Human resource information system

All products [https://timastra.com/products] / Timastra HRIS [https://timastra.com/products/payroll] / Privacy

Timastra HRIS: Privacy

Updated October 4, 2026

Read or download the October 4, 2026 legal documents [https://timastra.com/legal/releases/2026-10-04/index.html]. The dated archive preserves this release; your order or acceptance record identifies the documents that apply to you.

Overview [https://timastra.com/products/payroll]Privacy [https://timastra.com/legal/releases/2026-10-04/documents/products-payroll-privacy.html]Terms [https://timastra.com/legal/releases/2026-10-04/documents/products-payroll-terms.html]Support [https://timastra.com/products/payroll/support]Account & data deletion [https://timastra.com/legal/releases/2026-10-04/documents/products-payroll-delete-account.html]Billing & refunds [https://timastra.com/legal/releases/2026-10-04/documents/products-payroll-billing.html]

On this page

Scope [#privacy-scope]

Who controls your data [#privacy-roles]

Information the product handles [#privacy-information]

Purpose [#privacy-purpose]

Providers, permissions and sharing [#privacy-providers]

Retention and deletion [#privacy-retention]

Your requests [#privacy-requests]

Scope

This privacy information is specific to Timastra HRIS, which Timastra LLC provides and is responsible for. The website and account privacy policy [https://timastra.com/legal/releases/2026-10-04/documents/privacy.html] separately covers visits to timastra.com, central sign-in, hosted purchase information and correspondence with Timastra LLC.

Who controls your data

For workspace data that a customer uploads or connects, the customer is the controller and Timastra LLC processes that data on the customer's instructions. Timastra LLC is responsible for the account, billing and support information it needs to run the service. Our data processing agreement [https://timastra.com/legal/releases/2026-10-04/documents/dpa.html], which forms part of the service agreement, and our sub-processor list [https://timastra.com/legal/releases/2026-10-04/documents/subprocessors.html] describe how we process that data; email support@timastra.com [mailto:support@timastra.com?subject=Timastra%20HRIS%3A%20DPA%20and%20sub-processor%20request] for a countersigned copy.

Information the product handles

User identities, organization membership, roles, sessions, MFA and recovery records

Employee contact details, employment history, pay rates, government identifiers, attendance, leave, loans and advances

Payroll earnings, deductions, contribution bases, withholding, payslips, approvals and correction history

Internal agency worksheets, submission and payment evidence, reconciliation records, support requests, billing references and audit events

Purpose

Maintain employee records, attendance and leave, provide linked employee self-service, import reviewed payroll inputs, prepare payroll, calculate supported contribution and withholding cases, issue payslips, enforce independent approval, compare parallel runs, and retain evidence for employer-led filing, payment and reconciliation work.

Providers, permissions and sharing

HRIS supports signed-in employer workspaces with multi-factor authentication, encrypted database storage, virus-checked uploads of agency payment receipts, subscription records, and optional billing, payout and accounting connections. It does not submit filings or payments to SSS, PhilHealth, Pag-IBIG or BIR. Any provider or agency connection must be separately configured, authorized and verified before use.

Timastra HRIS runs on a server Timastra rents from netcup in Singapore, behind Cloudflare. Service email is sent through Resend from its Tokyo region, subscriptions are billed through Paddle, and encrypted backups are stored in Cloudflare R2. The sub-processor list [https://timastra.com/legal/releases/2026-10-04/documents/subprocessors.html] names each provider, its purpose and location. Optional connections are identified before use.

Retention and deletion

Employer payroll records, support correspondence and billing events may follow different retention schedules and legal exceptions. Backup and offsite copies follow separate schedules, documented holds and the expiry stated in the deletion response. Before uploading workspace data, request the applicable processing and retention schedule. It must identify the export or return window when service ends, the live-data removal date, the expiry of each backup, recovery and operator copy, and any retained category's purpose, authority and review or expiry date. A backup rotation or subscription cancellation alone does not establish those deadlines. The customer chooses return or deletion at the end of the service, subject to documented legal retention obligations; recovery must reconcile completed deletion requests before records are used again.

Removing a user or employee login is different from deleting an employer workspace or payroll history. Approved payroll, payslips, statutory preparation records, payment evidence and audit events may need to remain for the employer's recordkeeping obligations. Identify the employer, account and records concerned so support can review access removal and data deletion separately.

Hosted data is backed up daily to encrypted storage. The standard managed rotation selects 14 daily, 4 weekly and 3 monthly copies. Protected release snapshots, legacy backups, provider recovery history and operator copies have separate schedules; rotation alone is not a guaranteed expiry date. Your deletion response identifies affected copies, documented holds and expected expiry. Recovery must reconcile completed deletion requests before reopening access.

Your requests

For access, correction, deletion or questions about processing, email support@timastra.com [mailto:support@timastra.com?subject=Timastra%20HRIS%3A%20Privacy%20request]. Identify the relevant organization if applicable. We answer within one month, extendable where the law allows. Available rights and exceptions depend on the circumstances and applicable law; see the legal bases [https://timastra.com/legal/releases/2026-10-04/documents/privacy.html#legal-bases], international transfers [https://timastra.com/legal/releases/2026-10-04/documents/privacy.html#international-transfers] and your rights [https://timastra.com/legal/releases/2026-10-04/documents/privacy.html#your-rights] sections of the website privacy policy.

Request account or data deletion [https://timastra.com/legal/releases/2026-10-04/documents/products-payroll-delete-account.html]