Privacy Policy

When an employer uses NextHR to run its HR and payroll, that employer is the personal information controller for its own people’s data. Nextcore Technology Inc. is the personal information processor, acting on the employer’s instructions.

In practice: if you are an employee and want your record corrected, ask your HR team first — they control it. If they need us to act, we will.

A workspace stores what payroll and statutory filings require:

• Identity and contact — name, employee code, work and personal email, mobile, address, birth date, gender, civil status, nationality.
• Employment — company, department, position, level, manager, work location, shift, dates of hire, regularisation and separation.
• Government identifiers — SSS, PhilHealth, Pag-IBIG and TIN.
• Financial — salary or professional fee, bank name and account number, loans, and every payslip line.
• Attendance — clock-in and clock-out times, the coordinates of a punch where the employer has enabled geofencing, whether the phone reported its location as simulated, and a photo taken at clock-in where the employer requires one.
• Requests — leave, overtime, official business and work-from-home, with the reasons given and approval decisions; certificates of employment, with passport details where a travel letter needs them.
• Sensitive personal information — medical records and dependants, where the employer records them.
• Account and audit — login email, password hash, session and device records, and a log of significant actions.
• Applicants — what a person gives when they apply through an employer’s careers page: name, contact details, CV and cover note, with the date and version of this notice they agreed to.
• Emergency contacts — the people an employee asks to be called, which the employee keeps up to date.

To operate the service the employer has asked for: computing attendance and pay, withholding and reporting statutory contributions and taxes, routing approvals, and producing the returns Philippine law requires — among them BIR 1601-C, 1601-EQ, 2316 and the 1604-C alphalist, and SSS, PhilHealth and Pag-IBIG remittances.

The lawful bases are the employment relationship, the employer’s legal obligations, and the legitimate interests of operating and securing the service. We do not sell personal data, and we do not use it to train models or to advertise.

Where an employer enables geofencing, a clock-in records the coordinates and accuracy reported by the device at that moment, and whether it fell inside the allowed radius. The verdict is decided by the server, not the device.

This is collected only at the moment of a punch. NextHR does not track location continuously or in the background.

The coordinates are removed after the period the employer sets (new workspaces start at ninety days). Whether the punch was inside the allowed radius, and how far outside it, remains.

• Government identifiers, bank account numbers and passport numbers are encrypted at rest with AES-256-GCM, and the field name is bound into the ciphertext so a value cannot be moved between columns.
• Passwords are stored as bcrypt hashes and are never recoverable, by us or anyone else.
• Reads of decrypted government identifiers are recorded, along with who performed them.
• Access inside a workspace is governed by a permission model, not by job title, so payroll figures and medical records can be restricted independently.
• Each workspace’s data is scoped to that workspace at the query layer; one employer cannot read another’s records.
• Data is held in managed PostgreSQL infrastructure with encryption in transit.

The sub-processors that make the service work, each bound by its terms to process data only to provide its service to us:

• Vercel Inc. — hosts the application (Singapore region) and stores uploaded files.
• Neon Inc. — the database, on Amazon Web Services in Singapore.
• Microsoft Corporation — sends email notices (Azure Communication Services); signs people in with their work account where the employer connects Microsoft.
• Google LLC — delivers notifications to the mobile app (Firebase Cloud Messaging), and measures sign-ups on our own sign-up confirmation page (no employee data).
• Anthropic PBC — answers questions typed into the in-app help assistant. It receives the question and the context needed to answer it, never payslip amounts.
• PayMongo — takes subscription payments from the employer; card details go to PayMongo, not to us.

Visits to our public pages (not the app, and not the sign-in or sign-up pages) are counted by Nextcore’s own visit counter, without cookies. For each page view it records the page, the site that linked to it, the country, and the type of device and browser. The IP address is used only to tell repeat views on the same day apart and is never stored.

We disclose data to government agencies only as the employer’s filings require, or where the law compels it.

For as long as the workspace is active, and after that for the periods Philippine law requires. When a workspace closes, we retain what those obligations require and remove the rest.

• Payroll, payslips and tax records — ten years, under BIR rules.
• Statutory contribution records (SSS, PhilHealth, Pag-IBIG) — as long as the agencies require, generally ten years.
• Employment and time records — at least three years from the last entry, the period for money claims under the Labor Code.
• Applicants not hired — removed after the period the employer sets (new workspaces start at twelve months); a count of applications remains, and the activity log refers to them only as a former applicant.
• A leaver’s medical records and the certificates filed with their leave, emergency contacts, dependants and survey or training participation — removed after the periods the employer sets, counted from the separation date (new workspaces start at four years for medical records, one year for family details and two for participation). Payroll, tax and the 201 file are kept as above.
• Clock-in photos — deleted ninety days after the punch; the time of the punch remains.
• Where a punch was made — removed after the period the employer sets (new workspaces start at ninety days); the time of the punch and whether it was inside the allowed area remain.
• Passport details given for a travel certificate — removed thirty days after the certificate is issued and the trip is over, or thirty days after a request is turned down or withdrawn.
• Activity logs — kept while the workspace exists, and removed a year after it is deleted.

Finalised payroll runs are immutable by design. They can be superseded by an adjustment but not rewritten, because a payslip is a record of what was actually paid.

Under the Data Privacy Act of 2012 (RA 10173) you may ask to be informed about, access, correct, object to, erase or block the processing of your personal data, to have it transferred to you, and to be indemnified for damage caused by inaccurate or unlawfully obtained data.

Every employee can download a copy of what NextHR holds about them from My details, and can hide their birthday from colleagues there. Employees should raise anything else with their employer, who controls the record. Write to support@nextcoretechnology.com if the employer needs us to act, or if you believe we have handled data improperly. You may also complain to the National Privacy Commission.

Material changes will be notified in the product before they take effect. The date at the top of this page always reflects the current version.