Skip to content
Contact

Legal

Privacy Policy

Last updated: 13 October 2026

This policy explains how Buffalo Payroll ("we", "us", "our") collects, uses and protects personal data when you visit this website (buffalopayroll.co.uk) or submit an enquiry through it. It does not cover how we process payroll data on behalf of clients under a signed service agreement — that is governed separately by each client's engagement terms and data processing agreement.

1. Who we are

Buffalo Payroll (company number 13407933), registered in England & Wales, is the data controller for personal data collected through this website.

2. What personal data we collect

We only collect personal data that you choose to give us. When you use the "Get started" or "Contact us for a quote" form, we collect:

  • Full name
  • Business name
  • Email address
  • Phone number
  • Number of employees (selected from a list)
  • Any details you add in the optional message field
  • The plan or service you were enquiring about

If you call or email us directly, we'll also hold whatever details you share with us in that conversation.

When you browse this website we also collect limited usage information, as described in section 6 (Cookies and analytics): anonymous, cookie-free visit statistics for every visitor, and Google Analytics data only if you accept analytics cookies.

3. How we use your data and our legal basis

  • Responding to your enquiry — to answer your questions and provide a quote, which is necessary to take steps towards a contract with you (UK GDPR Art. 6(1)(b)).
  • Following up about our services — where you've asked us to get in touch, based on our legitimate interest in growing our business in a way that respects your rights (Art. 6(1)(f)).
  • Understanding how our website is used — cookie-free visit statistics (Vercel Web Analytics) are based on our legitimate interest in running and improving our website (Art. 6(1)(f)). Google Analytics only runs if you accept analytics cookies, so it is based on your consent (Art. 6(1)(a)), which you can withdraw at any time.
  • Keeping records — so we can maintain accurate business and accounting records, which we may also need to do to comply with a legal obligation (Art. 6(1)(c)).

We will never sell your personal data, and we won't use it for marketing you haven't asked for.

4. Who we share your data with

We use a small number of trusted service providers to run this website and handle enquiries:

  • FormSubmit (formsubmit.co) — relays the enquiry form submission to our team's inbox. FormSubmit acts as a data processor on our behalf. According to FormSubmit's own documentation, submissions are retained on their systems for up to 30 days for delivery and support purposes, and they may set their own cookies for security and access-control purposes as part of operating their service. See FormSubmit's privacy policy for details.
  • Vercel Inc. — hosts this website and provides our cookie-free visit statistics (Vercel Web Analytics). Vercel may process standard technical server logs (such as IP address) as part of delivering the site. See Vercel's Web Analytics privacy information.
  • Google (Google Analytics 4) — if you accept analytics cookies, provides statistics about how visitors use this website, such as pages viewed, how visitors found us and whether an enquiry was sent. We do not use Google Analytics for advertising. See Google's privacy policy.
  • Microsoft 365 — hosts our business email, where enquiry details are received and stored.

Some of these providers may process data on servers located outside the UK or European Economic Area (for example, in the United States). Where that happens, we rely on the provider's UK/EU-approved safeguards, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, to keep your data protected to UK GDPR standards.

We do not share your personal data with any other third party for marketing purposes.

5. How long we keep your data

If you make an enquiry and don't go on to become a client, we typically keep your details for up to 24 months from your last contact with us, so we can follow up or refer back to earlier conversations, after which we securely delete them. If you become a client, your data is retained in line with our client engagement terms and any applicable HMRC or statutory retention requirements.

6. Cookies and analytics

Cookie-free visit statistics. We use Vercel Web Analytics to count visits and see which pages are popular. It does not use cookies. Vercel identifies visits using a hash created from the incoming request, and the visitor session is automatically discarded after 24 hours. It records information such as the page visited, the referring website, approximate location, browser and device type. It does not identify you personally or track you across other websites.

Google Analytics (optional). With your permission, we use Google Analytics 4 to understand in more detail how visitors use our website, for example how you found us, which pages you visited and whether you called, emailed or sent an enquiry. Google Analytics sets cookies (named _ga and _ga_<ID>) which usually last up to two years. It only loads if you click "Accept" on our cookie banner. We do not use Google Analytics for advertising, and advertising features are switched off.

You can change your choice at any time using the "Cookie settings" link at the bottom of every page. If you withdraw consent, we stop loading Google Analytics and remove its cookies from this website.

Other browser storage. We store your light/dark display preference and your cookie choice in your browser's local storage. These are not cookies and are not shared with us or any third party.

Enquiry form. When you submit our enquiry form, your browser connects to FormSubmit (formsubmit.co), our form-processing provider, which may set its own strictly-necessary cookie for security and spam-prevention purposes as part of delivering that submission to us. We do not control this cookie and it is not used for advertising or tracking across other websites. See FormSubmit's privacy policy for details.

7. Your rights

Under UK GDPR, you have the right to:

  • Ask us what personal data we hold about you and get a copy of it (right of access)
  • Ask us to correct inaccurate or incomplete data (right to rectification)
  • Ask us to delete your data, where there's no good reason for us to keep it (right to erasure)
  • Ask us to restrict or stop processing your data in certain circumstances
  • Object to processing based on legitimate interests
  • Ask for your data in a portable format, where technically feasible

To exercise any of these rights, email hello@buffalopayroll.co.uk or call 0161 823 8363. We'll respond within one month.

If you're unhappy with how we've handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We'd appreciate the chance to resolve any concerns directly first.

8. Children's data

This website is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18.

9. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "last updated" date at the top of this page shows when it was last revised. We encourage you to check back periodically.

10. Contact us

If you have any questions about this policy or how we handle your data, please get in touch: