Privacy Policy

Privacy policy details

1. About this policy

This privacy policy explains how Hostedo Limited, trading as HR Omni Solutions (“HR Omni”, “we”, “us” or “our”), processes personal data in connection with its website, platform, services and integrations.

Depending on the processing activity, we act as a data controller or a data processor. We generally act as a processor when handling workforce and company information on behalf of a customer organisation, which normally determines the purposes and lawful bases for that processing. We act as a controller for personal data we process for our own purposes, including account administration, service security, billing and business operations.

If an organisation has entered your information into HR Omni, its privacy notice should explain its use of your data.

2. Who we are

The controller for the activities described as our controller activities in this policy is:

Hostedo Limited, trading as HR Omni Solutions
Company number: 573015
Address: Suite 10772, 77 Sir John Rogerson’s Quay, Dublin 2, D02 Y7Y5, Ireland
Email: support@hromni.com

You can use this email address for privacy questions, complaints and requests to exercise your data-protection rights.

3. People whose data we process

Depending on the services used, we may process data about account holders, customer employees and other workers, former workers, invited users, customer administrators and business contacts, and people whose information a customer enters into HR Omni, such as emergency contacts. We may also process data about website visitors, prospective customers, support contacts and individuals involved in security or administrative records.

4. Personal data we process

The information processed depends on the services used, the relevant purpose and information supplied by individuals or customer organisations. It may include:

• Identity and contact information: names, contact details, account credentials and profile details, including information about contacts provided by a customer or worker.
• Employment and organisational information: employment records, job and organisational details, working arrangements and reporting relationships.
• HR and operational records: leave and absence information, worklogs, documents, assets and related activity or history held through enabled services.
• Company and billing information: business contacts, company information, subscription and invoice records and payment references. Payment-card details are processed by our payment provider; HR Omni does not store full payment-card numbers.
• Security, access and technical information: authentication and session details, permissions, OAuth authorisations, integration disclosure approvals and enablement records, IP addresses, request metadata, diagnostics and audit information.
• Website, service and business-relationship information: website or product interactions, analytics, enquiries and customer-relationship records.
• Communications: messages and records relating to invitations, service notifications, support requests and other correspondence.

Customer-provided documents and free-text information may contain other personal information, including sensitive data as described in section 5. Not all categories apply to every individual.

5. Special-category and sensitive information

HR Omni does not require users to place health or other special-category information in general free-text fields. However, organisations may use leave types, messages, employee notes or uploaded documents in ways that contain information about health, religious beliefs, trade-union membership or other special categories of personal data.

Where we process this information on behalf of an organisation, that organisation is responsible for identifying an appropriate lawful basis and, where required, a condition under Article 9 GDPR. We process the information on the organisation’s documented instructions and subject to our contractual and security obligations.

Users and administrators should avoid entering special-category or highly personal information where it is not necessary for the intended HR process.

6. How we obtain personal data

We may obtain personal data:

• directly from you when you register, use HR Omni, contact us or submit a form;
• from your employer, contracting organisation or another HR Omni customer;
• from customer administrators and other authorised users;
• from Google or Microsoft when you choose their sign-in service;
• from Stripe in connection with payments and billing administration;
• from a third-party application or service when you authorise it to interact with HR Omni;
• automatically from our website, application, security and operational systems; and
• from public business sources or direct business communications when managing prospective and existing customer relationships.

If an organisation creates your workforce record before you have an account, that organisation is responsible for giving you appropriate information about its processing, including its use of service providers such as HR Omni.

7. Why we process personal data and our lawful bases

The lawful basis depends on the processing activity. The following table describes the bases on which we expect to rely when HR Omni acts as controller.

Where we rely on legitimate interests, we consider the necessity of the processing, its effect on individuals and whether those interests are overridden by individual rights. You may object to processing based on legitimate interests as explained below.

When HR Omni acts as a processor for a customer, the customer determines the purpose and lawful basis for processing its workforce data. Questions about those decisions should normally be directed to that customer.

Some information is necessary to create and secure an HR Omni account or to provide a contracted service. If required account, authentication or billing information is not provided, we may be unable to create the account, grant access or provide the relevant service. A customer determines which workforce information it requires people to provide for its own HR processes and must explain any consequences of not providing it. Fields identified as optional may be left blank, although this may limit the related feature.

We do not sell personal data.

8. Company accounts and access controls

HR Omni separates customer company information and evaluates access by company. A single user account may be associated with more than one company, but access to each company’s information depends on the user’s membership, role, available services and applicable permissions. Customer administrators manage access for their organisation.

9. Third-party integrations

HR Omni supports third-party integrations through interfaces such as the Model Context Protocol (MCP), allowing authorised external applications and services to interact with supported HR Omni capabilities. These external services are selected or enabled by customers and are not necessarily service providers engaged by HR Omni.

9.1 Company approval and individual authorisation

Before a supported third-party integration may access a company’s data, an authorised company administrator must review and approve the applicable integration data-sharing disclosure and separately enable that integration. Approving the disclosure does not itself enable any integration; enabling one does not enable another.

The disclosure presented to administrators describes the categories of information and types of actions that may be available through the integrations covered by that disclosure. We record the administrator’s approval, the applicable disclosure version and evidence of the approved text, including its cryptographic hash, together with relevant integration enablement and disablement activity.

Individual users separately authorise third-party applications through OAuth, including the scopes they choose to grant. Such authorisation does not override company enablement, membership, permissions, enabled services or applicable business rules. The specific capabilities and data made available depend on the disclosure, integration, authorisations and access controls applicable to the request.

9.2 Information shared and customer responsibilities

When a user invokes a permitted integration capability, relevant information may be disclosed to the connected third-party service or a supported action may be carried out in HR Omni. The receiving provider may process information under its own terms, privacy practices and applicable law.

By enabling an integration following disclosure approval, the customer authorises the corresponding permitted exchanges with the connected third-party service, subject to HR Omni’s access controls. Customers are responsible for deciding whether their use of third-party integrations is appropriate and lawful, including establishing the necessary lawful basis, informing affected individuals, assessing any relevant international transfers and entering into provider agreements where required. Customers should maintain appropriate internal policies, including whether personal or organisation-managed third-party accounts may be used, and identify relevant external recipients in their own privacy notices where required.

HR Omni does not currently develop or operate its own AI or large language models.

9.3 Disabling integrations and previously shared information

A company administrator can disable an integration. Disabling blocks subsequent access to that company’s HR Omni data through the integration but does not itself revoke individual OAuth sessions or authorisations. If the integration is enabled again, existing authorisations may be usable subject to their validity and applicable access controls.

Disabling an integration does not delete information previously received by the third-party provider. Any such information is subject to that provider’s retention and deletion arrangements.

The data and actions described in integration disclosures may evolve. Where a revised disclosure requires renewed approval, it will be presented to company administrators as appropriate. Details of particular supported integrations and capabilities are provided in the relevant integration information.

10. Calendar feeds, reports and exports

Where relevant services are enabled, authorised users may create calendar feeds or export supported reports. These may contain personal or company information. A calendar subscription URL may allow its holder or a connected calendar service to retrieve information while the feed remains active. Customers and users are responsible for protecting shared links and information exported or shared outside HR Omni.

11. Who receives personal data

We disclose personal data where needed to provide and secure our services, follow customer instructions, fulfil user-authorised actions or comply with applicable law.

Recipients may include infrastructure, hosting and communications providers (including Amazon Web Services and Cloudflare); payment service providers (including Stripe); business and customer relationship services (including HubSpot); performance and error monitoring providers (including New Relic); and identity providers when users choose their sign-in services (such as Google or Microsoft).

Other recipients may include customer organisations and their authorised users, third-party applications and services independently authorised by customers or users to connect to HR Omni (including AI assistants and productivity services), user-selected calendar services, and authorities where legally required.

A third-party service connected through a customer-authorised integration is not necessarily an HR Omni-appointed subprocessor. The legal roles and protections applying to any disclosure depend on the relevant relationship and processing activity.

12. International transfers

Our core application infrastructure is hosted in Ireland. Some service providers may process personal data outside the European Economic Area or access it from other countries. Where international transfers are subject to Chapter V GDPR, applicable transfer requirements and safeguards must be observed. You may contact us for information about safeguards relevant to a particular transfer.

13. Cookies, local storage and analytics

HR Omni uses strictly necessary browser technologies to provide and secure the service. These include secure authentication and session cookies, CSRF protection and local storage used to remember settings such as the selected company or colour theme.

Our authentication cookies are protected with security settings including Secure, HttpOnly and SameSite restrictions where applicable.

We use self-hosted analytics to understand website and product use. We also use Cloudflare Web Analytics on the marketing website. Our self-hosted analytics does not use analytics cookies, retain IP addresses or fingerprint devices. It may process page views, interaction events, a logged-in user’s account details, user agent and approximate region or city.

The current production service does not use Google Tag Manager. We do not use the analytics described here for third-party behavioural advertising or remarketing.

You can configure your browser to block or delete browser storage, but blocking necessary cookies or local storage may prevent parts of HR Omni from working correctly.

14. Security

We use technical and organisational measures intended to protect personal data, including encryption in transit and at rest, company-aware access controls, authentication safeguards, infrastructure security measures, monitoring and backups. Access to company records is subject to applicable authorisation controls.

No system can eliminate every security risk. Customers are responsible for managing their users’ permissions, exports, shared links and authorised integrations.

15. Retention

We retain personal data for as long as necessary for its relevant purpose, taking account of customer instructions, service requirements, applicable legal obligations, security and dispute resolution. Retention periods and deletion triggers depend on the information concerned:

• Customer-controlled records: ordinarily remain until deleted through available customer controls, a configured retention rule, module removal or customer closure, subject to applicable exceptions.
• Documents and module data: customer-configured document retention rules and module deletion behaviour may apply. Customers should preserve copies they need before removing data or disabling services.
• Accounts and sessions: account deletion is handled in accordance with section 16; sessions and authorisations are managed in accordance with their validity, revocation and applicable cleanup processes.
• Analytics: we retain self-hosted website and product analytics information for up to one year. Retention of information processed by external analytics providers depends on the relevant service and arrangements.
• Financial records: records that must be retained for accounting, tax or legal purposes are kept for the applicable statutory period. Relevant billing and accounting records are retained for six years where applicable.
• Security, audit, support and operational records: retained according to their purpose, applicable legal requirements and the configurations of the relevant systems and providers. Operational diagnostic data may include IP addresses, API client identifiers, errors and performance information. Some application-level logs are temporary and may be replaced on deployment; separate infrastructure and monitoring tools generate and retain their own records.
• Integration approval evidence: disclosure approval and integration activity records associated with a company are deleted when that company is permanently deleted, subject to backup expiry. OAuth authorisations may have separate lifecycles while an account remains active.
• Backups: database backups are created daily and retained for up to 30 days. Data deleted from active records may remain in protected backup copies until the relevant backup expires.
• Third-party integrations: information already received by independently authorised third parties is subject to their own retention arrangements.

Where lawful and appropriate, we may irreversibly anonymise information that is no longer needed in identifiable form. Data that can still be linked to a person is not treated as anonymous.

We review retention practices as legal, operational and customer needs evolve, and update privacy information or provide additional notice where required by law. Customers should keep their own copies of information they need beyond the applicable retention period or after closure.

16. Deletion and account closure

Customers may delete records through available product controls or request assistance. On permanent company deletion, HR Omni deletes the company’s active records, associated files and company-specific access associations, including integration disclosure approval and integration activity records. Records retained to meet applicable legal obligations, such as relevant billing and accounting records, may be retained for the required period.

An individual may request deletion of their global account through support, subject to appropriate verification. Deleting an account does not automatically delete workforce records that a separate customer organisation controls.

Copies of deleted information may remain in database backups for up to the applicable 30-day retention period. We may retain or irreversibly anonymise information where permitted or required by law, subject to the relevant purpose and safeguards.

17. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• obtain confirmation of whether we process your personal data and receive a copy;
• correct inaccurate or incomplete personal data;
• request deletion;
• restrict processing;
• receive personal data in a portable format where applicable;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent where processing is based on consent, without affecting earlier lawful processing; and
• lodge a complaint with a supervisory authority.

HR Omni does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Customer-configured workflow rules may automate operational steps, such as approving a configured leave type, but the customer determines those settings and remains responsible for its employment decisions.

To exercise your rights, email support@hromni.com. We may ask for information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

If your request concerns workforce data controlled by your employer or another HR Omni customer, the customer is normally responsible for deciding the request. We may refer you to that organisation or assist it in responding.

We normally respond within one month of receiving a valid request. The period may be extended where permitted by law due to the complexity or number of requests. We do not normally charge a fee. A reasonable fee or refusal may apply only where permitted by law, including for manifestly unfounded or excessive requests.

18. Complaints

Please contact us first at support@hromni.com if you have a concern about our processing. We will investigate and respond.

You also have the right to complain to the Irish Data Protection Commission:

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland
https://www.dataprotection.ie

If another EEA supervisory authority is relevant to your location or circumstances, you may also have the right to complain to that authority.

19. Children

HR Omni is a business service and is not marketed to children. A customer may hold employment information about a worker under 18 where this is lawful and appropriate in the employment context. In that situation, the customer is responsible for the lawful basis, transparency and any additional protections required for the young person.

Children should not create a standalone HR Omni account unless their use is authorised and lawful in their circumstances.

20. Changes to this policy

We may update this policy to reflect changes to our services, processing activities, retention practices or applicable legal requirements. We will publish a revised policy and provide further notice when required by law.

21. Contact us

For privacy questions, rights requests or complaints, contact:

Hostedo Limited trading as HR Omni Solutions
Suite 10772, 77 Sir John Rogerson’s Quay
Dublin 2, D02 Y7Y5
Ireland
support@hromni.com