Legal
Together, these pages outline the rules for using our services and set expectations for a safe, fair, and accessible experience for all users. Please read them carefully before proceeding.
1.1 Definitions
“Agreement” means these Terms of Service together with the Order, the Data Processing Addendum (Schedule 1), and any Order Form.
“Confidential Information” means any non-public information disclosed by one party to the other in connection with this Agreement, whether or not marked as confidential, that would reasonably be understood to be confidential given its nature or the circumstances of disclosure, including Customer Data, pricing, and technical or business information.
“Customer” or “you” means the business entity that subscribes to the Service.
“Customer Data” means all payroll, employee, and HR data submitted to or processed within the Service by or on behalf of the Customer.
“Dynamics 365 Business Central” or “BC” means the Microsoft Dynamics 365 Business Central environment into which the Service is installed.
“HMRC Submissions” means Real Time Information (RTI) submissions, including EPS, FPS, P6, P9, Student Loan notices, P11D and P11D(b), made via HMRC’s secure gateway.
“Order” means the online subscription order, Microsoft AppSource listing order, or signed order form under which the Customer subscribes to the Service.
“Service” or “Qnipay” means the payroll software-as-a-service provided by the Supplier, including the Qnipay core module, QniConnect (employee self-service portal), Qnipay Intelligent (AI automation add-on), and QniWorkforce (enterprise workforce module), as applicable to the Customer’s subscription tier.
“Subscription Fees” means the recurring per-employee fees set out in clause 1.5.
“Supplier”, “we”, “us” or “our” means Qnipay Limited, a company registered under company number 16976533 whose registered office is at Shakespeare Barn Main Street, Grendon Underwood, Aylesbury, England, HP18 0ST.
1.2 The Service
1.2.1 The Supplier provides Qnipay as a subscription payroll service that operates natively within the Customer’s Microsoft Dynamics 365 Business Central environment, or is connected via API to Dynamics 365 Human Resources, Dynamics 365 Finance & Operations, or another HR platform nominated by the Customer.
1.2.2 The Service includes statutory payroll calculation, RTI and HMRC Submissions, generation of BACS-format payment files (which are configurable to the Customer’s chosen bank format, and which the Customer exports from the Service and submits directly via its own bank’s portal), G/L posting to the Customer’s chart of accounts, and standard payroll reporting, as further described in the applicable Order.
1.2.3 The Supplier is an HMRC-recognised payroll software provider. Recognition relates to the software’s technical compliance with HMRC’s specifications; it does not make the Supplier responsible for the accuracy of data input by the Customer, nor for the Customer’s own statutory or regulatory compliance as an employer.
1.2.4 The Service is distributed via Microsoft AppSource. Use of the Service is additionally subject to Microsoft’s Commercial Marketplace Terms of Use and any applicable Microsoft AppSource publisher policies, to the extent they apply to the Customer as an end user of a marketplace-listed application.
1.2.5 Qnipay Intelligent is an AI assistant built into the Service to support certain payroll tasks. It is designed to assist, not replace, human review, and is not used to make decisions producing legal effects or similarly significant effects on an employee within the meaning of Article 22 UK GDPR without meaningful human involvement. It runs entirely on the Supplier’s own infrastructure; no third-party AI vendor is engaged as a sub-processor of Customer Data.
1.3 Accounts and Eligibility
1.3.1 The Customer must hold a valid Microsoft Dynamics 365 Business Central (or other applicable Microsoft) licence to use the Service.
1.3.2 The Customer is responsible for all activity under its account, for maintaining the confidentiality of login credentials, and for ensuring only authorised personnel have access to the Service.
1.4 Customer Data and Responsibilities
1.4.1 The Customer warrants that it has the legal right to submit all Customer Data to the Service, including all necessary consents, notices, and lawful bases required under applicable data protection law to process its employees’ personal data for payroll purposes.
1.4.2 The Customer is solely responsible for the accuracy and completeness of data entered into the Service, including employee records, pay elements, tax codes, and statutory declarations. The Supplier is not liable for errors in HMRC Submissions arising from inaccurate or incomplete Customer Data.
1.4.3 As between the parties, in respect of employee personal data processed through the Service, the Customer is the data controller and the Supplier is the data processor, on the terms set out in the Data Processing Addendum at Schedule 1 (see also the Privacy Policy at Part 2).
1.5 Subscription Fees and Payment
1.5.1 Fees are charged per employee per month at the rates set out in the Order or as published on qnipay.com/#pricing at the time of subscription, currently: Qnipay (£1.00/employee/month), Support (£0.20/employee/month), and QniConnect (£0.50/employee/month), each exclusive of VAT and any other applicable taxes.
1.5.2 Fees for Qnipay Intelligent and QniWorkforce are quoted individually and set out in the applicable Order.
1.5.3 Fees are billed monthly in advance based on the number of active employee records in the Customer’s payroll for that billing period, and are payable within 30 days of invoice unless otherwise agreed in the Order.
1.5.4 The Supplier may increase Subscription Fees on no less than 60 days’ written notice, to take effect no earlier than the Customer’s next annual renewal.
1.5.5 Save as required by law, Subscription Fees are non-refundable.
1.6 Support
1.6.1 Standard support is included with all subscriptions. Customers subscribed to Support receive 24/7 access to payroll specialists as described on the Supplier’s website; other Customers receive support during the Supplier’s standard business hours as published at qnipay.com/support/.
1.7 Data Hosting and Security
1.7.1 Customer Data processed through the Service is hosted on Microsoft Azure infrastructure. The Supplier maintains encryption in transit and at rest consistent with the security description published on the Supplier’s website, and maintains an audit trail of payroll processing activity.
1.7.2 The Supplier will maintain appropriate technical and organisational measures proportionate to the sensitivity of Customer Data, as further described in the Data Processing Addendum (Schedule 1).
1.7.3 The Supplier maintains professional indemnity insurance and cyber insurance in amounts proportionate to the sensitivity of the Customer Data processed under this Agreement, and will provide evidence of cover on reasonable request.
1.8 Intellectual Property
1.8.1 All intellectual property rights in the Service, including the Qnipay software, documentation, and underlying technology, are and remain the property of the Supplier or its licensors (including Microsoft, in respect of the Dynamics 365 platform).
1.8.2 The Supplier grants the Customer a non-exclusive, non-transferable licence to use the Service for the Customer’s own internal payroll purposes for the subscription term, subject to payment of Subscription Fees.
1.8.3 The Customer retains all rights in Customer Data. Nothing in this Agreement transfers ownership of Customer Data to the Supplier.
1.8.4 The Supplier will defend the Customer against any third-party claim that the Service, as provided by the Supplier and used in accordance with this Agreement, infringes that third party’s intellectual property rights, and will indemnify the Customer against damages finally awarded as a result, provided the Customer promptly notifies the Supplier of the claim and gives the Supplier control of its defence. This indemnity does not extend to claims arising from the Customer’s own data, modifications not made by the Supplier, or use of the Service otherwise than as permitted under this Agreement.
1.9 Confidentiality
1.9.1 Each party shall keep the other’s Confidential Information confidential and shall use it only for the purposes of this Agreement.
1.9.2 The obligation in clause 1.9.1 does not apply to information that: (a) is or becomes public other than through breach of this Agreement; (b) was already lawfully known to the receiving party without any obligation of confidence before disclosure; (c) is independently developed by the receiving party without reference to the disclosing party’s Confidential Information; or (d) is required to be disclosed by law or by a regulatory or governmental authority (including HMRC), provided that, where lawful and practicable, the receiving party gives the disclosing party reasonable notice before disclosure.
1.10 Warranties and Disclaimers
1.10.1 The Supplier warrants that the Service will materially conform to its published description and will be provided with reasonable care and skill.
1.10.2 The Supplier does not warrant that the Service will be uninterrupted or error-free, or that HMRC Submissions will always be accepted without query, though the Supplier will act promptly to resolve any submission failures caused by the Service itself.
1.10.3 Except as expressly set out in this Agreement, all warranties, conditions, and other terms implied by statute or common law are excluded to the fullest extent permitted by law.
1.10.4 Any specific uptime, response-time, or other service-level commitments applicable to the Customer’s subscription are those set out in the applicable Order. Where no Order specifies such commitments, descriptions published on the Supplier’s website are indicative only and do not form part of this Agreement; the Supplier will give reasonable advance notice of any material reduction in standard support hours.
1.11 Limitation of Liability
1.11.1 Nothing in this Agreement limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be limited or excluded.
1.11.2 Subject to clause 1.11.1, neither party’s aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), or otherwise, shall exceed the total Subscription Fees paid by the Customer in the 12 months preceding the event giving rise to the claim.
1.11.3 Subject to clause 1.11.1, neither party shall be liable for indirect or consequential loss, loss of profits, loss of business, or loss of goodwill.
1.12 Term, Suspension and Termination
1.12.1 This Agreement commences on the Order date and continues for the initial term set out in the Order, renewing automatically for successive periods of the same length unless either party gives at least 60 days’ written notice of non-renewal.
1.12.2 Either party may terminate this Agreement immediately on written notice if the other party commits a material breach that is not remedied within 21 days of written notice, or becomes insolvent.
1.12.3 The Supplier may suspend the Service where the Customer fails to pay undisputed Fees within 21 days of the due date, having given at least 7 days’ prior written notice of intended suspension.
1.12.4 On termination for any reason, the Supplier will make Customer Data available for export in a standard format for a period of 30 days, after which it may be deleted in accordance with the Supplier’s data retention schedule (see Privacy Policy, Part 2).
1.13 Force Majeure
1.13.1 Neither party is liable for delay or failure to perform caused by circumstances beyond its reasonable control, including failures of Microsoft Azure, Microsoft Dynamics 365, or HMRC’s own systems, provided the affected party notifies the other promptly and uses reasonable efforts to mitigate.
1.14 General
1.14.1 Assignment — Neither party may assign this Agreement without the other’s prior written consent, except that the Supplier may assign it in connection with a merger, acquisition, or sale of substantially all its assets.
1.14.2 Entire Agreement — This Agreement, together with the Order and Schedule 1, constitutes the entire agreement between the parties in relation to its subject matter.
1.14.3 Severability — If any provision of this Agreement is found unenforceable, the remaining provisions continue in full force.
1.14.4 Governing Law — This Agreement is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
1.14.5 Notices — Notices under this Agreement must be in writing and sent by email to the addresses specified in the Order, or to support@qnipay.com in the case of notices to the Supplier. All notices and enquiries, including data protection questions, and cookie questions, should be sent to support@qnipay.com.
1.14.6 Waiver — No failure or delay by either party in exercising any right under this Agreement operates as a waiver of that right, nor does any single or partial exercise of a right preclude any other or further exercise of it.
1.14.7 Third Party Rights — A person who is not a party to this Agreement has no right to enforce any term of it under the Contracts (Rights of Third Parties) Act 1999.
1.14.8 Subcontracting — The Supplier may subcontract the performance of its obligations under this Agreement, other than the processing of Customer Data by a sub-processor (which is governed exclusively by Schedule 1), provided the Supplier remains responsible for the acts and omissions of its subcontractors as if they were its own.
1.15 Schedule 1 — Data Processing Addendum (Article 28(3) UK GDPR)
1.15.1 Subject Matter and Duration — This Schedule 1 sets out the terms on which the Supplier processes Customer Data as a processor on behalf of the Customer, for the duration of this Agreement.
1.15.2 Nature and Purpose of Processing — The Supplier processes Customer Data for the purpose of providing the Service, being payroll processing for the Customer’s employees, including the processing activities described in clause 1.2.
1.15.3 Categories of Data Subjects and Personal Data — The categories of data subjects are the Customer’s current and former employees. The categories of personal data are name, National Insurance number, tax code, bank details, salary and pay data, and, where applicable, benefit-in-kind and P11D data.
1.15.4 Processing on Instructions — The Supplier shall process Customer Data only on the Customer’s documented instructions, including in respect of transfers of personal data to a country outside the UK, unless required to do otherwise by UK law, in which case the Supplier shall inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
1.15.5 Staff Confidentiality — The Supplier shall ensure that all personnel authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
1.15.6 Security Measures — The Supplier shall implement appropriate technical and organisational measures aligned to Article 32 UK GDPR, including encryption of Customer Data at rest and in transit, access controls limiting access to authorised personnel, maintenance of an audit trail of processing activity, and appropriate backup and disaster recovery arrangements.
1.15.7 Sub-processors — The Supplier may engage sub-processors to process Customer Data, currently comprising: Microsoft (Azure infrastructure hosting and the Dynamics 365 Business Central platform) and HMRC (as recipient of statutory submissions, not a sub-processor in the conventional sense). BACS payment files are generated by the Service in the Customer’s chosen bank format for the Customer to export and submit directly through its own bank’s portal; the Supplier does not transmit payment files to any bank or BACS processor on the Customer’s behalf, and no banking or BACS-processing sub-processor is engaged for this purpose. The Supplier shall impose data protection obligations on any sub-processor that are no less protective of Customer Data than those set out in this Schedule 1. The Supplier shall give the Customer at least 30 days’ advance notice of any intended addition or replacement of a sub-processor, and the Customer may object on reasonable data-protection grounds within 14 days of that notice; if the parties cannot resolve the objection, either party may treat it as grounds to terminate the affected part of the Service.
1.15.8 Assistance to the Customer — The Supplier shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, with the Customer’s obligation to respond to requests for exercising data subjects’ rights, and with the Customer’s obligations under Articles 32 to 36 UK GDPR, including security of processing, breach notification, and data protection impact assessments.
1.15.9 Personal Data Breach — The Supplier shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and shall provide reasonably requested information to assist the Customer in meeting its own breach-notification obligations.
1.15.10 Return or Deletion of Data — On termination of this Agreement, the Supplier shall, at the Customer’s choice, delete or return all Customer Data and delete existing copies, in accordance with clause 1.12.4, unless UK law requires continued storage.
1.15.11 Audit and Compliance — The Supplier shall make available to the Customer all information reasonably necessary to demonstrate compliance with this Schedule 1, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable prior notice and subject to reasonable confidentiality and frequency limitations.
1.15.12 International Transfers — Where the Supplier transfers Customer Data outside the UK, it shall ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy regulations, as further described in the Privacy Policy.
2.1 Who We Are
Qnipay Limited (“Qnipay”, “we”, “us”, “our”) is a company registered in England and Wales under company number 16976533, with its registered office at Shakespeare Barn Main Street, Grendon Underwood, Aylesbury, England, HP18 0ST. This policy explains how we collect and use personal data, and applies to (a) visitors to qnipay.com, and (b) individuals whose data is processed through the Qnipay payroll Service.
2.2 Two Roles We Play
2.2.1 As Controller — When you visit our website, request a demo, subscribe to our newsletter, or contact our sales or support teams, we act as the data controller for that personal data (e.g. your name, business email, phone number, and enquiry details).
2.2.2 As Processor — When a business customer uses the Qnipay Service to run payroll, the personal data of that customer’s employees (e.g. name, National Insurance number, tax code, salary, bank details) is processed by us strictly on the Customer’s instructions. In that context, the Customer is the data controller and Qnipay is the data processor, governed by the Data Processing Addendum referenced in the Terms of Service (Schedule 1). If you are an employee of one of our Customers and have a question about your payroll data, you should contact your employer in the first instance, as they control that data.
2.3 Information We Collect (as Controller)
2.3.1 Contact and enquiry data: name, job title, company, email, phone number, and the content of any enquiry, submitted via our website contact form or by email.
2.3.2 Website usage data: pages visited, referral source, device and browser type, and approximate location, collected via analytics tools (see Cookie Policy, Part4).
2.3.4 Account and billing data for Customers who subscribe directly (as opposed to via Microsoft AppSource), including billing contact name, company details, and invoicing history.
2.3.5 Marketing preferences, where you have opted in to receive communications from us.
2.4 How We Use Information (as Controller)
2.4.1 To respond to enquiries and provide requested information about the Service.
2.4.2 To manage the contractual relationship with Customers, including billing and support.
2.4.3 To send product updates or marketing communications, where you have consented or where permitted under the ‘soft opt-in’ for existing customers under UK PECR. Every marketing email includes an unsubscribe link, and you can also opt out at any time via the details in clause 2.14.
2.4.4 To understand website usage and improve our site and Service.
2.4.5 To comply with our own legal and regulatory obligations, including under company and tax law.
2.5 Legal Bases
We rely on the following legal bases under UK GDPR: performance of a contract (for Customer account administration); legitimate interests (for responding to enquiries and improving our website, balanced against your rights); consent (for marketing communications, where required); and legal obligation (for statutory record-keeping).
2.6 Data Protection Officer
We have assessed whether appointment of a Data Protection Officer is required under Article 37 UK GDPR given the scale and nature of our processing, and have determined that a DPO is not currently required. Data protection queries are handled by our data protection lead, contactable via the details in clause 2.14. We keep this assessment under periodic review as our processing activities evolve.
2.7 Automated Decision Making
Qnipay Intelligent uses automated processing to support certain payroll tasks. Any processing that could produce legal or similarly significant effects on an employee, within the meaning of Article 22 UK GDPR, is subject to meaningful human review before it affects an employee’s pay; we do not use Qnipay Intelligent to make solely automated decisions with such effects.
2.8 Sub-processors and Third Parties
Where we act as processor for payroll data, we use the following sub-processors, each bound by a written data processing agreement consistent with Schedule 1 of the Terms of Service:
2.8.1 Microsoft — for Azure infrastructure hosting and the Dynamics 365 Business Central platform into which the Service is installed.
2.8.2 HMRC — as the statutory recipient of RTI and other required submissions, via HMRC’s secure Government Gateway.
BACS payment files are generated by the Service in your chosen bank’s format for you to export and submit directly through your own bank’s portal. We do not transmit payment files to any bank on your behalf, and no banking or BACS-processing sub-processor is engaged for this purpose.
2.9 International Transfers
Customer Data is hosted on Microsoft Azure in UK/EEA data centre regions. Where any processing occurs outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy regulations.
2.10 Data Retention
We retain Customer Data for the duration of the subscription and for 30 days afterward to allow export, as set out in the Terms of Service. We retain website enquiry data for up to 24 months from your last contact with us, or until you ask us to delete it sooner, unless a longer period is needed to resolve an ongoing query or dispute. We retain marketing preference data until you unsubscribe or otherwise withdraw consent. Statutory records (e.g. for HMRC or accounting purposes) are retained for the periods required by law, which for payroll and tax records is generally at least 6 years.
2.11 Security
We apply encryption in transit and at rest, access controls limiting data access to authorised personnel, and an audit trail of processing activity, consistent with Article 32 UK GDPR. No system can be guaranteed completely secure; we will notify affected Customers and, where legally required, the ICO, without undue delay in the event of a qualifying personal data breach.
2.12 Your Rights
If we are the controller of your data, you have the right under UK GDPR to: request access to your personal data; request rectification of inaccurate data; request erasure; object to or restrict processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at the details in clause 2.14. If we are the processor (i.e. your employer is the controller of your payroll data), please direct your request to your employer, who will engage us as needed to fulfil it.
2.13 Cookies
Our website uses cookies. Full detail is set out in the Cookie Policy, Part 4.
2.14 Contact Us and Complaints
Questions about this policy, or requests relating to your rights, can be sent to support@qnipay.com. If you wish to unsubscribe from marketing communications, you can use the unsubscribe link in each marketing email, or contact us at the same address. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
2.15 Notification of Material Changes
In addition to updating the ‘last updated’ date, we will take reasonable steps to actively notify Customers of any material change to this policy that affects them directly, such as the addition of a new category of sub-processor or a materially different retention period, for example by email or an in-product notice.
2.16 Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. The ‘last updated’ date at the top of this page will indicate the most recent revision.
3.1 Our Commitment
Qnipay Limited is committed to ensuring our website is accessible to all visitors, including people with disabilities. We want the experience of using qnipay.com to be easy to navigate and rewarding, regardless of how you access it.
3.2 Standard We Aim For
We aim for our website to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, published by the World Wide Web Consortium (W3C). These guidelines explain how to make web content more accessible for people with disabilities, and more usable for everyone.
3.3 Known Limitations and Roadmap
We have not yet completed a formal audit of this website against WCAG 2.1 Level AA. We are not currently aware of any specific accessibility issues, but if you encounter one, please contact us using the details in clause 3.7 and we will treat it as a priority. We review this statement, and our progress toward full conformance, at least annually, or sooner if we make a significant change to the website, and are targeting full WCAG 2.1 Level AA conformance within the next 12 months. If you need information in an alternative accessible format, please contact us using the details in clause 3.7.
3.4 Browser and Device Support
Our website is built to work with the current and previous two versions of major browsers, including Chrome, Firefox, Safari, and Microsoft Edge, and is designed to adapt to the screens of modern mobile and tablet devices.
3.5 Adjusting Text and Display
You can increase or decrease text size using your browser’s built-in zoom or text-size controls (for example, Ctrl and + / Ctrl and – on Windows, or Cmd and + / Cmd and – on Mac). We aim to ensure the site remains usable and readable when text is resized or when browser zoom is increased.
3.6 Images, Colour and Structure
3.6.1 We aim to give meaningful images descriptive alternative text so that screen readers and other assistive technology can convey their content.
3.6.2 We aim to keep headings in a logical, sequential order to support navigation by screen reader and keyboard users.
3.6.3 We aim to write links that describe their destination, rather than generic text such as ‘click here’.
3.7 Feedback and Contact
We are continually working to improve the accessibility and usability of our website. If you experience any difficulty accessing content or using any part of qnipay.com, please contact us at support@qnipay.com. We aim to acknowledge accessibility feedback within 5 working days and will do our best to assist you and address the issue.
4.1 What Are Cookies
Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device and remember information about your visit.
4.2 Categories of Cookies We Use
4.2.1 Strictly necessary / functional cookies – required for the website to operate (e.g. session management, security, load balancing). These cannot be switched off.
4.2.2 Preference cookies – remember choices you make, such as cookie consent preferences.
4.2.3 Statistics / analytics cookies – help us understand how visitors use the site (e.g. Google Analytics), used only with your consent.
4.2.4 Marketing cookies – used to measure the effectiveness of marketing campaigns, used only with your consent.
A full list of individual cookies, including the specific provider, purpose, and duration of each, is available on request at support@qnipay.com.
4.3 Managing Your Preferences
You can accept or reject non-essential cookies via the cookie banner shown on your first visit, and can change your preferences at any time via the cookie settings link in the website footer, using the same categories and controls shown when you first gave consent – withdrawing your consent is as easy as giving it. You can also block cookies through your browser settings, though this may affect site functionality.
4.4 Contact
Questions about our use of cookies can be sent to support@qnipay.com.