Privacy Policy

Last updated September 2026.

Overview

TropicHR (“TropicHR”, “we”, “us”) provides payroll and HR software for Caribbean employers. This policy explains how we collect, use, share and protect information (a) through this website, and (b) through the TropicHR product (“the Service”) used by our customers (employers) and their employees.

For the Service, most of the personal information we process — employee names, pay, bank details, statutory identification numbers and similar — belongs to our customers and their employees. In that relationship, the employer is the data controller and TropicHR acts as a data processor, handling that information only as instructed by the employer and as described in our customer agreement. If you are an employee and have a question about your own data, please contact your employer’s HR or payroll administrator first; they control that data and can action most requests directly, including through their TropicHR employee self-service portal.

Information we collect

Through this website

• Information you submit through the demo request, contact or sign-up forms: name, work email, company name, phone number, the territories you operate in, approximate employee count and any message you send us.
• Standard technical and server log information (IP address, browser type, pages visited, timestamps) generated as you browse.

Through the product, as a customer or a customer’s employee

• Account and workspace data: the company profile, operating territories, subscription plan, and administrator names and work email addresses.
• Employee and payroll data, entered by an employer’s administrators or imported on their behalf: employee names, contact details, employment terms, pay rates, pay elements (allowances, deductions, loans), leave and timesheet records, bank account details and statutory identification numbers. Bank account numbers, routing codes and statutory IDs are encrypted at rest (see Security, below).
• Employee self-service data: if an employer enables employee access, an employee may view their own payslips, submit leave requests and timesheets, and download year-end certificates through a separate employee portal.
• Billing data: the subscription plan, invoices, and payment confirmations. Card and bank details used to pay for the Service are collected and stored by our payment processor, not by TropicHR directly — see Sub-processors, below.
• Usage and diagnostic data: log-in activity, feature usage and error diagnostics, used to operate, secure and improve the Service.

How we use information

We use information to: provide, maintain and support the Service and this website; respond to enquiries and arrange demonstrations; process subscription payments; secure the Service and investigate misuse; meet our legal, tax and accounting obligations; and, in aggregated or de-identified form, to understand product usage and improve TropicHR. We do not sell personal information, and we do not use customer payroll data to serve advertising.

Legal bases for processing (where applicable)

Where data protection law in a relevant territory requires a legal basis, we (or, for product data, the employer as controller) rely on one or more of: performance of a contract (running payroll, providing the Service), a legal obligation (statutory reporting, tax and labour-law recordkeeping), legitimate interests (securing and improving the Service, preventing fraud), and consent, where we ask for it (for example, optional cookies or marketing communications).

Sharing and sub-processors

We do not sell personal information. We share it only as follows:

• Service providers who help us operate — for example cloud hosting and database infrastructure, transactional email delivery, and payment processing (a customer’s employer may enable one of PayPal, Stripe or Square to collect subscription payments; card details are handled by that processor under its own terms, not stored by TropicHR). Each is bound by contract to protect information and use it only to provide their service to us.
• Within a customer’s own workspace — employee data an employer enters is visible to that employer’s authorised users according to the roles it assigns them (for example Company Admin, HR Manager, Payroll Admin). TropicHR enforces strict separation between customers: one employer can never access another’s data.
• Legal and safety reasons — where required by law, regulation, legal process, or to protect the rights, property or safety of TropicHR, our customers, or others.
• A business transfer — if TropicHR is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy of at least equivalent protection.

International data transfer

TropicHR serves employers across multiple Caribbean territories, and our infrastructure and service providers may be located outside the territory where a customer or employee is based. Where we transfer personal information across borders, we take reasonable steps to ensure it continues to receive an appropriate level of protection, including through contractual safeguards with our service providers.

Security

We protect information with technical and organisational measures appropriate to its sensitivity, including:

• Encryption in transit (TLS) for all traffic, and encryption at rest (AES-256-GCM) for bank account numbers, routing codes and statutory identification numbers, with encryption keys held in a managed key vault separate from the database.
• Strict tenant isolation — a database-level filter applied to every query so one employer’s data is never visible to another.
• Role-based access control, so users see only the information their role requires.
• Two-person approval on payroll runs, so a payment cannot be released by the person who prepared it alone.
• An immutable, field-level audit log of changes to employee records, pay elements and payroll runs.

Further detail is on our Security page. No method of transmission or storage is completely secure; while we work to protect information, we cannot guarantee its absolute security.

Data retention

Website enquiry information is kept for as long as needed to follow up on it and for a reasonable period afterwards for our own records. Product data is retained for the duration of the customer’s subscription and for a period afterwards as required by applicable tax, labour and accounting record-keeping obligations, or as agreed with the customer, after which it is deleted or anonymised. The Service includes built-in tools an employer can use to run a retention schedule and to action an access or erasure request for a current or former employee.

Your rights

Depending on where you are and your relationship to us, you may have the right to ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, object to or restrict certain processing, or receive a portable copy of it. If you are a website visitor or prospect, contact us directly at [email protected]. If you are the employee of a TropicHR customer, please raise this with your employer first, since they control that data; we will assist our customer in responding to your request.

Cookies

This website uses cookies and similar technologies that are essential to its operation (for example, to remember your session and preferences). We do not use these to build advertising profiles. If we add optional analytics or marketing cookies in the future, we will ask for your consent where required and update this section.

Children’s privacy

This website and the Service are directed at businesses and working adults. We do not knowingly collect personal information from children, other than the ordinary employment records an employer may hold for employees who are minors under applicable local labour law.

Changes to this policy

We may update this policy from time to time. We will post the revised version here with an updated “last updated” date, and, where a change is material, we will make reasonable efforts to notify customers directly.

Contact

Questions about this policy or your personal information: [email protected]. General enquiries: [email protected].