Privacy notice

The controller of your personal information is Eugenero, trading as Neturon.

For privacy questions or to use your rights, email services@neturon.com. Staff can also contact hr@neturon.com.

• Browsing. You can read the site without an account. We do not use analytics or advertising cookies. See the cookie notice.
• Enquiry form. We store what you send so the right person can reply: your name, company, email, optional phone number, the service, enquiry type, preferred contact method and description, plus the extra staffing details if you ask about staffing. We also store your IP address, to block repeated automated submissions. The enquiry goes into our client management system, where only staff who handle enquiries can see it. We use it to respond and, if you become a client, to manage our work with you. We do not use it for marketing without asking you.
• Technology for Good applications. We store your application so it can be reviewed.
• Our addresses. www.neturon.com is our website. If you use one of our other addresses (neturon.com or neturon.co.uk), you are simply sent to the same page on www.neturon.com. Nothing about you is looked up or stored for this.
• Lawful basis. Our legitimate interests in answering enquiries and running our business, or steps you ask us to take before entering a contract.

For employees, contractors and other staff, the employee portal holds:

• Identity and contact: your name (title, first, middle and last name, the name you are known by, and letters after your name), username, work email and phone if you have them, and an optional personal contact email you choose to add.
• Employment: employee number, job title, grade, department, team, manager, employment type and status, join and leaving dates, and the history of those details.
• Photograph and e-signature, if you or HR upload them, used on your profile and identity card once approved.
• Your professional profile: skills, qualifications, certifications and languages, each shown only to the audience you choose.
• Leave and absence, including sickness absence. Sickness absence is health information, which the law treats as special category data. It is limited to what is needed to manage absence and pay, and seen only by you, your line manager, and the people who manage leave (HR and administrators). Colleagues who can see the team calendar see only that you are absent, not why.
• Pay: your salary and how it has changed, allowances and one-off payments, and the reason and approver for each change. It is seen only by you and HR, kept encrypted, and every time HR opens someone's pay it is recorded. Bank details, tax and payslips are handled by our payroll provider, not stored here.
• Salary confirmation letters you or HR issue: a copy of what each letter states (name, job title, employment type, start date and current salary, the salary kept encrypted), its language and dates. The letter carries a private link; anyone you give the letter to can use it to check that it is genuine, and sees those details only while the letter is valid. Letters expire after 90 days and you can revoke one at any time. Each check is recorded.
• Documents about your employment, such as your contract, offer letter, agreements, qualifications and certificates.
• Development: career plans, one-to-one meetings and notes, objectives and reviews. Each note is shown only to the people its visibility allows. Private notes are seen only by their author.
• Work records: projects, tasks, support tickets, client work and messages you are involved in. For messages, the portal also records when each person last opened a conversation, which the others see as “Seen by”, and reactions. A message can be edited or withdrawn for 24 hours after sending; its earlier wording is kept and can be seen only in an authorised investigation.
• Identity and visiting cards: the details printed on each card, its serial number and dates, and a copy of the photograph printed on it.
• Your account: notifications, email preferences, and the security records in section 6.

Lawful basis.

• Performing your contract with us.
• Our legal obligations as an employer, for example on pay, tax, working time and right to work.
• Our legitimate interests in running the business, developing our people and keeping systems secure.
• For sickness absence: our employment law obligations (UK GDPR Article 9(2)(b), and Schedule 1 paragraph 1 of the Data Protection Act 2018).

We do not use automated decision-making or profiling that has legal or similarly significant effects on you.

For contacts at the organisations we work with, we hold:

• your name, job title, organisation, contact details, username and portal role
• our relationship records: notes of meetings and calls, follow-ups, feedback you give, and who at Neturon looks after your account
• what you do in the client portal: support requests, messages, project updates, documents and approvals

Lawful basis: our legitimate interests in providing and managing services for your organisation, and performing our contract with it.

Your organisation’s administrator can see the portal accounts of colleagues in your organisation. Other clients can never see your information.

Anyone can scan the QR code on a Neturon identity or visiting card, or enter its serial number at neturon.com/verify, to check it is genuine.

• For a valid identity card, the check shows the holder’s name, job title, department, employee number, card serial and dates, and the photograph printed on the card, so the person checking can confirm the holder is who they say they are.
• For a valid visiting card, it shows the contact details printed on the card and offers them as a contact file.
• For an expired, revoked or replaced card, or one belonging to someone who has left, it shows only the card’s status.
• What is never shown: email or phone on an identity check, home address, date of birth, or permissions.

Lawful basis: our legitimate interests, and those of the people our staff deal with, in preventing impersonation and fraud.

About the person checking: we record nothing, except that checks made by serial number count failed attempts against the IP address, so serial numbers cannot be guessed in bulk.

To protect the portals and the information in them, we automatically record:

• sign-ins, failed sign-ins, sign-outs, two-step verification changes and password changes, with the date, time, IP address and browser
• important actions, such as changes to records, roles and permissions, documents uploaded or downloaded, reports exported, and cards issued, downloaded or revoked

Lawful basis: our legitimate interests in keeping systems and information secure and preventing misuse, and our legal duty to protect personal data. We do not rely on your consent.

Who can see them: only a small number of authorised staff. They are not used to watch how individuals work day to day. A particular person’s records are reviewed only for a specific, proportionate reason, such as a security incident or suspected misuse, as set out in our Acceptable Use Policy.

• Inside Neturon, people see only what their role needs. The portal enforces this: for example, HR-confidential records are limited to HR.
• Our hosting provider stores the system for us, under a contract that only lets it act on our instructions. Once we connect an email provider for portal notifications, it will be added here.
• Professional advisers, such as lawyers, accountants and auditors, where needed.
• The police, regulators, courts or HMRC, where the law requires or allows it.
• If the business were sold or reorganised, the new owner, under the same protections.

We never sell personal information.

Portal information, uploaded documents and backups are kept on Neturon’s own server. The hosting provider and the country where the server is located are to be confirmed. If any information is ever transferred outside the UK, we will use a lawful transfer mechanism, such as UK adequacy regulations or the International Data Transfer Agreement, and update this notice first.

Clients and people outside the UK. Neturon is a UK business and handles personal information under UK data protection law wherever its clients are. Where we offer services to people in the European Union and the law requires it, we will appoint a representative in the EU and name them here (to be confirmed).

• Failed sign-in records: about 30 days.
• Signed-in sessions: they end after 2 hours of inactivity or 8 hours at most.
• One-time passwords: they expire after 7 days.
• Website enquiries that do not lead to work: to be confirmed.
• Staff records after someone leaves: to be confirmed, in line with legal limitation periods, typically 6 years for employment and pay records.
• Client records after a contract ends: to be confirmed.
• Security and audit logs: to be confirmed.
• Backups: to be confirmed.
• Identity card records: kept while the card is valid and for a period afterwards to answer checks. To be confirmed.

Leavers’ records are archived, not deleted, until their retention period ends.

• Every account uses two-step verification. Passwords are stored only as secure hashes, and two-step secrets are encrypted.
• Access is permission-based and checked on the server for every request. Changes and downloads are logged.
• Uploaded files are stored privately, never at a public address.
• Identity cards are digitally signed, so fake cards can be detected.
• The database and files are backed up, and there is a documented way to check a restored copy is complete.

Under UK data protection law, you can ask us to:

• give you a copy of your personal information
• correct it if it is wrong
• delete it, or restrict how we use it, in some circumstances
• move it to another organisation, where you gave it to us for a contract

You can also object to our use of it where we rely on legitimate interests.

Contact services@neturon.com. We will reply within one month. Staff can update many of their details themselves under My profile in the portal.

If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

We will update this notice before we start using personal information in a new way, for example when we connect an email provider or add analytics. We will tell staff and clients about important changes. The current version is always on this page.