Privacy Policy

1. Who we are

Moonworkers Ltd ("Moonworkers", "we", "our" or "us") is a private limited company incorporated in England and Wales (Companies House number 11123973), with its registered office at 20-22 Wenlock Road, London, England, N1 7GU.

We operate the website at www.moonworkers.co.uk and the payroll platform at payroll.moonworkers.co.uk (together, the "Services").

We are registered as a data controller with the Information Commissioner's Office (ICO), registration number ZA525097.

For any privacy-related enquiry, please contact us at privacy@moonworkers.co.uk.

2. Personal data we collect

The personal data we collect depends on how you interact with our Services. It falls into the following categories:

2.1 Account and contact data

When you register for an account or contact us, we collect your name, email address, phone number, job title, and the name and address of your business.

2.2 Payroll and employee data

To run payroll on your behalf, we process personal data relating to your employees, including: full name, date of birth, National Insurance number, tax code, address, bank account details, salary and earnings information, pension contribution details, and statutory payment records. This data is provided by you as the employer and is processed strictly to perform the payroll calculations and HMRC submissions you have instructed us to carry out.

2.3 Usage and technical data

We automatically collect technical information when you visit our website or use our platform, including your IP address, browser type and version, operating system, pages visited, time and duration of visits, and referring URLs. We use Google Tag Manager and Google Analytics for this purpose — see our Cookie Policy for details.

2.4 Payment data

Payment card details are processed directly by our payment provider (Stripe) and are never stored on our own systems. We retain transaction records including amounts, dates, and references for accounting and legal compliance purposes.

2.5 Communications data

If you contact our support team or send us an email, we retain a record of that correspondence, including its content and any attachments.

3. How and why we use your data

We process personal data only where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

4. Who we share your data with

We do not sell your personal data. We share it only where necessary, with the following categories of recipients:

• HMRC: For RTI submissions (FPS and EPS), as required by UK law.
• Pension providers: Including NEST, Smart Pension, and The People's Pension, to process auto-enrolment contributions you have instructed us to make.
• Cloud infrastructure: We host our platform on services including Vercel and Sanity, which process data on our behalf under appropriate data processing agreements.
• Payment processing: Stripe processes payment card transactions on our behalf.
• Analytics: Google Analytics (via Google Tag Manager) processes anonymised usage data to help us understand how our website is used.
• Professional advisers: Our lawyers, accountants, and insurers, where necessary in the course of the services they provide to us.
• Law enforcement: If required by law, a court order, or other legal process.

5. International transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place — typically UK adequacy regulations or the International Data Transfer Agreement (IDTA) and its addendum to the EU Standard Contractual Clauses. Our primary service providers (Vercel, Google, Stripe) maintain appropriate transfer mechanisms for UK data.

6. Data retention

We retain personal data only for as long as is necessary for the purposes described in this policy, or as required by law. Specifically:

• Payroll and HMRC records are retained for a minimum of 6 years from the end of the relevant tax year, as required by HMRC.
• Account data is retained for the duration of your subscription and deleted within 90 days of account closure, unless a longer retention period is legally required.
• Support correspondence is retained for 3 years.
• Website analytics data (anonymised) is retained for 26 months.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us at privacy@moonworkers.co.uk. We will respond within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include encryption in transit and at rest, access controls, and regular security reviews. No method of transmission over the internet is entirely secure, however, and we cannot guarantee absolute security.

9. Third-party links

Our website may contain links to third-party websites. This policy applies only to Moonworkers and we are not responsible for the privacy practices of other sites. We encourage you to read the privacy notice of any website you visit.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify registered users by email. Your continued use of our Services after any change constitutes your acceptance of the updated policy.

11. Contact us

For any questions about this policy or how we handle your personal data: