AdminHQ Privacy Policy
Last updated: 21 August 2026
1. Who we are
AdminHQ is a business administration software platform operated by Melissa Burrows trading as AdminHQ, a sole trader based in the United Kingdom.
AdminHQ provides businesses with tools to manage business administration, including employee records, compliance and renewal tracking, tasks, annual and other leave requests, reminders and related administrative information.
For privacy enquiries, please contact:
When we process personal information for our own business purposes, such as administering customer accounts, providing support and managing our relationship with customers, Melissa Burrows trading as AdminHQ is the data controller.
Where a subscribing business enters or manages information about its employees or other personnel within AdminHQ, that business will generally be the data controller and AdminHQ will process that information on its behalf as a data processor.
2. Personal information we collect
Depending on how you use AdminHQ, we may process:
Account and business information
- Name
- Email address
- Business/company name
- Telephone number, where provided
- Account and user identifiers
- Subscription status and plan information
Employee information entered by our customers
- Name
- Email address
- Job title
- Start date
- Employment status
- Compliance requirements and renewal dates
- Training or qualification information
- Tasks and task status
- Annual leave and other leave information
- Notes entered by authorised users
AdminHQ is not designed for customers to record medical information, DBS results, criminal-offence information or other special-category personal information in free-text fields, and users are instructed not to enter such information.
AdminHQ does not currently provide functionality for customers to upload employee documents or certificates.
Technical information
When you access AdminHQ, certain technical information may be processed automatically, including:
- IP address
- Browser/device information
- Authentication and security information
- Request and server logs
- Login and activity information
Billing information
Subscriptions and payments are handled by Paddle, our Merchant of Record.
AdminHQ does not receive or store full payment-card details. Paddle processes payment and billing information in accordance with its own legal and privacy obligations.
Support correspondence
If you contact us, we may process your name, email address and the contents of your correspondence so that we can respond to you and provide support.
3. How we obtain personal information
We obtain personal information:
- directly from customers when they create and manage an AdminHQ account;
- from authorised users of a customer's AdminHQ account;
- from subscribing businesses when they add employees or other personnel to AdminHQ;
- from employees when they interact with permitted AdminHQ features or links; and
- automatically when users access and interact with the service.
Where an employer or other organisation provides your information to AdminHQ, that organisation is generally responsible for determining why your information is being processed and ensuring it has an appropriate lawful basis for doing so.
4. Why we use personal information
Where AdminHQ acts as controller, we may use personal information to:
- create and administer accounts;
- provide and maintain the AdminHQ service;
- manage subscriptions;
- authenticate users and protect account security;
- provide customer support;
- send service messages and transactional emails;
- maintain records relating to our contractual relationship with customers;
- detect, investigate and prevent misuse or security incidents;
- comply with legal and regulatory requirements; and
- establish, exercise or defend legal claims.
Our lawful bases will depend on the particular processing involved and may include:
Contract — where processing is necessary to provide AdminHQ or take steps requested before entering into a contract.
Legitimate interests — where necessary to operate, secure, support and improve our business and service, provided those interests are not overridden by individuals’ rights and interests.
Legal obligation — where we are required to process or retain information to comply with applicable law.
Where AdminHQ acts solely as a processor, the relevant customer determines the lawful basis for processing its employee information.
5. Employee information processed for customers
Businesses using AdminHQ may add personal information about their employees or other personnel.
In these circumstances, AdminHQ generally processes the information on the customer’s instructions and to provide the functionality requested by that customer.
Customers are responsible for ensuring that:
- they have an appropriate lawful basis for processing employee information;
- employees receive appropriate privacy information;
- information entered into AdminHQ is accurate and appropriate;
- access is only provided to authorised users; and
- sensitive information is not entered where AdminHQ does not provide functionality designed for that purpose.
Our processing of customer-controlled personal data is also governed by our Data Processing Agreement.
The ICO requires controller-processor contracts to address matters including instructions, confidentiality, security, sub-processors, data-subject rights, assistance and end-of-contract deletion/return. Our DPA will deal with these separately from this public Privacy Policy.
6. Who processes personal information for AdminHQ
We use carefully selected service providers to operate AdminHQ. These currently include:
Lovable / Lovable Cloud
Application infrastructure, hosting, authentication and database services.
Supabase infrastructure / AWS
The primary production database is hosted in Paris, France (AWS eu-west-3).
Cloudflare infrastructure
Used in connection with application delivery and edge/network infrastructure. Requests may transit through global infrastructure.
Paddle
Our Merchant of Record, responsible for subscription payments, billing, taxation and invoicing.
Resend / Lovable email infrastructure
Used to deliver transactional communications such as invitations, reminders and account-related emails.
Microsoft 365
Used for AdminHQ business email, including support and privacy correspondence.
We maintain further information about relevant service providers in our Sub-processor List.
We do not sell personal information to advertisers.
7. International transfers
AdminHQ’s primary production database is hosted in France within the European Economic Area (EEA).
Some of our service providers may process personal information in other countries, including the United States, or use global infrastructure.
Where personal information is transferred internationally, we require appropriate safeguards to be used where required by UK data-protection law. Depending on the destination and provider, these may include UK adequacy regulations or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.
Information about relevant safeguards can be requested by contacting privacy@adminhq.app.
8. How long we keep information
We only retain personal information for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory and contractual requirements.
When an AdminHQ subscription ends, customer data is scheduled for deletion following a 90-day retention period.
During this period, the customer may reactivate their subscription and retain their data.
Customers receive reminders before scheduled deletion.
Customers may also choose to permanently delete their AdminHQ account sooner. Where immediate deletion is requested, the applicable AdminHQ account data is permanently deleted without waiting for the 90-day period and cannot be restored through AdminHQ.
Activity/audit records are ordinarily retained for no longer than 24 months.
Where an employee is permanently deleted, associated information is removed where appropriate and identifying information in relevant activity records is pseudonymised.
Certain payment, invoice and taxation records are retained independently by Paddle in accordance with Paddle’s own legal obligations and retention requirements.
We may retain limited information for longer where necessary to comply with law, resolve disputes or establish, exercise or defend legal claims.
9. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
Measures within AdminHQ include:
- authenticated account access;
- company-level separation of customer information;
- access controls;
- database security controls;
- expiring and rotating links for certain employee interactions;
- restricted data access;
- deletion and retention controls;
- activity logging; and
- security monitoring and appropriate third-party infrastructure.
No online service can guarantee absolute security, but we review the measures used to protect the information processed through AdminHQ.
10. Automated decision-making and AI
AdminHQ does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.
AdminHQ does not currently send customer or employee information to a generative-AI model as part of the live service.
If this changes materially in future, this Privacy Policy will be updated before such processing is introduced where required.
11. Your data-protection rights
Depending on the circumstances and applicable law, individuals may have rights including:
- the right to be informed about how their information is used;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability; and
- the right to object to certain processing.
These rights are not absolute and may depend on the lawful basis and circumstances of the processing.
Where AdminHQ processes employee information on behalf of a customer, requests concerning that information should normally be directed to the relevant employer/business as the controller. We will assist our customers with appropriate requests in accordance with our Data Processing Agreement.
For information for which AdminHQ is controller, contact:
12. Your right to object
Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.
Contact privacy@adminhq.app if you wish to exercise this right.
I’ve separated this because the ICO specifically says the right to object should be brought to people’s attention clearly and separately.
13. Complaints
If you have concerns about how we use your personal information, please contact us first at:
You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO).
14. Cookies and similar technologies
AdminHQ currently does not use advertising pixels, behavioural advertising tools or session-recording technology.
The service may use strictly necessary technologies required for authentication, security and operation of the application.
If we introduce analytics, advertising or other non-essential tracking technologies in future, we will update our cookie information and obtain consent where required.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to AdminHQ, our service providers, applicable law or how we process personal information.
Where changes are significant, we will take reasonable steps to bring them to the attention of affected users.
The latest version will always display its effective or last-updated date.