Privacy Policy
Last updated: 20 October 2026
1. Who we are
Newployee is an onboarding and offboarding platform operated by Newployee OÜ, a private limited company registered in Estonia (registry code 17073210), Viru väljak 2, 10111 Tallinn, Estonia ("Newployee", "we"). You can reach us about privacy at hello@newployee.com.
2. Our two roles
- For our customers' employee data, we act on the customer's behalf (a "data processor" under GDPR). The company that uses Newployee decides what to collect about its employees and why; it is the "data controller". If you are an employee, questions about your data should go to your employer first; we will help them answer.
- For people who sign up for, buy or contact Newployee, we are the data controller.
3. What we store
- Identity and work details: name, employee number, work and personal email, work and personal phone, photo, gender (optional), hire date, department, team, location, job title, seniority, manager, and preferred language.
- Onboarding and offboarding: journeys, their dates and the people assigned to them, actions and their status, comments, and attached files.
- Survey answers: answers to surveys your employer sends. Anonymous surveys show results only as a group, and only once enough people have answered. Unfinished answers are saved encrypted.
- Sign-in and security: a password stored only as a salted hash (we never store your password itself), two-step login settings stored encrypted, recovery codes stored as hashes, and active sessions with the IP address and browser they were started from.
- Activity records: an audit log of security-relevant changes (who changed what, and when) and in-app notifications.
- Integration settings: connection details for tools your employer connects, such as Slack, Microsoft Teams, PandaDoc or a company directory (LDAP). Secret keys are stored encrypted where the integration allows.
We do not use your data for advertising, we do not sell it, and the app has no advertising or tracking tools.
4. Why we use it
- To run the service for your employer: plan and track onboarding and offboarding, send reminders and surveys, and show reports. (On your employer's instructions; for our own customers, to perform our contract.)
- To keep accounts secure: sign-in, two-step login, checking new passwords against known data breaches, and audit records. (Legitimate interest and legal obligations.)
- To send emails the service needs, such as invitations, password resets and reminders.
- To provide optional AI features when your employer turns them on (see section 5).
5. Who helps us run Newployee
We use a small number of carefully chosen service providers. Each may use personal data only to provide its service to us, under a written agreement that includes data protection terms.
| Type of service | What it receives | Where |
|---|---|---|
| Hosting of the app and database | The data described in section 3 | EU |
| File storage | Files and photos you upload | EU |
| Email delivery | Recipient name and email, and the email content | EU |
| Optional AI features, only if your employer turns them on | Action titles, job titles and template text used to draft actions | USA |
| "Sign in with Google / Microsoft", if you choose it | Confirmation of your identity and email | The provider you choose |
| Tools your employer connects (such as chat or document signing) | What that tool needs, such as names, emails and messages | The tool your employer chooses |
| A password safety check against known data breaches | Only the first 5 characters of a scrambled (hashed) form of a new password, never the password | Global |
Customers can ask for the current list of these providers by name at hello@newployee.com.
6. Transfers outside the EU
Newployee is based in the European Union, and our core hosting is in the EU. A few services are outside the European Economic Area (the optional AI features, used only when your employer turns them on, run in the USA). For those, we rely on the safeguards GDPR requires: the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguards at hello@newployee.com.
7. Cookies and browser storage
Newployee uses only what it needs to work. There are no advertising or analytics cookies.
- Sign-in cookies: keep you signed in securely and protect against forged requests.
- Browser storage: remembers your language, theme, list and grid views, recent searches and setup progress, on your device only.
8. How long we keep data
- Employee and journey data: for as long as your employer uses Newployee, then deleted within 90 days after the contract ends, unless the law requires longer.
- Signed-in sessions: 30 days of inactivity.
- Unfinished survey answers: 30 days.
- Audit log: 2 years, to investigate security issues.
- AI request records: 90 days.
9. Your rights
Under GDPR you can ask to see, correct, delete or export your data, object to its use, and complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). If your employer uses Newployee, send your request to them; we help them answer it. Otherwise write to hello@newployee.com. We answer within 30 days. Requests to delete a person's data are currently handled by our team on request.
10. Security
Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Secrets and two-step login keys are encrypted. Access inside a workspace follows access levels. Every security-relevant change is recorded in a log that cannot be edited.
11. Changes
We will tell workspace admins in the app or by email at least 30 days before material changes take effect.
