Privacy & your information

Who to contact

Optimus Security manages staff information in this portal. For privacy questions, requests or complaints, contact u.ashraf@optimus-security.co.uk or your usual Optimus contact. You do not need a portal account to make a request.

What the portal uses

Contact and identity details, date of birth, National Insurance number, bank details, employment arrangements, shifts, pay rates, holiday records, expenses and receipts, pay queries, account details and security logs. These come from you, authorised Optimus staff and imported scheduling records.

The information supports staff administration, payroll preparation, expenses, statutory record keeping, holiday administration and account security. Providing the information needed to identify and pay you is necessary for these functions; missing information can delay processing.

The relevant grounds are legal obligations for payroll and statutory records, performance of your employment or services contract where necessary, and legitimate interests in secure administration and handling queries. Optimus must assess and document the grounds for each activity. Portal access is not treated as consent to unrelated uses.

Access and sharing

You can access your own staff information. Authorised payroll administrators can manage staff and payroll records. Privileged administrators can manage accounts, security and backups. Do not put passwords, medical details or unnecessary information about other people into receipts or free-text fields. If sensitive information is needed, ask Optimus for the appropriate channel.

This portal runs on ChatGPT Sites using Cloudflare database and file storage. Authorised payroll staff prepare files for Sage. The complete list of contracted service providers must be confirmed by Optimus.

Hosting and international transfers

Hosting and support locations, any international transfers and the safeguards used are awaiting confirmation by Optimus. Contact the privacy contact for details.

How long information is kept

PAYE records: at least 3 years after the end of the relevant tax year. Minimum-wage evidence: at least 6 years from the end of the following pay reference period. Annual-leave and holiday-pay records made from 6 April 2026: at least 6 years from creation. Where several duties apply, retain the relevant record for the longest applicable period. Optimus must confirm review/deletion periods for profiles, queries, security logs and backups, and any legal holds.

Deletion requests are reviewed against applicable record-keeping duties and legal claims. A deletion request does not automatically erase payroll history. Backups may continue to contain information until they are securely retired; any approved restriction or deletion must also be respected after a restore.

Your rights and complaints

You can ask for access, correction, erasure, restriction, portability or object to processing where the relevant right applies. Sign in and open Privacy & data, or contact Optimus directly. You can request access verbally or in writing; using this portal is optional. Identity checks must be proportionate.

Rights requests are normally answered within one calendar month. Where a lawful extension or clarification pause applies, Optimus should explain it. Data-protection complaints are acknowledged within 30 days and investigated and answered without undue delay. The portal acknowledges submissions immediately on screen; it currently does not send email notifications.

You may complain to the Information Commissioner’s Office. You do not have to give up any rights to use this portal.

Calculations and human review

The portal calculates hours, draft pay breakdowns and holiday balances using configured rules. Managers review and confirm timesheets and requests. A draft calculation is not a final Sage payroll result or a decision about your legal entitlements. Use Pay queries to challenge a calculation or ask for human review.

Cookies and security

The portal uses an essential sign-in cookie, optimus_session, to keep you authenticated. Its browser lifetime is up to eight hours; the server expires inactive sessions after 30 minutes and incomplete sign-ins after ten minutes. The portal application does not add advertising or analytics trackers. Hosting infrastructure may use essential security technologies; Optimus must include those in its provider review.

Passwords are hashed, authenticator verification is required, access is checked on the server, and backups are encrypted. No system can guarantee absolute security. Report suspected loss, disclosure or unauthorised access promptly to the privacy contact.