This notice covers the heimdallhr.com marketing website. The HeimdallHR application itself (where customers store HR data) is governed by a separate in-app privacy notice and data processing agreement, presented to you at sign-up. This page is about the marketing site only.
Who we are
HeimdallHR is operated by WSH Software Solutions Ltd, a company registered in England & Wales (company number 17186192). Our registered office is 73a High Street, Little Lever, Bolton, England, BL3 1NA. WSH Software Solutions Ltd is the data controller for the marketing website. Contact us at [email protected].
What data we collect on this website
The marketing website is intentionally minimal. We collect only:
- Server access logs — IP address, request URL, user-agent string, timestamp. Recorded by our web server for security and diagnostic purposes.
- Information you send us — if you email
[email protected]or use the contact form, we hold your message, email address, and anything you choose to share. - Demo requests — if you submit the See a Demo form, we hold the details you enter (name, work email, company, company size, phone, and your message) so our sales team can arrange your demo — and, if you build a tailored demo afterwards, which features you selected. The form is protected against bots by Cloudflare Turnstile, which processes your request metadata to distinguish people from automated traffic.
- First-party preferences stored locally in your
browser via
localStorage(theme preference and billing toggle). These never leave your browser and are not tracking.
For visit statistics we use Plausible Analytics, a privacy-first, cookieless tool: it sets nothing on your device, stores no IP addresses or persistent identifiers, and produces only aggregate page statistics. Plausible is an EU company and the data is hosted in the EU. Because it collects no personal data, no cookie banner is needed. We don't use advertising trackers or fingerprinting. See our Cookie Policy.
Product data is separate
If you become a HeimdallHR customer, the personal data your business stores in the product (employee records, leave history, performance reviews, etc.) is processed under a separate Data Processing Agreement. In that context, your business is the data controller and WSH Software Solutions Ltd is the data processor. Details are provided at sign-up and in the in-app privacy notice.
Why we use it and our legal basis
- Access logs — running a secure website. Legal basis: legitimate interests.
- Email enquiries — to reply to you and progress sales conversations. Legal basis: legitimate interests, or performance of a contract for active customers.
- Demo requests — to contact you about the demo you asked for. Legal basis: consent (the checkbox on the form), which you can withdraw at any time by emailing us.
- Browser preferences — to remember your settings between visits. No legal basis required (first-party, no personal data leaves your device).
How long we keep it
- Server access logs are kept for up to 30 days, then deleted.
- Email correspondence and demo-request details are kept for as long as is reasonably necessary to maintain the relationship or meet legal record-keeping obligations (typically up to 6 years for tax records under UK law). If you ask us to delete your demo request, we will.
Who we share it with
We use a small number of third-party processors to operate the website and respond to enquiries:
- Our VPS hosting provider (web server infrastructure).
- Our email provider (sending and receiving messages).
- Amazon Web Services (SES) — delivers demo-request and contact-form notifications to our sales team.
- Cloudflare — content delivery and Turnstile bot protection on the demo-request form.
- Plausible Analytics — aggregate, cookieless visit statistics (no personal data; EU-hosted).
We do not sell, rent, or share your personal data with anyone for marketing purposes.
International transfers
Our marketing-site infrastructure is hosted within the UK or the European Economic Area wherever possible. Where data must be transferred outside the UK/EEA, we rely on adequacy decisions or standard contractual clauses as required by UK GDPR.
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data ("right to erasure");
- ask us to restrict how we use your data;
- object to processing based on legitimate interests;
- request a copy of your data in a portable format.
To exercise any of these rights, email [email protected]. We'll respond within one month.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
We may update this notice from time to time. The "last updated" date at the top of this page shows when it was last revised.