notifications.
• Paystack — processes subscription payments by card and mobile money.

Each is used only for the purpose above. We do not add processors that receive payroll data without telling you.

These providers run their infrastructure outside Ghana, so the data you enter is transferred abroad for storage and processing. We do this under written contracts that require security and confidentiality at least as strong as the Data Protection Act, 2012 (Act 843) requires of us, and access to it stays limited to providing the service. If your organisation needs its data kept within Ghana, contact us before signing up.

5. How long we keep it

Payroll records are kept for as long as your account is active, because payroll history has to stay reproducible — a payslip from three years ago must still reconcile. If you close your account we delete your data within 30 days of your request, other than records we must retain by law, and audit entries required to demonstrate what happened to data we held.

6. Rights

Under Ghana’s Data Protection Act, 2012 (Act 843), individuals may ask to see the personal data held about them, have inaccurate data corrected, object to processing, and complain to the Data Protection Commission.

If you are an employee whose payroll is run on Payro, your employer holds your record: ask them first, and they can act on it directly in the software. If they cannot resolve it, contact us and we will help them.

7. Security

Tenant data is isolated at the data-access layer, permissions are enforced on the server, sensitive fields are encrypted at rest, passwords are hashed with scrypt, and the audit log rejects updates and deletes at the database level. What we do and do not claim is set out in full on our security page.

8. Breach notification

If personal data we hold is compromised, we will tell affected customers without undue delay, with what we know, what we have done, and what you may need to do — including notifying your own employees and the Data Protection Commission where that is required.

9. Cookies

Payro sets a session cookie when you sign in, and a small number of functional cookies to remember your organisation and interface preferences. We do not use advertising or cross-site tracking cookies.

10. Changes

When this policy changes materially we will update the date above and tell account owners by email before the change takes effect. Questions go to hello@novalss.com.