Last updated: 15 October 2026
Wealden Computing Services Limited, trading as Wealden (“Wealden”, “we”, “our” or “us”), has provided HR and payroll software and services to UK organisations for many years, and protecting the personal data our clients entrust to us is central to what we do.
In the UK, personal data is protected by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Where we work with clients in the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR) may also apply. This page explains how we help our clients meet their obligations under these laws. For information about how we handle personal data collected through this website, please see our Privacy Policy.
Wealden is registered with the Information Commissioner’s Office (ICO), registration number Z1025668, and holds Cyber Essentials certification.
When you use our HR and payroll software or our payroll bureau services, you (our client) are the controller of your employees’ personal data and Wealden acts as your processor. This means we only process that data on your documented instructions and for the purpose of providing our services to you. You retain ownership of, and all rights in, the data you store in our services.
Our software includes features to help you meet your own obligations to your employees, including responding to requests to access, correct, delete or transfer their personal data, or to object to its processing. If one of your employees contacts us directly, we will pass the request to you promptly and help you respond to it.
Client data is hosted on Microsoft Azure in UK data centres. Microsoft’s data centres are certified to internationally recognised security standards, including ISO/IEC 27001, and are protected by 24‑hour physical security and strict access controls. Our services are designed so that each client’s data is kept logically separate from the data of other clients.
We apply appropriate technical and organisational measures to protect client data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:
Our software also lets you monitor how data is managed and who has access to what data within your organisation.
Some members of our support and development team are based outside the UK, including in India, and may need to access client data to provide support or maintain our services. Where this happens, the transfer is protected by the International Data Transfer Agreement (IDTA) approved under UK data protection law, together with strict access controls and confidentiality obligations. We will tell you about any international transfers relevant to your service and provide further details on request.
We use a small number of carefully selected sub‑processors to help us provide our services, including Microsoft (hosting). Each sub‑processor is bound by a written contract that requires it to protect your data to the same standard we do. We keep a list of our current sub‑processors, which is available on request, and we will notify you before adding or replacing a sub‑processor so that you can object.
We have documented processes for detecting, investigating and responding to security incidents. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any event within 48 hours, and give you the information you need to meet your own obligations, including reporting to the ICO where required.
We keep client data only for as long as needed to provide our services and as instructed by you. When our contract ends, we will return your data to you or securely delete it, as you choose, unless we are required by law to keep it.
Because compliance is a shared responsibility, we are committed to helping you comply with data protection law. Requirements such as data access and erasure rules, privacy by design, and data breach notification may mean changes for your organisation, so it is important to understand your obligations regardless of where your organisation is based.
Our Data Processing Agreement (DPA) sets out our commitments as your processor, as required by Article 28 of the UK GDPR, including the safeguards for any international transfers. If you are a client and would like a copy of our DPA or our sub‑processor list, or you have any questions about data protection, please contact us at support@wealden.net.