Privacy Notice

Last updated: 26 August 2026

This notice describes how we handle personal data in a UK payroll practice. It is not a substitute for the data-processing terms in a signed client agreement. Company registration details will be added when they are available. A UK solicitor and data-protection adviser should review this notice against the final operating model.

Who we are

Ravelin is the trading name of Ravelin Capital Group Ltd, a company registered in England and Wales under company number 15556240. Contact: payroll@ravelin.group or 0333 050 0024.

Registered office: 50 Essex Street, London, WC2R 3JF
Company number: 15556240
ICO registration: [number, once issued]

We provide managed UK PAYE payroll and workplace-pension administration for employers. We are not an umbrella company, we do not employ a client’s staff, and we are not authorised by the Financial Conduct Authority to give financial, investment or pension advice.

How this notice is structured

Payroll work sits under two different data-protection roles. Mixing them up is how firms get this wrong, so we keep them separate:

• Ravelin as controller. We decide how to use personal data collected through this website, enquiries, quotes, billing, supplier management and our own employment records.
• Ravelin as processor. When we run payroll for a client, that employer remains the controller of its workers’ payroll data. We process that data on the client’s documented instructions, to help the client meet duties owed to HM Revenue & Customs (HMRC), The Pensions Regulator and other competent authorities.

If you are paid through a Ravelin-supported payroll, your employer is usually the organisation you should contact first about payslips, tax codes, hours, pension opt-outs or personal details. Ask them to involve us where we hold the operational record.

People this notice covers

We may process personal data about:

• website visitors and people who send an enquiry, including employers, agencies and workers;
• client contacts, approvers, directors and payroll operators;
• employees, workers, office-holders and pension-scheme members on a client payroll, once a service is live;
• suppliers, professional advisers and our own staff.

Personal data we use

Website and enquiries

Name, job title, business name, work or personal email, telephone number, the audience you selected on the contact form, message content, and technical data such as IP address, browser type and pages requested, generated by our host’s server logs.

Please do not send bank details, National Insurance numbers, full tax documents, medical information or other special-category data through the website form. If we need that information to run payroll, we will collect it through the agreed secure channel after onboarding.

Managed payroll and pension administration

On a live service we typically process, on the client’s instructions:

• identity and contact data: name, address, date of birth, email, telephone, employee or payroll number;
• tax and National Insurance identifiers, tax codes, student or postgraduate loan notices, and starter/leaver declarations;
• employment and pay data: job, department, hours, salary or rate, pay frequency, overtime, deductions, expenses treated through payroll, attachment of earnings, and statutory payments such as SSP, SMP, SPP, SAP, parental bereavement pay and neonatal care pay where they apply;
• pension data needed for automatic enrolment assessment, enrolment, opt-out processing, contribution files and scheme member identifiers;
• bank account details used to pay people, HMRC or a pension provider, where the client has asked us to prepare or submit those payment files;
• correspondence, approvals, audit logs and copies of HMRC or pension-provider reports.

Some statutory-pay cases involve health information (for example fit notes supporting statutory sick pay). That is special-category data. We only process it where the client instructs us to do so and UK GDPR Article 9 and the Data Protection Act 2018 allow it — typically for employment law, social security or statutory payment purposes, not for monitoring health in the round.

Sources

We collect data from you directly; from the employer that engages us; from HMRC (tax codes, student loan notices and similar payroll instructions); from pension providers and scheme administrators; from previous payroll providers during a controlled switch; and from our website host, form-delivery provider and professional advisers.

Why we use personal data, and the lawful bases

UK GDPR requires a lawful basis for each purpose. For website and commercial data we rely on:

• pre-contract steps and contract — responding to an enquiry, preparing a proposal, and performing a client agreement;
• legal obligation — tax, accounting, statutory record-keeping, and answering HMRC, The Pensions Regulator, the Information Commissioner’s Office (ICO) or a court;
• legitimate interests — running, securing and improving a payroll practice, keeping enquiry records, and establishing or defending legal claims, where those interests are not overridden by the individual’s rights;
• consent — only where we ask for it, for example a non-essential cookie if we ever introduce one. You can withdraw consent without affecting processing that already happened.

For client payroll files we process as a processor. The client’s lawful bases are typically its legal obligations as an employer (PAYE, National Insurance, Real Time Information, National Minimum Wage records, automatic enrolment and statutory payments) and performance of the employment or engagement contract with the individual. We do not use client payroll data for our own marketing.

HMRC, The Pensions Regulator and other authorities

Payroll is a regulated reporting activity even though we are not a tax authority and not a pension scheme. Where the client has authorised us as its agent, we submit Full Payment Submissions and other Real Time Information to HMRC, receive tax-code and student-loan instructions, and exchange contribution and membership files with the client’s chosen workplace pension scheme. The Pensions Regulator expects employers to assess workers, enrol eligible jobholders, pay contributions on time, keep records and complete a declaration of compliance. We help administer those tasks. We do not take the employer’s duties over, select the scheme, or act as trustee.

We disclose personal data to competent authorities where the law requires it, including HMRC, The Pensions Regulator, the ICO, the courts, and law-enforcement bodies. We do not sell personal data.

Who else we share data with

We share personal data only as needed with:

• our website host (currently Hostinger) and the form-to-email provider that delivers the contact form to payroll@ravelin.group (FormSubmit);
• payroll, RTI and pension-file software suppliers named in the client’s service schedule;
• banks, BACS bureaux or payment-file providers where the client has asked us to prepare FPS-aligned payment files;
• professional advisers, insurers and auditors under confidentiality;
• a successor provider, under the client’s written instruction, if the client switches away from us.

Google Fonts are loaded from Google’s servers when you view this website. That is a separate controller relationship between you and Google for the font request. See our Cookie Policy.

International transfers

We aim to keep payroll processing in the UK. Some suppliers (including font delivery, hosting components or a form-to-email service) may process data in the European Economic Area or elsewhere. Where UK GDPR requires a transfer tool, we will use the UK’s International Data Transfer Agreement or Addendum, or another mechanism the ICO recognises, and we will say so in the client data-processing terms once suppliers are confirmed.

Retention

We do not keep personal data longer than we need it. Typical periods, which a client agreement may tighten or extend where the law requires, are:

• website enquiries and unsuccessful quotes: 12 months after last contact, unless you ask us to delete sooner and no legal hold applies;
• PAYE and RTI working papers: at least three years after the end of the tax year they relate to, which is HMRC’s usual minimum for PAYE records;
• automatic-enrolment records: generally six years, and opt-out records for the period The Pensions Regulator expects (currently four years);
• National Minimum Wage supporting records: the statutory minimum then in force (currently treated in practice as up to six years);
• contracts, invoices and accounting records: six years after the end of the relevant financial year;
• dispute, investigation or claim files: until the matter is closed plus any limitation period.

When a client leaves, we return or make available the payroll data reasonably required for continuity, then delete or irreversibly anonymise remaining copies in line with the agreement, except where we must keep a copy for tax, accounting or legal claims.

Security

We use technical and organisational measures appropriate to payroll data: access limited to named operators, approved software, encrypted transit where the supplier supports it, and instructions not to use public email for National Insurance numbers or bank details. No method of transmission is completely secure. The client remains responsible for how it sends us source data and for who it authorises to approve a pay run.

Your rights

UK GDPR gives individuals the right, subject to exemptions, to request access, correction, erasure, restriction, objection to processing based on legitimate interests, and data portability. Where we rely on consent, you may withdraw it. Rights are not absolute — for example we cannot erase PAYE records that HMRC still requires an employer to keep.

If we hold the data only as a processor, we will forward a request to the client (the controller) unless the law requires us to act directly. Send requests to payroll@ravelin.group. We may need to verify identity.

You can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113. We would rather fix a problem first if you are willing to contact us.

Automated decision-making

Payroll software calculates tax, National Insurance, student loans, statutory payments and pension contributions from the data and statutory parameters the client supplies. Those calculations are not intended as solely automated decisions with a legal effect under UK GDPR Article 22. A named operator prepares each pay run and the client approves it before we treat it as final.

Children

This website is aimed at employers and adult workers. We do not knowingly collect website enquiries from children. A client payroll may include young workers; the employer remains the controller of that data.

Changes

We will post updates on this page and change the date above. Material changes to how we process client payroll data will also be handled through the client agreement.