PayrollDash is a trading name of Buffalo Payroll Ltd. A sub-processor is a provider we use that may handle personal data a bureau puts into the portal. Each one handles that data under its own data protection terms and only to provide its service to us. For how we handle personal data more generally, see our privacy notice.
Providers that handle portal data
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Supabase Supabase Inc. | Database for the portal, including documents and files uploaded to it | Everything a bureau stores in the portal: user accounts, client and contact details, pay run records, tasks, tickets, messages and uploaded files | London, UK (Amazon Web Services eu-west-2) |
| Vercel Vercel Inc. | Hosts the website and runs the portal's server code. Every request to the portal passes through it. | Portal data while a request is being handled, plus IP addresses and short-lived request logs | United States (Washington DC region), with a global delivery network |
| Cloudflare Cloudflare Inc. | Domain name service for our domains, and forwarding of email sent to @payrolldash.co.uk addresses | Emails sent to those addresses, and IP addresses in DNS requests | Global network, with logs processed in the US and Europe |
Services a bureau chooses to connect
These only receive data if a bureau connects its own account. The bureau's own agreement with the provider applies, and the bureau can disconnect at any time.
| Service | What the connection does | Data involved |
|---|---|---|
| Microsoft 365 | Reads the bureau's chosen mailbox to turn client emails into tickets, and sends email from it, such as engagement letters for signature | Emails, names and email addresses |
| Xero | Suggests new clients from the bureau's Xero contacts and invoices | Contact and company names, email addresses and invoice summaries |
| AI assistants | If a bureau's staff connect an AI assistant to the portal, it can read and update portal records they have access to | Whatever that person can see in the portal |
Other services the website uses
- Google Fonts and Fontshare supply our web fonts. Your browser fetches them directly, so these services receive your IP address and browser details. They don't receive any portal data and don't set cookies through our site.
- Companies House. When someone searches for a company in the portal, we send the search words to the Companies House public register. This is a public data source, not a sub-processor.
- Microsoft 365 is also our own email system. If you email us, your message is held there.
Transfers outside the UK
The portal's database stays in the UK. Where a provider processes personal data outside the UK, such as Vercel in the United States, we rely on a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU standard contractual clauses, depending on the provider.
Changes to this list
Before we add or replace a provider that handles portal data, we'll update this page and email each bureau's account owner at least 30 days in advance. A bureau that objects can tell us, and if we can't resolve it, can end its subscription. The date at the top shows when this list last changed. Questions? Email hello@payrolldash.co.uk.