Privacy policy

This policy is issued by Cube Systems Limited, a company registered in England and Wales under number 17220899, with its registered office at Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. CubeHR is a trading name of Cube Systems Limited, which is part of Crushed Ice Group. In this policy, "we", "us" and "our" mean Cube Systems Limited.

For the processing this policy describes we are the controller. That means we decide how and why the data is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office under registration number ZC216972.

We are not required to appoint a data protection officer. Questions about this policy or your personal data go to hello@cube-hr.co.uk, by telephone on 01234 672 617, or by post to the address above, marked for the attention of the data protection lead.

We handle personal data in two different capacities, and it matters which one applies to you.

Where we are the controller

This policy covers personal data we collect for our own purposes, about:

• people who visit this website;
• people who contact us, register interest or apply to our partner programme;
• contacts at our customers, prospective customers, partners and suppliers; and
• people who sign in to CubeHR, in respect of their account, sign-in and security records, and any support request they raise with us.

Where we are a processor

Employers use CubeHR to manage their people: staff records, holiday and absence, rotas, time and attendance, documents, onboarding and reviews. The personal data in those records belongs to the employer. The employer is its controller and its own privacy notice for staff applies. We process the data only on its instructions, under a data processing agreement, as set out in our data processing terms.

When you visit this website

Pages, fonts, icons and images are served from our own servers. The website sets no cookies unless you allow analytics, and it carries no advertising or social media tags.

Like any web server, ours keeps a log of each request: your IP address, the date and time, the page requested, the page that linked to it, and the browser and operating system your device reports. We use these logs only to keep the site secure and working.

Your browser also keeps a short note of your visit in its session storage, under the name visit_journey: the page you arrived on and when, the site that sent you, any campaign tags or ad click IDs in that first link, the previous page, and how many pages you have viewed. It stays in that browser tab, is deleted when you close it, and only reaches us if you send an enquiry or register interest.

If you allow analytics

When analytics is in use, a banner asks whether you allow it. If you choose "Allow analytics", Google Analytics 4 sets its _ga and _ga_<container-id> cookies and records which pages you view, how you arrived, the type of device, browser and screen you use, your approximate location (such as the country and city, worked out by Google from your IP address), and interactions such as scrolling, following a link to another website, clicking a phone number or email address, and sending a form. GA4 does not log or store IP addresses. We see the results as reports about visits in general, and we do not use them to identify anyone. Advertising features are switched off.

The Google Analytics script only loads after you allow analytics, so if you choose "Essential only" nothing is sent to Google. If you withdraw your consent through Cookie settings, Google Analytics stops and its _ga cookies are removed.

When you get in touch or register interest

If you use the contact form or register interest, we collect your name and work email address, your company name and headcount if you give them, the type of enquiry, your message, and the page or form you sent it from. If you apply to the partner programme, we collect the contact and business details you enter.

With the form, your browser also sends details about your visit. They help us route your enquiry to the right person, spot misuse of the form, and understand which pages lead people to get in touch. They are:

• your IP address;
• your browser and operating system, read from the user agent your browser reports, and the type of device;
• your language, time zone and local time, your screen and window size, whether your device has a touch screen, and whether cookies are enabled;
• the note of your visit described above: the page you arrived on and when, the site that sent you, campaign tags and ad click IDs, the previous page and the number of pages viewed; and
• if you allowed analytics, your Google Analytics client ID, which lets us match the enquiry to the analytics for that visit.

The enquiry is sent to the Cube Systems enquiries mailbox by email. If you email or call us, we keep what you tell us and the details you contact us from. Please do not send passwords, API keys or details about your staff through a form.

When you become a customer

We hold names, job titles and business contact details for the people we deal with at your organisation, including account, billing and technical contacts, together with your plan, headcount, invoices, payment history, and the history of our support and account conversations. Card payments for subscriptions are taken by Stripe. Card details go straight to Stripe and are never stored on our systems.

When you use CubeHR

• Account details: your name, work email address, role and permissions in your organisation’s CubeHR account.
• Sign-in data: your password, stored only as a salted hash, and your two-step verification settings if you use them.
• Security records: sign-in times and the IP address and browser used, which we use to protect accounts and investigate misuse.
• Audit records: which user created, changed or deleted a record, and when. Your organisation can see these in the CubeHR audit trail.
• Support requests: anything you send us when you ask for help.

Your employer may hold special category data about you in CubeHR, such as health information in sickness and absence records. We process it only as your employer’s processor. We do not ask for special category data for our own purposes. CubeHR is a workplace tool, so we do not knowingly collect information about children, other than where an employer records a young worker it lawfully employs.

Data protection law requires a lawful basis for every use of personal data. These are ours.

Where we rely on legitimate interests, we have weighed them against your rights and you can ask us for that assessment. You can object at any time, as explained under your rights.

We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

We do not sell personal data, and we do not share it with anyone for their own marketing. We share it only with:

• Crushed Ice Group companies, chiefly Crushed Ice, which operates the UK data centres CubeHR runs in.
• Service providers who process data for us under written contracts: Amazon Web Services, for CubeHR file storage and system email in its London region; Stripe, for subscription payments; Google, for website analytics if you allow it; and our business email and accounting providers. Those used within CubeHR itself are named on our sub-processors page.
• Professional advisers, such as lawyers, accountants and insurers, who owe us a duty of confidentiality.
• Authorities, such as the police, HMRC or a regulator, where the law requires it. We check that a request is lawful before acting on it and, where the data belongs to a customer, we tell the customer unless the law forbids us to.
• A buyer or successor, if all or part of our business is sold or reorganised, on condition that they honour this policy.

We hold personal data in the United Kingdom. CubeHR databases, file storage and backups are in UK data centres, and the storage and email services we use from Amazon Web Services run in its London region.

There are two exceptions. Google Analytics runs only if you allow it. It is provided by Google Ireland Limited, with Google LLC, and the data may be processed in the United States under the UK Extension to the EU-US Data Privacy Framework. Stripe processes payment details in the European Union and the United States under the same framework and its own data transfer terms.

If any other provider can access personal data from outside the UK, for example to give technical support, it does so under UK adequacy regulations or the International Data Transfer Addendum to the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.

We keep personal data only for as long as we need it for the purpose it was collected for, then delete or anonymise it.

The note of your visit kept in your browser is deleted when you close the tab, unless you send it to us with an enquiry. Where a legal claim or investigation is under way, we may keep the relevant records until it is resolved. Where your employer is the controller, its retention instructions apply to your staff record.

The measures that protect personal data include:

• encryption in transit with TLS, and encryption at rest for sensitive fields such as bank details and National Insurance numbers, and for uploaded document copies;
• passwords stored only as salted hashes, and two-step verification for sign-in;
• role-based permissions, so each organisation decides who can see which records;
• an audit trail of changes to personnel records, recording who changed what and when;
• regular backups held in the UK, with tested restore procedures; and
• staff access limited to the named people who need it to run and support the service, with that access logged.

If a personal data breach is likely to put people’s rights at risk, we will report it to the ICO within 72 hours of becoming aware of it and, where the risk is high, tell the people affected without undue delay. Customers are notified as set out in our data processing terms.

Under UK GDPR you have the right to:

• be informed about how your data is used, which is what this policy is for;
• access a copy of the personal data we hold about you;
• rectification of data that is inaccurate or incomplete;
• erasure of your data where there is no good reason for us to keep it;
• restrict how we use it, for example while a question about its accuracy is resolved;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability, receiving data you gave us in a machine-readable format; and
• withdraw consent, where we rely on it, without affecting anything done before. For analytics, use Cookie settings in the footer of any page.

To use any of these rights, email hello@cube-hr.co.uk. You do not need a form or any particular wording. We may ask you to confirm your identity before we act, so that we never hand your data to someone else. We respond within one month, and there is normally no charge. If a request is complex we may extend that by up to two further months, and we will tell you why within the first month.

If your request concerns your staff record in an employer’s CubeHR account, we will pass it to that employer, which is responsible for answering it, and help it do so.

If you are unhappy with how we have handled your data, please tell us first at hello@cube-hr.co.uk and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, with whom we are registered under number ZC216972:

• online at ico.org.uk/make-a-complaint;
• by telephone on 0303 123 1113; or
• by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

This website sets no cookies unless you allow Google Analytics, which then sets two. The CubeHR app keeps you signed in using your browser’s storage. Everything is listed in our cookie policy, and you can change your analytics choice at any time using Cookie settings in the footer.

We review this policy at least once a year, and whenever the way we handle personal data changes. The date at the top shows when it was last updated. If a change materially reduces your rights, we will email account holders before it takes effect. Previous versions are available on request.