Legal · Compliance
Compliant by design
payslipmaker.uk is architected so that payslip data never leaves your browser. Below: precise claims for the UK GDPR (Data Protection Act 2018) and the EU GDPR, each linked to the technical guarantee that supports it.
— Some things should never leave your browser.
In this section
What we receive when you generate a document: nothing.
Every field you type — your name, your employer's name, your NI number, your salary — is processed in your browser and rendered to PDF on your device. No document field is ever transmitted to us, logged, or stored. There's no document-data breach surface because there's no document data to breach.
The only data we get to know is that a payment has been made, and that too through our payment-gateway partner. We never receive or store the contents of any document you create.
United Kingdom · Data Protection Act 2018 + UK GDPR
UK GDPR
The UK GDPR (the EU GDPR text retained in UK law via the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) is the UK's primary personal-data regulation. The Information Commissioner's Office (ICO) is the supervisory authority.
payslipmaker.uk's architectural posture is compliant by design: the categories of personal data the UK GDPR regulates (name, address, National Insurance number, salary, tax code, bank details, employer identifiers) are processed entirely in your browser and never transmitted to us. We cannot disclose, sell, lose, or breach data we never receive.
The only data we get to know is that a payment has been made, and that too through our payment-gateway partner (Razorpay or PayPal). Payment references are retained for refund handling and HMRC's 6-year financial record-keeping window — no card data, no bank details, no cardholder name (the gateway tokenises and holds those, not us).
For the legal text, see the Data Protection Act 2018 and the ICO UK GDPR guidance.
European Union · General Data Protection Regulation
EU GDPR
While payslipmaker.uk is a UK service, EU residents (Irish, French, Italian, and other EEA payroll workers using UK-aligned payroll formats, plus dual-residents) are within scope of the EU GDPR. The same browser-only architecture that satisfies the UK GDPR also satisfies EU GDPR's data-minimisation, purpose-limitation, and storage-limitation principles (Articles 5(1)(b), (c), (e)).
EU GDPR Article-by-article posture:
- Art. 5(1)(c) — Data minimisation: document-generator data is processed entirely in your browser — we receive none of it server-side. The limited operational data we do hold — only confirmation that a payment was made, via our payment-gateway partner — is the minimum necessary for contract performance and site operation.
- Art. 6 — Lawful basis: the lawful basis for the small set of payment confirmation we receive is contract performance (Art. 6(1)(b)) — needed to deliver the paid PDF.
- Art. 13 — Information to data subjects: see our Privacy Policy.
- Art. 15–22 — Data-subject rights: because we hold no document data, most rights (access, rectification, portability) have nothing to act on. For payment-reference data, request via [email protected] — we respond within the statutory one-month window.
- Art. 28 — Processors: our payment processor (EU cross-border via SCC), a hosting provider, and a content-delivery network. The full subprocessor list is available on request to [email protected].
- Art. 32 — Security: TLS in transit, HSTS, hashed corporate codes, no plain-text secrets at rest.
- Art. 33 — Breach notification: we have no document-data breach surface; payment-ref breaches would be reported within 72 hours per the Article.
Disclosure and contact
payslipmaker.uk is operated under the law of England and Wales. The claims above describe architectural invariants of the live site as of the last-reviewed date. For ICO-related requests, EU GDPR data-subject requests, or audit inquiries, contact [email protected]. See also our Privacy Policy.