Privacy Policy — Halo Benefits

1. Who we are

Halo Benefits Ltd ("Halo", "we", "us") is the data controller for personal data collected through halobenefits.co.uk and the Halo platform (app.halobenefits.co.uk). Our registered office is in England. You can contact us at hello@halobenefits.co.uk.

2. What data we collect

We collect the following categories of personal data:

Account information — name, email address, phone number, job title.
Employment information — employer name, salary details (for Halo Pay calculations).
Child information — child's name, date of birth, sex (required for nursery arrangements).
Nursery information — nursery name, Ofsted/Care Inspectorate number, contact details.
Company information — company name, company number, registered address, contact details.
Financial information — bank details for Direct Debit mandates (processed via GoCardless).
Usage data — pages visited, features used, device and browser type (via analytics).

3. How we use your data

We process personal data for the following purposes:

Setting up and managing childcare arrangements under the workplace nursery exemption.
Calculating Halo Pay amounts and tax/NI savings.
Processing payments between employers and nurseries.
Verifying nursery registrations (Ofsted/Care Inspectorate).
Communicating with you about your account and arrangements.
Improving our platform and services.
Complying with legal and regulatory obligations.

4. Legal basis for processing

We rely on the following legal bases under UK GDPR:

Contract — processing necessary to provide our services to you.
Legitimate interests — improving our services, fraud prevention, and business analytics.
Legal obligation — compliance with tax, employment, and financial regulations.
Consent — where required, for marketing communications and optional cookies.

5. Who we share your data with

We may share your personal data with:

Your employer — arrangement details and Halo Pay amounts.
Nursery providers — child details and payment information for arrangements you set up.
GoCardless — payment processing (as a data processor).
Clerk — authentication services (as a data processor).
Vercel — hosting and infrastructure (as a data processor).
Analytics providers — anonymised usage data.

We do not sell your personal data. We only share data as necessary to provide our services or as required by law.

6. Data retention

We retain your personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations (including tax record-keeping requirements). Arrangement records are retained for at least 6 years after the arrangement ends, in line with HMRC requirements.

7. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Request erasure of your data (subject to legal retention requirements).
Object to or restrict certain processing.
Data portability — receive your data in a structured, machine-readable format.
Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at hello@halobenefits.co.uk.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews.

9. International transfers

Some of our service providers (such as Vercel and Clerk) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Complaints

If you have concerns about how we handle your data, please contact us first at hello@halobenefits.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through the platform. The "last updated" date at the top of this page indicates when the policy was last revised.