Documented instructions only.
We process payroll data solely on the client's documented instructions and never for any other purpose. We do not use client data for marketing, analytics or any secondary purpose, and we do not sell or share it.
Compliance and data protection
Our role and yours
Orinomics Limited administers payroll on employer instructions. The client remains the employer and retains its own legal, regulatory and tax obligations. The service agreement sets this out in full; the summary is on the How It Works page and the boundaries are below.
Data protection
Payroll data is among the most sensitive personal data a business holds: names, addresses, dates of birth, National Insurance numbers, bank details, salary, and in some cases health-related information through statutory sick pay and maternity records. It is treated accordingly.
Where we process personal data on behalf of a client, the client is the data controller and Orinomics Limited is the data processor. We enter into a written data processing agreement setting out the subject matter, duration, nature and purpose of the processing, the categories of personal data and data subjects, and the obligations of each party.
In practice:
Least-privilege access.
Access is limited to the individuals who need it for the agreed payrolls, granted at onboarding and revoked when the engagement ends or the individual's role changes.
Confidentiality.
Everyone with access to client payroll data is bound by written confidentiality obligations.
Secure transfer.
Payroll data is exchanged only through the channel agreed at onboarding. We do not accept payroll data through channels not named in the agreement, and we do not send unprotected personal data by email.
Payslip distribution.
Payslips are distributed by the method agreed with you: secure download, password-protected document, or printed and posted.
Retention.
Payroll records are retained for the period required by law and stated in your agreement, then securely deleted or returned on your instruction. Your data is returned to you on request at the end of an engagement at no charge.
Sub-processors.
We do not appoint a sub-processor without your prior written authorisation.
Incidents.
Any personal data breach affecting client data is reported to you without undue delay, with the information you need to meet your own notification obligations as controller.
Service boundaries
So that clients, counterparties and reviewers are in no doubt, Orinomics Limited confirms that it does not:
- recruit, supply, place or employ workers, and does not operate as an employment agency or employment business;
- act as an umbrella company, an employer of record, or a managed service company;
- become the employer of any individual on a client's payroll;
- determine employment status, worker status, or off-payroll working (IR35) status;
- provide legal, tax, accounting, audit, immigration or employment law advice;
- provide bookkeeping or accountancy services, or prepare statutory accounts, VAT returns or corporation tax returns;
- carry out any regulated financial services activity, or hold any Financial Conduct Authority authorisation;
- provide pension advice, select or recommend schemes, or complete a client's declaration of compliance;
- receive, hold, control or disburse payroll funds, or hold payment authority on any client bank account; or
- make employment, commercial, tax or legal decisions on a client's behalf.
Where a prospective client requires any of the above, we say so and decline the engagement.
Client due diligence
We carry out due diligence before accepting an engagement. This includes verifying the identity and registration details of the client business, identifying the individuals who will instruct us and approve pay runs, and confirming the nature of the employment arrangement and the PAYE scheme.
We do not accept an engagement where we cannot establish who the employer is, where the funding of payroll liabilities is unclear, where the instructions are inconsistent with the stated arrangement, or where the structure appears designed to obscure the true employment or tax position.
Business continuity
Payroll has fixed statutory deadlines that do not move for our convenience. Processing arrangements, data backups and contact cover are set out in your service agreement so that a pay run does not depend on one person being available in one particular week.
Complaints
If something goes wrong we want to hear about it directly and early. Our complaints procedure sets out how to raise a complaint, who handles it, and the timescales for acknowledgement and response.