Your data and security
You hold your staff’s records as their employer, and we handle them for you. Here’s who can see them, where they’re kept, how we protect them, and how you take them with you if you leave.
- Where it’s kept
- In the EU, on servers in Amsterdam, the Netherlands
- Who sees it
- You, the people you allow, and your Maravier HR team
- If you leave
- Export your records, and download PDFs of everything we issued
The suppliers we use are listed in our privacy notice.
Who sees what
You decide who in your business sees what. At Maravier, people see only the clients and the work assigned to them.
In your business
- You see everything about your business and your staff.
- Managers you invite see what you allow. You choose what each one can see, and who can approve holiday or issue warnings. Dismissals need you or a named director.
- Each member of staff sees only their own records.
- Your accountant or bookkeeper sees only the pay summaries, if you give them a login.
At Maravier
- Your named HR expert and their backup see your business’s records and messages, so they can answer your questions and run your cases.
- Our employment solicitor will see only the matters passed to them.
- An independent investigator or chair sees only the one case they’re assigned.
- Our health and safety adviser sees only your risk assessments, accident book and health and safety calendar, and only if you have the add-on, from summer 2027.
Everyone on our team is trained in data protection before they see any client data, keeps no client files on personal devices, and loses access the day they leave. Every view and change is logged.
Health details and concerns
Health details, such as sickness records and fit notes, are kept to the minimum, held separately and shown only to those who need them. Your first pack includes an appropriate policy document: the document employers need to hold health details about staff, setting out how they’re protected and how long they’re kept.
Concerns raised by staff in the app come to your HR expert, not their manager, and staff can hide their name from you. Maravier still sees it, so your HR expert can follow up with them.
- Nothing a member of staff tells us is passed to you automatically. Your HR expert decides what you need to know.
- If you need to act, your HR expert can tell you what the concern is without naming the person who raised it.
- Concerns about you follow a confidential route, and your HR expert can recommend an independent investigation.
- Your staff privacy notice tells staff that our HR experts can read their messages.
Fernside won’t see your name. Maravier will, so Rachel can follow up with you.
Send to RachelAll names are made up for the demo.
Where it’s kept, and how it’s protected
Your records are kept in the EU. Our servers are in Amsterdam, in the Netherlands, and questions to Mirith are processed in the EU. UK data protection law allows this, because it treats every country in the European Economic Area as having adequate data protection.
Where a supplier is based outside the UK and the EU, a data processing agreement with the safeguards UK law requires is in place before any client data goes in. Our suppliers are listed in our privacy notice.
Two-step verification
For everyone with a login: you, your managers, your staff and our team.
Encrypted documents
Contracts, fit notes and right-to-work copies are encrypted before they’re uploaded, and the keys are kept apart from the files.
Only what each person needs
Each person at Maravier sees only the clients assigned to them, and loses access the day they leave.
Every view logged
An audit trail records every view and every change, and who made it.
Backups kept apart
Daily, weekly and monthly backups, plus an encrypted backup every hour, kept away from the live system. We test restoring them before launch and every quarter.
Checked before launch
A security scan, and a data protection impact assessment: a formal check of the risks to people’s data, updated when features change.
Nothing sensitive in alerts or logs
Notifications never carry sensitive details, and our logs hold no names, health details or document contents.
No tracking, no ads
The app only measures how it’s used, with a simple way to switch that off. Nothing tracks people or serves ads.
People make the decisions
Mirith never makes a decision about a person. You decide, and your HR expert signs off dismissals, so no decision about your staff is made automatically.
Our role for your staff’s data
As the employer, you decide why and how your staff’s data is used: in data protection terms, you’re the controller. We handle it for you, on your instructions, as your processor.
Our data processing terms, which you get before you share any staff information with us, commit us to:
- act only on your instructions
- keep the data confidential and secure
- use only approved suppliers
- help you with data requests and any breach
- return or delete the data when you leave.
Your first pack includes a staff privacy notice, and the software keeps your record of HR data processing up to date: what staff data you hold, why, who sees it and for how long.
When a member of staff asks for their data
Staff can ask for a copy of their data. This is called a subject access request. When one arrives, you must answer within 1 month, or within up to 2 more months for a complex request if you tell the person why within the first month. We help you answer it, with the letters for each step.
If something goes wrong
If a breach affects your data, we tell you without undue delay. We report our own notifiable breaches to the Information Commission, the UK’s data protection regulator, within 72 hours, and we log every breach.
If you’re unhappy with how we’ve handled data, tell us at hello@maravier.com. We acknowledge a complaint within 30 days and give you the outcome without undue delay. You can also complain to the Information Commission.
If you leave Maravier
- Before you close your account, you can export all your records.
- PDFs of everything we issued, including signed contracts, your handbook and policies as issued, and letters, stay downloadable after you leave, until your data is returned to you or deleted.
- If a payment fails, your account becomes read-only rather than being deleted, because you still have to keep your records.
- At the end, we return your data to you or delete it.
Editing, law-change updates and your HR expert’s checks end with your subscription.
When a member of staff leaves
- Their login stays open for 30 days after their last day, with a reminder a week before it closes. You can change that in settings.
- If they delete their account, their login goes, but the records you must keep by law stay on your file, and the app tells them so.
- Records are kept for as long as the law requires, then deleted automatically.
Questions
How long do you keep records?
As long as the law requires: right-to-work checks for the employment plus 2 years, holiday and minimum wage records for 6 years, tip records for 3 years, working time records for 2 years, and payroll records for 3 years from the end of the tax year. Everything else is kept for a period we’ll agree with our employment solicitor. Then records are deleted automatically.
Can my staff see what you write about them?
They can ask for a copy of their data, and advice from an HR expert isn’t covered by legal privilege, the rule that keeps advice from a solicitor confidential. So we write every record as if the employee will read it, and contested matters will go to our employment solicitor.
Where do my questions to Mirith go?
They’re processed in the EU, and every answer is kept in your advice record. The first time you use Mirith, the app explains how it works and who supplies it, and asks your permission before any question is sent.
Do you sell our data?
No. We use your staff’s data only on your instructions, to do your HR work.
Who sees a concern a member of staff raises about me?
Your HR expert. It follows a confidential route rather than coming to you, and your HR expert can recommend an independent investigation, carried out by someone who isn’t your HR expert.
Your HR team, from January 2027.
Start with the free checklist. Reserve your founding price, and we set you up in January. It’s refundable until launch.
Not ready yet? Get the free 1 January 2027 checklist.