Privacy Policy

WiPayroll ("WiPayroll," "we," "us," or "our") is a cloud-based payroll software-as-a-service platform registered and operating in the Republic of Trinidad and Tobago. This Privacy Policy applies to all personal data collected by WiPayroll through our website, web application, APIs, and any associated services (collectively, the "Platform").

For the purposes of the Data Protection Act of Trinidad and Tobago (Chapter 22:04) ("DPA"), WiPayroll is the data controller for personal data collected directly from our clients (account holders and administrators). In relation to employee personal data submitted by our business clients through the Platform, WiPayroll acts as a data processor on behalf of the client, who is the data controller for their employees' personal data.

We collect several types of information in connection with your use of the Platform:

WiPayroll uses the personal data we collect for the following purposes:

• Service Provision: To process payroll, calculate statutory deductions, generate payslips, and deliver the core features of the Platform.
• Account Management: To create, maintain, and secure your account, and to authenticate your identity when you log in.
• Compliance and Reporting: To generate statutory reports, TD4 certificates, NIS contribution reports, and other compliance documents required by the laws of Trinidad and Tobago.
• Communications: To send you transactional emails (payslip notifications, billing receipts, password resets), service announcements, and, where you have opted in, marketing communications.
• WhatsApp Notifications: To deliver payslips and payroll notifications to employees via WhatsApp, where this feature is enabled by the account administrator.
• Customer Support: To respond to your support enquiries, troubleshoot technical issues, and resolve disputes.
• Platform Improvement: To analyze usage patterns, diagnose bugs, and improve the functionality and user experience of the Platform. Analytics are performed on aggregate and de-identified data where possible.
• Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents.
• Legal Obligations: To comply with applicable laws, court orders, regulatory requirements, and lawful requests from governmental authorities in Trinidad and Tobago.
• AI Assistant: To provide context for the AI Tax Assistant feature. Note that you should not enter personally identifiable employee data into the AI chat interface.

WiPayroll processes personal data in accordance with the Data Protection Act of Trinidad and Tobago (Chapter 22:04). Our processing activities are based on one or more of the following lawful grounds:

• Contractual Necessity: Processing is necessary for the performance of our contract with you (i.e., providing the payroll services described in our Terms of Service). This covers the majority of our core processing activities.
• Legal Obligation: Processing is necessary for WiPayroll and its clients to comply with legal obligations under Trinidad and Tobago law, including the Income Tax Act (Chapter 75:01), the National Insurance Act (Chapter 32:01), the Labour Act, the Minimum Wages Act, and associated regulations.
• Legitimate Interests: Processing is necessary for WiPayroll's legitimate interests, including maintaining platform security, preventing fraud, improving services, and communicating relevant information to users, provided that such interests are not overridden by the rights and freedoms of data subjects.
• Consent: Where processing is based on your freely given, specific, and informed consent (e.g., marketing emails, optional analytics). You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

WiPayroll stores all client and employee data on secure servers. We implement a range of technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your browser/device and our servers is encrypted using TLS (Transport Layer Security) 1.2 or higher.
• Encryption at Rest: Sensitive data fields (including financial information and government identification numbers) are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within our systems is restricted on a need-to-know basis, with role-based access controls and multi-factor authentication for staff accessing production systems.
• Audit Logging: We maintain comprehensive audit logs of access and changes to sensitive data within the Platform.
• Regular Security Reviews: We conduct periodic security assessments and vulnerability testing of our Platform and infrastructure.
• Data Backups: Regular encrypted backups are performed to ensure data availability and recovery in the event of a system failure.

While we take all reasonable measures to protect your data, no electronic transmission or storage system is completely secure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify affected users and, where required, relevant regulatory authorities in accordance with applicable law.

WiPayroll retains personal data only for as long as necessary for the purposes for which it was collected and to comply with our legal obligations:

• Active Account Data: We retain personal and payroll data for as long as your account remains active and the contract between us is in force.
• Post-Termination Retention: Following account termination or subscription cancellation, WiPayroll retains payroll records, tax documents, and related business data for a period of seven (7) years to comply with the record-keeping requirements of the Income Tax Act and associated regulations in Trinidad and Tobago. This period aligns with the statutory limitation period for tax assessments by the Board of Inland Revenue.
• Account Credentials: Login credentials are retained only during the active account period. Upon deletion, passwords are irreversibly hashed and purged.
• Marketing Data: If you have consented to marketing communications, we retain your contact details for this purpose until you withdraw consent or unsubscribe.
• Audit Logs: Security and access audit logs are retained for a minimum of two (2) years.

After the applicable retention period, personal data is securely deleted or permanently anonymized so that it can no longer be attributed to any individual.

WiPayroll does not sell, rent, or trade your personal data to third parties. We may share your data only in the following circumstances:

• WiPay (Payment Processing): Billing and payment data is transmitted to WiPay for payment processing. WiPay is a licensed payment service provider in Trinidad and Tobago. Only the minimum necessary data for transaction processing is shared with WiPay.
• WhatsApp / Meta (Messaging): When payslip delivery via WhatsApp is enabled, payslip data and the employee's phone number are transmitted to Meta's WhatsApp Business API infrastructure for message delivery.
• OpenAI (AI Features): Queries submitted to the AI Tax Assistant are processed by OpenAI's API. These queries should not contain personally identifiable employee data. WiPayroll's use of OpenAI's API is governed by OpenAI's data processing policies.
• Cloud Infrastructure Providers: We use reputable cloud hosting and infrastructure providers to operate the Platform. These providers process data on our behalf under data processing agreements that require them to maintain appropriate security measures.
• Legal and Regulatory Authorities: We may disclose personal data to government bodies, regulatory authorities (including the Board of Inland Revenue and the National Insurance Board of Trinidad and Tobago), law enforcement agencies, or courts of law when required by law, court order, or other compulsory legal process.
• Business Transfers: In the event of a merger, acquisition, sale of assets, or other business combination, your data may be transferred to the successor entity. We will notify affected users prior to any such transfer and provide information about choices you may have.
• With Your Consent: We may share your data with third parties where you have provided your explicit, informed consent to such sharing.

The WiPayroll Platform integrates with third-party services to deliver certain features. Each third party operates under its own privacy policy and terms of service, which we encourage you to review:

• WiPay: Payment gateway for Trinidad and Tobago. Processes subscription and disbursement payments.
• Meta / WhatsApp Business API: Used for payslip delivery and employee notifications via WhatsApp messaging.
• OpenAI: Powers the AI Tax Assistant feature. Queries sent to the assistant are processed under OpenAI's API data usage policies.

WiPayroll is not responsible for the privacy practices of third-party services. We encourage all users to familiarize themselves with the privacy policies of the third-party services used within the Platform. WiPayroll will only share the minimum data necessary with third-party service providers to deliver the requested features.

Under the Data Protection Act of Trinidad and Tobago (Chapter 22:04), you have the following rights in relation to your personal data processed by WiPayroll:

• Right of Access: You have the right to request a copy of the personal data WiPayroll holds about you and to be informed of the purposes for which it is processed.
• Right of Correction: You have the right to request that inaccurate, incomplete, or outdated personal data be corrected or updated.
• Right of Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations (such as the 7-year record-keeping requirement).
• Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain circumstances (e.g., while a dispute regarding accuracy is resolved).
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where processing is for direct marketing, we will cease processing upon your objection.
• Right to Data Portability: You have the right to receive personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another service.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at privacy@wipayroll.com. We will respond to all valid requests within thirty (30) calendar days in accordance with the DPA. We may require you to verify your identity before processing your request. Some requests may be subject to limitations where they conflict with our legal obligations.

If you believe your rights under the Data Protection Act have been violated, you may lodge a complaint with the Office of the Information Commissioner of Trinidad and Tobago or seek judicial recourse through the courts of the Republic of Trinidad and Tobago.

WiPayroll uses cookies and similar technologies (such as local storage and session tokens) to operate the Platform and improve your experience. The types of cookies we use include:

• Strictly Necessary Cookies: These are essential for the Platform to function and cannot be disabled. They include session authentication cookies that keep you logged in during your session.
• Functional Cookies: These allow us to remember your preferences (such as dark mode settings) and provide a personalized experience.
• Analytics Cookies: With your consent, we use analytics cookies to understand how users interact with the Platform, which pages are most visited, and how we can improve the overall experience. Analytics data is collected in aggregate form.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the Platform. For more detailed information about cookies, please refer to our separate Cookie Policy available at /cookies.

The WiPayroll Platform is a professional business service intended exclusively for use by individuals aged eighteen (18) years and older. We do not knowingly collect personal data from individuals under the age of 18.

If you are under the age of 18, you must not create an account or use the WiPayroll Platform. If you are a parent or guardian and believe that a minor has provided personal data to WiPayroll, please contact us immediately at privacy@wipayroll.com and we will take prompt steps to delete such data from our systems.

WiPayroll's primary data storage and processing infrastructure is located in data centers that may be situated outside of the Republic of Trinidad and Tobago (for example, in the United States or the European Union), as we utilize cloud infrastructure providers that operate globally.

Additionally, our integration with third-party services such as OpenAI (United States) and Meta (United States) may involve the transfer of certain data to these jurisdictions for processing.

Where personal data is transferred internationally, WiPayroll takes appropriate measures to ensure that such transfers comply with applicable data protection law, including ensuring that adequate safeguards are in place to protect your data. These safeguards may include:

• Data processing agreements with third-party service providers that include appropriate data protection clauses.
• Ensuring that recipient jurisdictions or organizations provide an adequate level of data protection.
• Applying data minimization principles — only transferring the minimum necessary data to fulfil the service purpose.

By using the WiPayroll Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside of Trinidad and Tobago as described in this section, subject to the safeguards described above.

WiPayroll may update this Privacy Policy from time to time to reflect changes in our practices, the Services we offer, legal requirements, or other operational reasons. When we make material changes, we will notify you by:

• Sending an email notification to the address associated with your Account.
• Displaying a prominent notice within the Platform when you next log in.
• Updating the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you should discontinue use of the Platform and contact us regarding account termination.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way WiPayroll handles your personal data, please contact our Data Protection Officer (DPO):

We aim to respond to all privacy-related enquiries within thirty (30) calendar days. For urgent matters involving potential data breaches or unauthorized access to your account, please contact us immediately at privacy@wipayroll.com with the subject line "URGENT: Data Security".