This policy explains how HCO-HR ("we") collects, uses and protects personal data on the HCO-HR platform, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
HCO-HR operates HCO-HR, a workforce-management and remote-hiring platform. For data that companies enter about their own employees and candidates, the company is the controller and we process it on its behalf. For your own HCO-HR account and career profile, we are the controller.
Data we collect
- Account data: name, email, phone, password (stored only as a one-way hash) and language.
- Company data entered by your employer: job, department, attendance, leave, payroll, documents, performance and learning records.
- Career profile data you add yourself: photo, CV, skills, experience, education and job applications.
- Technical data: IP address, browser, sign-in times and a security log of important actions.
- Billing data: invoices and payment status. Card details are entered on the payment provider's page and never reach our servers.
Why we use it
- To provide the service you or your employer signed up for.
- To keep accounts secure (sign-in checks, two-step verification, fraud prevention).
- To send service messages such as invitations, password resets and invoices.
- To show your career profile to companies, only when you choose to make it visible.
- To meet legal and tax obligations.
We do not sell personal data, and we do not use it for advertising.
Artificial intelligence
Some features use an AI provider to summarise or suggest. Only the text needed for the request is sent, results are suggestions for a person to review, and no automatic decision with legal effect is made about you.
Sharing
We share data only with service providers needed to run the platform (hosting, email, SMS, payment gateways, AI provider), under contracts that protect it, or when the law requires it. If data is transferred outside the UK, we do so only with safeguards the law recognises (such as UK adequacy regulations or the International Data Transfer Agreement).
How long we keep it
Account data is kept while the account is active. When an account is deleted, personal details are removed or anonymised within 30 days, except records we must keep by law (for example invoices). Company data is kept for as long as the company's subscription requires and is deleted on its request.
Your rights
Under UK GDPR you have the right to be informed, to access your data, to get a copy in a portable format, to correct it, to ask for its deletion, and to object to or restrict some processing. You can download your data and delete your account at any time from "Account security" in your account. For company records (such as payroll), contact your employer, who controls them. You may also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Security
We use encrypted connections (HTTPS), hashed passwords, optional two-step verification, encrypted storage of secrets, role-based access and daily backups.
Cookies
We use only essential cookies: one to keep you signed in, and others to remember your language and theme. We do not use advertising or tracking cookies.
Contact
For privacy questions or requests: the contact form on the platform.
We may update this policy; the date below shows the latest version. Last updated: 2026-10-12.