Privacy Policy

Krux is a product of SLP Media Ltd(“Krux”, “we”, “us”), a company registered in England & Wales (company no. [COMPANY NUMBER]), registered office [REGISTERED ADDRESS]. For personal data we hold about our own customers and website visitors, we are the data controller. For personal data that a customer enters into Krux about their workers and subcontractors, the customer is the controller and we act as a processor (see our Data Processing Agreement).

ICO registration: [ICO REGISTRATION NUMBER]. Contact: [PRIVACY EMAIL].

Depending on how you use Krux, we may process:

• Account data — your name, work email, company name, role and password (stored hashed by our auth provider).
• Workforce & payroll data entered by customers — worker names, trades, UTRs, National Insurance-related details, CSCS card numbers, pay rates, timesheets and clock-in location/GPS data, and incident records. For this data the customer is the controller; we process it on their instructions.
• Billing data — handled by our payment processor; we do not store full card details.
• Usage & technical data — IP address, device/browser information and essential cookies needed to keep you signed in.

• To provide the service (account, sites, crew, compliance and payroll-estimate features) — performance of a contract.
• To secure, support and improve Krux — legitimate interests, balanced against your rights.
• To meet legal obligations (e.g. accounting, responding to lawful requests) — legal obligation.
• Non-essential cookies/analytics, if used — consent.

Krux provides compliance and payroll estimates and tooling; it is not a payroll bureau or tax adviser, and customers remain responsible for their own HMRC obligations.

Where a customer enables location-verified clock-in, Krux processes the location of a worker’s device at clock-in/out, on the customer’s instructions. Monitoring workers carries specific obligations: the employer (as controller) must have a lawful basis, complete a Data Protection Impact Assessment, and clearly inform workers in advance. We provide tooling to support this but the transparency duty rests with the employing customer.

We share data only with service providers who help us run Krux, under contract:

• Supabase — database, authentication and hosting.
• Vercel — application hosting and delivery.
• Stripe — payments and (where enabled) worker disbursements.
• [EMAIL PROVIDER] — transactional email.

We do not sell personal data, and we do not use it for advertising.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards (UK adequacy regulations or the International Data Transfer Agreement/Addendum). Configure your Supabase region to a UK/EU location where you need data residency. [Confirm your provider regions.]

We keep account data for as long as your account is active and as needed to comply with legal and accounting obligations afterwards. Customer workforce/payroll data is retained per the customer’s instructions and their own statutory retention requirements (e.g. HMRC record-keeping).

Under UK GDPR you have the right to access, rectify, erase, restrict or object to processing of your data, and to data portability. To exercise these, contact [PRIVACY EMAIL]. If your data was entered by an employer using Krux, please contact them as the controller. You can also complain to the Information Commissioner’s Office (ico.org.uk).

We use row-level security to isolate each company’s data, encrypted transport, role-based access controls and least-privilege handling of secrets. No system is perfectly secure; we will notify affected parties and the ICO of any reportable breach as required.

We may update this policy and will revise the date above. Questions or requests: [PRIVACY EMAIL], SLP Media Ltd, [REGISTERED ADDRESS].