Privacy Policy

MyHR Privacy Policy

User Terms of Use | Terms and Conditions | Website Terms of Use

Last updated: 17 June 2026

We are committed to maintaining the privacy of the information of our customers and other users of our MyHR software platform.

This Privacy Policy describes how we collect, use, store and distribute Personal Information and other data, and describes the purposes for which we may use, disclose or hold such Personal Information and other data.

The Short Version

What	Detail
What we collect	The information you give us to run your HR platform, including employee records, account details, usage data, and payment information.
How we use it	To operate and improve MyHR, support you, and (only with your permission) send you marketing.
How we protect it	Industry-standard security measures, and we will notify you promptly if something goes wrong.
Who we share it with	Only trusted third-party service providers who help us run MyHR, and only under strict data protection agreements.
AI and modern tools	We use AI tools built by third-party providers to help us deliver our Services better to you. MyHR does not build or train its own large language models, and we do not allow our AI vendors to train on your data. If our approach ever changes, we will tell you first.
Where we operate	Across New Zealand, Australia, and Canada, and we comply with the applicable privacy laws in each country.

In this Privacy Policy:

all references to Personal Information are to information or an opinion about an identified individual, or an individual who is reasonably identifiable;
all references to we, our or us are to the MyHR group of companies. This includes the following companies, as well as their affiliate and subsidiary companies:
- MyHR Limited, a company incorporated in New Zealand (NZBN 9429031116916) whose registered office is located at Unit 4, 485c Rosebank Road, Avondale, Auckland 1026, New Zealand;
- MyHR Australia Pty Limited, a company incorporated in Australia (ABN 70 620 586 003) whose registered office is located at Level 4, 55 Clarence Street, Sydney NSW 2000; and
- MyHR Platform Canada Limited, a company incorporated in British Columbia, Canada (BC1444706) whose registered office is located at 108 - 1870 Dowad Avenue, Squamish, British Columbia, V8B1C4; and
all references to you or your are to an individual who is the subject of the Personal Information.

Our Role: Data Controller and Data Processor

MyHR handles Personal Information in two distinct capacities, depending on whether it is information we hold and process for our own purposes or employee information a business uploads to MyHR that we hold on that business's behalf.

When MyHR is a Data Controller

For certain information, MyHR determines the purposes and means of collection and use. This includes:

account and profile information for customers and authorised users;
usage, analytics, and technical data relating to access and operation of the platform;
marketing and communications data; and
payment and billing information.

For this information, MyHR acts as a data controller (or principal organisation responsible for the information under applicable law). We are responsible for how this information is collected, used, disclosed, and protected in accordance with this Privacy Policy.

When MyHR is a Data Processor

When a subscribing employer or organisation uses MyHR to manage employee information (such as employment records, payroll data, contracts, or HR documentation), that employer determines the purposes for which the information is collected and used.

In this context, MyHR acts as a data processor (or agent), processing employee information on behalf of and under the instructions of the employer. The employer is responsible for ensuring it has the authority and any consents required from its employees to collect their information and upload it to MyHR.

For data where MyHR acts as a processor:

we process the information only in accordance with the employer's documented instructions, our agreement with the employer, and applicable law;
we do not use identifiable employee data for our own marketing or unrelated business purposes; and
access to employee data is limited to authorised personnel who require it to provide the services and who are subject to confidentiality obligations.

If you are an employee whose information is processed through MyHR, you should contact your employer in the first instance regarding privacy rights or concerns. We will assist employers in responding to valid requests where required.

What Personal Information and data do we collect?

During the course of your relationship with us or your use of the MyHR software platform (MyHR), we may collect the following information:

we will collect personal details from you during the course of your establishing and maintaining a customer account or user profile with us via MyHR, such as your name, user name, passwords, address, email address, phone numbers, and payment details;
we will collect data that is inputted or uploaded by users into MyHR, or that is inputted, uploaded or provided by users via any helpdesk or online chat service we may provide in connection with MyHR. This may include employment and payroll information about individuals;
you may be required to provide your age or date of birth to us for identity verification purposes, or where required to verify that you are legally entitled to access certain products or services;
we will collect data related to the use of MyHR, including details of the pages visited, the reports generated and the data accessed;
we may collect other Personal Information and data during the course or as a result of your relationship with us, including where necessary to enable us to provide products and services to you or to respond to requests for further information; and
we limit the Personal Information we collect to what is reasonably necessary.

We don't collect credit card information

We do not collect, store or process any credit card information. Any credit card payments made by users in connection with MyHR will be processed by third-party payment platform providers.

How we use Personal Information and other data

We will use, disclose and hold Personal Information and data collected by us for the following purposes:

to enable us to operate MyHR for the benefit of you or the applicable subscribing customer;
to enable other authorised users within your organisation to access and use the Personal Information and data you have agreed to share with them via MyHR;
to establish and maintain any user or customer account you hold with us;
to complete sales transactions, including billing, credit card processing, payment, receipt, credit check and verification services;
to respond to your queries or requests for additional information or support;
to provide any after-sales service required by you;
to maintain our records;
to provide technical support and administration services in relation to MyHR and any additional services ordered by you;
to keep you informed about products, services, events, promotions or any other marketing activities, but only to the extent permissible under applicable laws, and subject to any other restrictions contained in this Privacy Policy;
for product development or research purposes; and
to evaluate customer satisfaction and the performance of marketing activities.

Cookies

MyHR uses cookies and similar tracking technologies to help us operate and improve the platform. Cookies are small text files that are placed on computers, devices or browsers used to access websites, apps or other internet content.

We may use cookies or other tracking technologies for the purposes below.

to recognise your computer or device when you access MyHR, without requiring a login;
to measure traffic patterns, to determine which areas of MyHR have been visited, and to measure transaction patterns in the aggregate;
to research the habits and preferences of our users so we can improve MyHR;
to allow us to operate MyHR efficiently; or
to measure the effectiveness of our marketing activities.

You may be able to change the settings on the device that you use to access MyHR in order to reject or limit the use of such cookies or tracking technologies. But if you do so, it may reduce or limit the functionality of MyHR.

Some cookies are strictly necessary to operate MyHR. Others, such as analytics and marketing cookies, are optional, and where required by law we will ask for your consent before setting them. Some cookies may also be set by our third-party service providers and are governed by those providers’ own privacy policies.

AI and Modern Tools

Our position on AI

MyHR is a customer of AI technology, not a developer of large language models (LLMs). We do not build, train, or fine-tune our own LLMs. Where we use AI to deliver our Services, we do so by using established third-party AI providers.

Tools we use to deliver the Services

We use a range of technology tools, including AI-powered tools, to help us deliver MyHR’s Services to you. These fall into two categories.

AI features within the MyHR platform.

AI-powered features built into the MyHR platform itself (such as document generation and content assistance) are delivered through enterprise cloud infrastructure providers, currently Amazon Web Services. We do not interact directly with the underlying AI model providers (such as Anthropic or OpenAI) for these features. This means:

your data is processed within the same enterprise cloud environment as the rest of the MyHR platform;
the cloud infrastructure provider is contractually prohibited from using your data to train AI models or for any independent purpose; and
the underlying AI model providers do not directly receive or retain your data.

AI tools used by our team.

Our HR professionals and internal team also use AI-powered productivity tools (such as those provided by established AI vendors) to assist with drafting, summarising, analysing information, and producing reports. Where these tools process Customer Data:

the AI provider is contractually prohibited from using your data to train their own models or for any independent purpose;
the use is governed by our internal policies and our Security and Privacy Impact Assessment process;
our internal policies prohibit entering financial account numbers, individual tax identifiers (such as IRD numbers, SINs, or ABNs), or government-issued identification numbers into any AI tool;
outputs are reviewed by our authorised personnel before being actioned; and
the tools and providers we use are documented in our subprocessor list, available at knowledge.myhr.works/subprocessors.

Team experience and learning

Our HR professionals develop knowledge and experience through the work they do, and this informs the quality of advice we give to all customers. We do not share any individual customer's confidential or identifiable information with other customers.

Future changes to our AI position

If MyHR’s approach to AI changes, for example if we begin to develop, train, or fine-tune our own LLMs, or if we use Customer Data in ways not described in this Privacy Policy, we will:

update this Privacy Policy in advance of the change taking effect; and
notify affected customers at least 30 days before the change applies to them.

No automated decisions with legal effect

The AI tools we use do not make decisions that have legal or similarly significant effects on individuals without human review. Our HR professionals remain responsible for the advice and outputs we deliver.

Our Subprocessors and Third-Party Service Providers

We work with trusted third-party service providers to help us operate and deliver MyHR. These providers only process your data on our instructions and are subject to strict contractual data protection obligations.

Categories of third-party providers we use include:

cloud infrastructure providers (e.g. hosting, storage, and computing services);
payment processors (for billing and subscription management);
customer support and helpdesk tools;
analytics and performance monitoring tools;
email and communication platforms;
security and fraud prevention services; and
AI and machine learning service providers.

We may also use AI-assisted tools and technologies to support our internal operations, customer support, and service delivery. Where such tools may involve the processing of Personal Information, they are subject to appropriate contractual safeguards and technical controls designed to prevent customer data from being used for independent training or unrelated purposes. We will not sell your Personal Information to third parties.

A current list of our subprocessors is available at knowledge.myhr.works/subprocessors.

Marketing

We may use Personal Information and other data collected by us or via MyHR to send or email to you marketing or promotional information about our services or products, or the services or products of other companies (Direct Marketing Information). We will only send Direct Marketing Information where permitted under applicable law, including electronic messaging laws such as Canada’s Anti-Spam Legislation, on the basis of your express or implied consent.

If you have given us permission to send to you Direct Marketing Information, and you later decide that you do not want us to send you any further Direct Marketing Information, you can contact us at any time to request that we stop sending you such information. You can either contact our Privacy Team (see the details at the end of this Privacy Policy) or use the "Unsubscribe" facility at the bottom of any Direct Marketing Information email or communication that we send you.

Business acquisition

We may transfer your Personal Information and other data to another entity in connection with a sale of our business or assets, or a merger or consolidation or restructuring of our business or company, or any other transaction in which a third party acquires ownership of any rights in MyHR.

If we transfer any of your Personal Information and other data in such circumstances, we will ensure that such Personal Information and other data remain protected and that the recipient of that Personal Information and other data agrees to be bound by privacy practices and obligations that are consistent with our own under this Privacy Policy.

Disclosure of information to third-parties

We will not use your Personal Information and other data, or disclose your Personal Information and other data to third parties, except:

to the extent reasonably necessary to achieve any of the purposes described in this Privacy Policy;
where you or your organisation direct us to share data with a third-party service you have chosen to connect to MyHR (such as a payroll provider), in which case that provider handles the data under its own terms and privacy policy; or
where we reasonably believe that such use or disclosure is required or expressly permitted under any applicable law.

Holding Personal Information

We will not hold your Personal Information and other data for longer than is reasonably required for the purposes for which we may lawfully use that Personal Information or data.

Personal Information or data may be held for longer periods where extended retention periods are required by law or regulation, or are necessary to enable us to enforce or defend our legal rights.

We may retain data about how our Services are used, in anonymised or aggregated form, and may continue to do so after a Customer's subscription ends for operational, analytical, security, and product improvement purposes. This includes HR service delivery analytics, platform usage, feature adoption, service categories, and operational performance.

Security

We take the security of your data seriously. We implement and maintain appropriate technical and organisational security measures to protect your Personal Information against unauthorised access, loss, misuse, disclosure, alteration, or destruction.

Our security best practices include encryption at rest and in transit, access controls, regular security assessments, employee training, and incident response procedures. Where we hold more sensitive Personal Information, such as tax identifiers, banking details, or health-related information, we apply safeguards appropriate to its sensitivity.

If a data breach affecting your Personal Information occurs, we will assess it against the notification thresholds under the privacy law that applies to you, and where that threshold is met we will notify affected individuals and the relevant regulatory authority as required under that law. We will also:

take prompt steps to contain the breach and mitigate any harm; and
provide you with clear information about what happened, what data was affected, and what we are doing about it.

If you have any questions about a data breach or how we handle one, please contact our Privacy Team using the details below.

Transfer of Information

We may transfer the information described in this Privacy Policy to or from other countries where necessary to enable us to operate MyHR, and to supply any other products or services ordered by you.

If you are New Zealand-based and we transfer your Personal Information outside New Zealand, we will ensure that appropriate safeguards are in place with the recipient of that Personal Information, as prescribed by the Privacy Act 2020 (NZ), before we transfer that Personal Information.

If you are Australia-based and we transfer your Personal Information outside Australia, we will take such steps as are prescribed by the Australian Privacy Principles in relation to that Personal Information.

If you are Canada-based, your Personal Information may be stored or accessed outside Canada, including in New Zealand, Australia, and the United States, where we and our service providers operate. It may therefore be subject to the laws of those countries, including lawful access by foreign authorities. We take reasonable steps to ensure it stays protected to a comparable standard. You can see who processes data on our behalf in our subprocessor list (available at knowledge.myhr.works/subprocessors).

Use of third-party websites

If you access any third-party websites via a link from MyHR, you will leave MyHR. By accessing these links you are not covered by the policies relating to MyHR. We are not responsible for the content of any third-party websites, or their use of your Personal Information or other data.

Your rights to access, correct and have deleted Personal Information

You may request access to any Personal Information we hold about you. You may also request that we correct the Personal Information we hold about you, and that we delete it where we are required or able to do so under applicable law.

All access, correction or deletion requests will be dealt with in accordance with applicable law, including the Privacy Act 2020 (NZ), the Privacy Act 1988 (Australia), and the Personal Information Protection and Electronic Documents Act (Canada).

Where we rely on your consent to collect, use or disclose your Personal Information, you may withdraw that consent at any time by contacting our Privacy Team, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we may no longer be able to provide you with some or all of the MyHR services. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.

Where you access MyHR through your employer, your employer determines how your Personal Information is collected, used and retained. Any request to access, correct or delete that Personal Information, or to withdraw consent, should be directed to your employer, and we will act on your employer’s instructions in accordance with our agreement with them.

To make an access, correction or deletion request, please contact our Privacy Team (see below). If you make a request, we may ask you to verify your identity.

Privacy Team

For any queries or further information about our Privacy Policy, or about our privacy or data practices, please contact our Privacy Team. Our Privacy Team is led by our designated Privacy Officer, who is accountable for MyHR’s compliance with applicable privacy laws. The contact details are:

MyHR Privacy Team
privacy@myhr.works

Unit 4, 485c Rosebank Road
Avondale, Auckland 1026
New Zealand

If you are based in Canada, you may also direct your privacy queries and requests, including any questions about the storage or processing of your Personal Information outside Canada, to:

Julie Morris
MyHR Platform Canada Limited
108 - 1870 Dowad Avenue
Squamish, British Columbia, V8B 1C4, Canada

Amendments to the Privacy Policy

We may change this Privacy Policy at any time, by changing or removing existing terms or adding new ones, or by replacing this Privacy Policy with a new one.

We will take reasonable steps to notify MyHR users and customers of any changes to this Privacy Policy. Any such changes will take effect immediately, unless we state otherwise.

Your continued use of MyHR after any such notice will constitute your acceptance of any amendments or revisions to this Privacy Policy.

You should periodically review this Privacy Policy for the latest information about our privacy practices.