Privacy Notice

This notice explains how JN Horizon Ltd uses personal data in connection with JN Tempo and its website, and what rights you have.

1. Who we are

JN Tempo is provided by JN Horizon Ltd, a company registered in England and Wales with company number 17355355. Our registered office is Suite 395, 25 Dorset House, Duke Street, Chelmsford, CM1 1TB, United Kingdom.

For privacy questions, requests and complaints, email [email protected].

JN Horizon Ltd is registered with the Information Commissioner's Office under reference ZC296139.

We have not appointed a Data Protection Officer. Our processing does not involve large-scale regular and systematic monitoring of people, or large-scale processing of special category or criminal offence data, which is when the law requires one. We will review this as JN Tempo grows.

2. Our two roles

When we decide how and why data is used, we are a controller. This covers:

• registering a business and setting up its account;
• running the free trial and subscriptions, and billing;
• emails we send about the account, the trial and billing;
• keeping the service and website secure and preventing misuse;
• support requests and other enquiries to us;
• marketing emails, only where someone has opted in;
• records of who accepted our Terms and when.

This notice explains that processing.

When a customer organisation uses JN Tempo to manage its contractors, we are its processor. The organisation (for example a recruitment agency) decides what information to record about its staff, contractors and clients, and why. We process that information only on its instructions, under our Data Processing Agreement.

If you are a contractor, manager or other user invited by an organisation, that organisation is responsible for its use of your data. Its own privacy notice should explain this, and you should contact it first about your data. If you contact us instead, we will pass your request to the organisation where we can identify it, and tell you we have done so.

3. Information we use as a controller

When a business registers:

• the registering person's name, work email address and chosen username;
• the organisation's name, phone number, address and (optional) company registration number;
• the person's password, which is handled by our authentication provider (Supabase) and stored only as a one-way hash that we cannot read;
• the person's choice about marketing emails, with the wording shown;
• a record of their acceptance of the Terms and acknowledgement of this notice (see section 4).

Trial eligibility. To give each business one free trial, we keep a one-way hash of the normalised verified email address and, if given, of the company registration number. We do not keep the original values in this record.

Billing. Our payment provider Stripe collects card details on its own pages. We do not see or store full card numbers. We receive and keep the Stripe customer and subscription identifiers, plan, status, dates and amounts, and Stripe's notifications about payments.

Service emails. The emails we send about the account (for example email verification, welcome, trial reminders and payment notices to Admins), and their delivery status as reported by our email provider. Emails sent for an organisation's own workflows, such as invitations, approval notifications and contractor billing reminders, are part of our processing for that organisation (section 6).

Security and misuse prevention. When you use the website or the app, your IP address and request details pass through our network and hosting providers (Cloudflare and Railway). To limit repeated sign-in and registration attempts, we store a keyed one-way hash of the IP address or email address with a counter, normally deleted after one day. Our providers also keep technical logs.

Support and enquiries. What you tell us when you email us.

Your device. The sign-in session and display preferences stored in your browser are described in our Cookie Policy. We do not use analytics or advertising cookies, and we do not track you across other websites.

4. Records of acceptance

When a business registers, we record:

• the account and organisation they relate to;
• the exact versions of the Terms, Data Processing Agreement and Privacy Notice shown, and a fingerprint (hash) that identifies each document's exact text;
• the wording of the box the person ticked;
• the time our server received the registration and the time the record was created after the email was verified.

We do not record the IP address, browser or device for this purpose. The record cannot be changed after it is created. Ticking the box to say you have read this notice is an acknowledgement, not consent: we do not rely on consent for the processing described here, except for marketing emails.

5. Why we use it and our lawful bases

• Setting up and running the customer's account, the trial and the subscription. Performance of a contract, where the customer is an individual (such as a sole trader). Otherwise, our legitimate interests in providing the service the business has asked for.
• Billing, accounting and tax records. Performance of a contract and our legal obligations.
• Service emails about the account, trial, security and billing. Performance of a contract or our legitimate interests in operating the service. These are not marketing.
• One trial per business. Our legitimate interests in preventing the free trial from being misused.
• Security, rate limiting and preventing misuse. Our legitimate interests in protecting the service, our customers and their data.
• Records of acceptance. Our legitimate interests in being able to show what was agreed, and in establishing or defending legal claims.
• Support and enquiries. Our legitimate interests in responding to you.
• Marketing emails. Your consent. You can withdraw it at any time using the unsubscribe link or by emailing us. Marketing emails are sent only to people who opted in.
• Complying with the law, and with requests from regulators, courts and law enforcement where we must. Legal obligation.

Where we rely on legitimate interests, we have considered whether they are outweighed by your interests and rights. You can ask us for more information about this balance.

We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. The trial eligibility check is automated: if a business has already had a trial, a new organisation is created without one. If you think this is wrong, email us and a person will review it.

6. Information we process for customer organisations

As a processor, we hold the information that customer organisations and their users put into JN Tempo. Depending on how an organisation uses it, this can include:

• names, email addresses, usernames, roles and profile details (preferred name, phone number, town, region, country and work arrangement);
• timesheets, expenses, receipt files, approvals and rejections;
• clock-in and clock-out times and correction requests (JN Tempo does not record location);
• placements, clients, pay and charge rates, and purchase orders and their documents;
• onboarding answers and files, including photos;
• engagement type, payment arrangement and IR35 status as recorded by the organisation;
• notes written by the organisation's staff;
• billing schedules, billing runs, reminders and recorded payment statuses;
• invitations, audit records, saved views, report templates and exports.

JN Tempo does not currently store contractor bank details, and its AI features are switched off.

The organisation decides what is recorded and how long it is kept, within our Data Processing Agreement.

7. Who we share personal data with

• Our service providers (subprocessors), who host and run JN Tempo for us: Supabase (database, authentication and file storage), Railway (application hosting), Cloudflare (network, security and delivery), Resend (email delivery), Stripe (payments) and Google Workspace (our support mailbox), and Vercel (which redirects the old address of JN Tempo to the current site). The subprocessors page lists what each one does and where. They may use personal data only on our instructions.
• Stripe also acts as a controller for some of the data it collects, for example to meet its own legal obligations and to prevent fraud. Stripe's privacy notice explains this.
• Professional advisers, such as accountants and lawyers, where needed.
• Regulators, courts, law enforcement and other public bodies, where the law requires it or it is necessary to establish, exercise or defend legal claims.
• A buyer or successor, if our business or JN Tempo is sold or reorganised, under confidentiality obligations.

We do not sell personal data.

8. International transfers

Our database, authentication and file storage are hosted by Supabase in London, United Kingdom. The application runs on Railway in its EU West region (the Netherlands). Some providers are based in, or may access data from, the United States and other countries. This includes Cloudflare's global network, Stripe, Resend (which stores email data in the United States), Google (our support mailbox), Vercel (visits to the old address), and the support and engineering staff of our hosting providers.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including for the European Economic Area, and for US organisations certified under the UK Extension to the EU-US Data Privacy Framework), or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses included in the provider's data processing terms. Our subprocessors page shows the safeguard for each provider. You can ask us for more information about these safeguards.

9. How long we keep it

• Account and organisation registration details: while the organisation's account exists. When the organisation's access ends and is not restored, they are deleted with its Customer Data, as set out in the Terms (clause 15.5).
• Registrations that are never verified: if the email address used to register a business is never verified, the registration and the sign-in account it created are deleted 7 days after the last registration attempt. This never affects an existing account, an invitation or a completed registration.
• Billing and payment records (including the Stripe identifiers, plan and dates kept when an organisation is deleted): 6 years from the end of the financial year (31 July) in which the organisation's access ended or the payment record was received, for accounting and tax purposes.
• Records of acceptance: for as long as the customer's contract lasts, and 6 years after it ends.
• Trial eligibility hashes: 3 years from the start of the trial.
• Marketing choices (each opt-in and unsubscribe, with the wording shown): while your account exists, and for 2 years after it is deleted, so that we can show what you chose. We send marketing emails only to people with an account whose latest choice was to opt in.
• Records of deletions (which organisation's data was deleted, when, and how many records and files, without names or contents): 7 years.
• Support emails: kept in our Google Workspace mailbox and deleted 2 years after the enquiry is resolved.
• Rate-limiting hashes: normally deleted after one day.
• Database exports we make as backups: kept while they may be needed to recover the service or to check a database change. We have not yet set a fixed period after which they are deleted; when we do, we will publish it in this notice.
• Technical logs kept by our providers (these can include IP addresses, email addresses and request details):
• Supabase: 1 day for API and database logs.
• Railway: 7 days (Hobby plan).
• Resend: 30 days for email content, delivery records and logs, with Resend's own backups kept for a further 7 days.
• Vercel (redirect from the old address only): 1 hour for request logs (Hobby plan).
• Cloudflare does not publish a fixed period for the request data it keeps to secure its network. Its privacy policy says it keeps personal data only for as long as its purposes require.

We delete the records listed above that are held in our database when their periods end. Provider logs are deleted by the providers. Information may be kept longer where the law requires it or where we need it for a legal claim, a dispute or a regulator's request; when that applies to an organisation, we keep its records until the matter is resolved.

Customer Data processed for organisations is kept and deleted as described in the Terms and the Data Processing Agreement.

10. Security

We use technical and organisational measures appropriate to the risk. They include encryption in transit, separation of each organisation's data in the database, role-based access, and restricted access to production systems. They are described in Schedule 2 of the Data Processing Agreement. No system is completely secure, and we cannot guarantee that a security incident will never happen. If one affects your personal data, we will act as the law requires.

11. Your rights

You have the right to:

• ask for a copy of your personal data;
• ask us to correct inaccurate data or complete incomplete data;
• ask us to delete your data;
• ask us to restrict how we use your data;
• object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
• receive data you gave us in a portable format, where the law provides for it;
• withdraw consent at any time, where we rely on consent (this does not affect anything done before you withdraw).

Some rights depend on the lawful basis and have exceptions. To make a request, email [email protected]. We may need to confirm your identity. We will respond within one month, or tell you within that month if we need up to two more months because the request is complex or one of several.

For data held for a customer organisation (section 6), please contact that organisation. We will help it respond.

12. Complaints

If you are unhappy with how we have used your personal data, please complain to us first at [email protected]. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, or call 0303 123 1113.

13. Children

JN Tempo is a business service. It is not intended for anyone under 18.

14. Changes to this notice

We will update this notice when our practices change. Each version is published with its version number and date, and earlier versions stay available in the archive of earlier versions. If we make a significant change, we will tell customer Admins by email or in JN Tempo.