PaySight Back to PaySight

Privacy

Privacy Policy

Version 1.2Effective 9 October 2026Data Protection Act No. 3 of 2021

PaySight handles some of the most sensitive information a business holds — what people are paid, their NRC numbers, how to pay them. This is exactly what happens to it.

In short

  • For your own account, we're responsible for your data. For your employees' payroll data, you are — we only process it on your instructions.§ 2
  • Your data is stored in London, in the United Kingdom. Spreadsheets you upload are partly read by an AI service in the United States to work out their columns.§ 6
  • Full bank account numbers are locked away from every screen. Screens show the last four digits; the full number appears only on that employee's own payslip.§ 8
  • Approved payslips can't be deleted — they're statutory payroll records.§ 7
  • No advertising, no tracking, and we don't sell personal data.§ 4
  • You can ask to see, correct or delete your data at any time.§ 9

01Who we are

PaySight is a payroll service operated by Luminex Solutions, a business in the Republic of Zambia (“we”, “us”). This policy explains what personal data PaySight handles, why, where it goes, and the rights people have over it under the Data Protection Act No. 3 of 2021.

02The two roles we play

Payroll involves two kinds of personal data, and the law treats them differently.

Your account

When you sign up, you give us your name, work email and business name. For this data we are the data controller: we decide how it's used, and we answer to you for it.

Your employees' payroll data

When you add employees or upload a payroll, you decide what goes in and why. For this data you — the employer or payroll bureau — are the data controller, and we are your data processor. We use it only to provide PaySight to you, on your instructions, and never for a purpose of our own.

If you're an employee whose payslip is produced by PaySight, your employer is responsible for your data. Please contact them first — we'll help them respond to you. See § 9.

03What we collect

Account data

Your name, work email, business name, the plan you choose, and whether you've confirmed your email. Your password is stored only as a one-way hash — we cannot read it.

Payroll data about employees

Whatever you enter or upload, which may include:

  • Identity — full name, employee number, NRC number, passport and work permit details, nationality, sex, date of birth and permanent address.
  • Statutory numbers — TPIN, NAPSA number and NHIMA number.
  • Employment — department, job title, contract type, place of engagement, and start and end dates.
  • Pay — basic salary, allowances and overtime, the PAYE, NAPSA, NHIMA and net pay calculated from them, and payslip history.
  • Payment — bank name, branch and branch code, SWIFT code, the name on the account, the bank account number, and mobile money network and number.
  • Contact — email address.

A record of changes

Who changed a salary, who approved a pay run, and when. Payroll needs to be able to answer those questions later.

Technical data

Your IP address and browser details, processed by our hosting and bot-protection providers when you use the site. We don't use them to profile you.

PaySight doesn't need, and you shouldn't upload, anything beyond what payroll requires — medical records, for example.

04Why we use it

The law requires a lawful basis for every use of personal data. Ours are:

What we doLawful basis
Provide the service you signed up forOur contract with you
Calculate PAYE, NAPSA and NHIMA and produce payslipsYour instructions, as processor. As the employer, your own basis is usually your legal duty to pay and report tax.
Keep a record of pay changes and approvalsLegitimate interest in accurate payroll records, and your record-keeping duties
Keep PaySight secure and prevent abuseLegitimate interest
Contact you about your account, security or changes to these policiesOur contract with you

We don't sell personal data, use it for advertising, or use it to train AI models.

05Who we share it with

We use a small number of providers to run PaySight. Each receives only what it needs to do its job.

ProviderWhat it doesWhat it handlesWhere
Cloud hosting and database providerDatabase and sign-inAll account and payroll dataLondon, UK
Website hosting and bot-protection providerHosts the website; checks sign-in forms for automated abuseTechnical dataGlobal
AI service providerReads the column layout of payroll spreadsheets you uploadUp to the first 25 rows of each sheetUnited States
Font providerServes the typefaces the site usesYour IP addressGlobal
Email delivery providerEmails payslips to employees, once delivery is switched onEmployee name, email and payslipEuropean Union

We may also disclose personal data where the law requires it — to the Zambia Revenue Authority, NAPSA, NHIMA, a court, or the Data Protection Commissioner — and only as far as the law requires.

06Where your data is stored

PaySight's database is hosted in London, in the United Kingdom. When you upload a payroll spreadsheet, the first rows of each sheet are sent to an AI service provider in the United States so the columns can be identified.

The Data Protection Act No. 3 of 2021 sets conditions on moving personal data out of Zambia. We transfer it only to providers bound by data protection obligations, and only as far as running PaySight requires. The United Kingdom's data protection law is among the strictest in the world.

As the data controller for your employees' data, by using PaySight you instruct us to make these transfers. Please make sure the notices you give employees about their data cover them.

Once PaySight has read a spreadsheet's layout, it remembers it: later uploads with the same layout aren't sent to the AI service at all. We don't keep a copy of the spreadsheet file itself — only the employee details extracted from it.

07How long we keep it

  • Account data — while your account is open. After you close it, you have 30 days to ask for an export; we then delete it within a further 60 days, except anything the law requires us to keep.
  • Payroll data — while your account is active, or until you delete it.
  • Records of changes and approvals — as long as the payroll records they describe.

Approved payslips can't be edited or deleted — on purpose. A payslip is a payroll record, and Zambian tax, pension, health insurance and employment law all require employers to keep payroll records for years. PaySight preserves them so the record you filed always matches the record you hold.

This is the main reason neither we nor an employer may be able to delete everything when someone asks.

08How we protect it

  • Each company's data is walled off from every other company's inside the database itself, not just hidden by the app.
  • All traffic is encrypted in transit, and the database is encrypted at rest by our provider.
  • Passwords are stored only as one-way hashes.
  • Full bank account numbers are kept in a separate store that no one can read back through PaySight's screens or interface, not even the company's own administrators. Screens show only the last four digits. The full number is used only to print that employee's own payslip. Mobile money numbers are stored in full, because they're needed to pay people.
  • Sign-in and sign-up are protected against automated attacks.
  • Approved payslips can't be altered, and every salary change and approval is recorded with who made it.

No system is perfectly secure. If you think your account has been compromised, tell us straight away.

09Your rights

Under the Data Protection Act No. 3 of 2021 you have the right to:

  • know whether we hold personal data about you, and get a copy of it;
  • have inaccurate data corrected;
  • have data deleted, where we're not required to keep it;
  • object to, or restrict, how it's used;
  • receive your data in a portable format;
  • complain to the Data Protection Commissioner of Zambia.

To use any of these rights, email luminexsolutionsglobal@gmail.com. We'll respond within 30 days, and may need to confirm who you are first.

If you're an employee, please start with your employer — they control your payroll data, and we act on their instructions. If they can't help, contact us and we'll work with them to resolve it.

10If something goes wrong

If a security breach affects personal data, we'll tell the businesses affected without undue delay so they can meet their own obligations, and notify the Data Protection Commissioner where the law requires.

11Age

PaySight is a service for businesses. You must be 18 or over to hold an account.

12Changes to this policy

We'll publish any change here and update the version and date above. If a change materially affects how we use personal data, we'll email account holders before it takes effect.

13Contact