Skip to content
Reading viewChange how this site looks for you.
Request a demo

Privacy notice

Last updated 10 November 2026

Who we are

Halo Benefits is a trading name of GRW Halo Ltd, a company registered in Scotland (company number SC861469), 93 George Street, Edinburgh EH2 3ES. We are registered with the Information Commissioner's Office as ZC050335. Employers use Halo Benefits to set up their benefits and let their people choose them, on the web at app.halobenefits.com and in our iPhone and Android apps.

Our role

For your benefits, your employer decides what information is used and why. In data protection terms your employer is the controller and Halo Benefits is the processor: we use your information only to run your employer's benefits, on their instructions.

For our own business records, such as the details of employer contacts and people who get in touch with us, Halo Benefits is the controller.

What we hold

From your employer's HR system or files:

  • your name, work email and employee reference
  • date of birth and gender, where a benefit needs them
  • start date, employment status, working hours, salary and other pay details
  • your home address, where your employer or a benefit needs it

From you:

  • the benefits you choose and change
  • details of dependants and beneficiaries you add
  • notes and documents you give for life events
  • questions you ask the benefits adviser
  • if you join a Thrive wellbeing challenge and allow it, daily activity totals from Apple Health or Health Connect (steps, wheelchair pushes, exercise minutes, workouts, mindful minutes and sleep). This is health data, so we only read it with your explicit permission, which you can withdraw at any time; disconnecting deletes it. Only you see your own figures. Your employer only sees totals for groups of ten or more, never yours.
  • if you use Halo Money, the money plan you type in, your money check answers and your scores
  • if you take part in Thrive, your points, check-ins, thank-you messages and any gifts you receive

When you sign in we keep a record of your account and sign-ins. If you allow notifications in the app, we keep your device's notification token. Face ID, Touch ID and fingerprint unlock are handled by your phone: we never see or store them.

We count how people use our website and app with PostHog, such as which pages are opened and which buttons are pressed. This helps us make them better. Analytics cookies are set only if you accept them. If you reject them, or have yet to choose, we still count visits, without cookies. We also record errors, so we can fix faults. We do not use advertising tools.

Why we use it

  • To run your employer's benefits: showing what you can choose, working out costs, and sending your choices to your employer's payroll and to the benefit providers your employer has chosen. This is done under our contract with your employer.
  • To keep the service secure and to keep a record of who saw or changed what. This is in our and your employer's legitimate interests.
  • To run Thrive and to read activity from your phone or watch, only if you choose to. For activity, which is health data, we rely on your explicit consent. You can say no, or stop later, and it makes no difference to your job, pay or benefits.
  • To meet our legal obligations.

How we use AI

Some features use AI, such as the benefits adviser, reading benefit documents and suggesting set-up. Most use Google's Gemini models in London. If Gemini is busy or down, Claude, made by Anthropic, answers instead. Claude runs on Google's servers in the European Union. A few features use only Claude. Both use a request only to answer it. Your information is not used to train AI models, and your employer can turn Halo AI features off. AI only suggests. Halo Benefits' rules and your employer's administrators decide who is eligible, what things cost and what goes to payroll, never AI. The adviser tells you when you are talking to AI.

The benefits adviser

When you ask the adviser a question, we remove email addresses, phone numbers and long numbers from it. We send the question and facts about your own benefits to the AI model. That is Gemini in London, or Claude in the European Union when Gemini is busy. These facts cover what is on offer, what you have chosen and what it costs. For pay exchange checks, they can include pay and pension figures. We do not add your name or contact details from your Halo record. The text you type is sent, so please leave out names, health details and other people's details. The adviser explains; it cannot choose or change anything for you.

We keep your questions and the answers so you can look back at them. There is no set time limit for these chats today. Administrators at your employer who can see reports and pay can read them too, and every time they do is recorded.

Thrive, Halo Money and gifts

Thrive is a wellbeing programme your employer may offer. Joining is up to you. Not joining, or leaving, makes no difference to your job, pay or benefits, and your employer never sees how you are doing. Some challenges need no phone, watch or bank, so you can always take part without sharing health data.

Step and activity data. If you connect Apple Health or Health Connect, your phone sends us one total a day for each measure you allow. These measures are steps, wheelchair pushes, active minutes, workout minutes, workouts, mindful minutes and sleep. We never receive your heart rate, location or routes. We ask for your permission for each source. You can disconnect at any time in Halo, which deletes the activity that source sent us. Your employer only sees totals for groups of ten or more, and we stop totals being compared in ways that could single anyone out. Your employer never sees your own figures.

Halo Money. Bank links currently use test accounts only. You cannot connect a real bank account. In this test service, we show accounts, balances and recent spending on screen but do not keep them. The test connection ends within 24 hours unless you connect again. You can disconnect at any time. Halo Money gives guidance, not financial advice.

Wellbeing scores. Your money check answers and scores are for you. Your employer only sees totals for groups of ten or more, never your answers or your score.

Gifts. If your employer gives Thrive thank-you gifts, we keep a record of each gift: what it was, what it cost and when. Your employer needs this for tax and must keep it for 3 years after the end of the tax year. If you ask us to delete your information, the gift record stays for that time but the reason for the gift is removed. Live gift card orders are not yet available. Demo orders buy nothing and use only the product, its value and a reference number, never your name, email address or pay.

Who else sees it

Your employer, its payroll, and the benefit providers it chooses (for example an insurer) receive what they need to run your benefits. We also use these service providers:

  • Amazon Web Services, London: runs our app and sends emails
  • Google Cloud (Vertex AI), London and the European Union: AI
  • TiDB Cloud, Frankfurt: our database
  • Cloudflare: delivering the website and app securely
  • Auth0 (Okta), United Kingdom: sign-in
  • Customer.io, European Union: sending sign-in codes by email
  • Datadog, European Union: keeps security logs for sign-in
  • PostHog, Frankfurt, Germany: counts how people use our website and app, and records errors. It sees the pages you open and the buttons you press, with a reference number in place of your name.
  • Apple and Google: delivering app notifications, if you allow them
  • Deepgram, European Union: turns a spoken question into words and an answer into speech. It receives the sound of one question, or the words of one answer, not your Halo record. We ask it not to use that to train its models.
  • Twilio, United States: carries calls on the Halo Benefits phone line. It sees your phone number and the sound of the call while the call lasts. Calls are not recorded.
  • Microsoft Teams and Slack: delivering notifications, if your employer connects them and your choices allow them

If your employer offers the workplace nursery benefit run by Halo Workplace Nurseries, a separate Halo group company, we send it your first name, work email and a reference number when you choose to continue there. It decides for itself how it uses them. We never send it your salary, address, date of birth or anything about anyone else.

Our full, current list of service providers, with what each one sees, is on our sub-processors page.

Notification choices

If your employer connects Microsoft Teams or Slack, Halo matches your sign-in email to your account there. The service receives your account reference, a short general notification and a link to Halo. Notifications carry no names, pay amounts or details of your benefit choices.

You can turn benefit updates off separately for your phone, Microsoft Teams and Slack in Notification settings. News and offers stay off unless you choose to receive them on that channel. These choices do not change messages in Halo or email updates. We keep delivery outcomes for 13 months, and keep the history of your choices.

Microsoft and Slack process notifications in the locations used by your employer’s service, which may include places outside the UK. Your employer can explain its workspace settings and how long it keeps messages there.

Cookies

We use essential cookies to keep you signed in and to keep your account secure. Analytics cookies are used only if you accept them on the cookie banner.

To change your choice, clear the cookies and site data for halobenefits.com in your browser. The banner will ask again on your next visit.

Where your information is

Your benefits information is stored in our database in Frankfurt, Germany, including documents you upload. The app's processing, email and our encrypted backups are in London, and most AI is too. It does not all stay in the UK:

  • sign-in (Auth0) is in the United Kingdom; the phone line (Twilio) is in the United States;
  • Cloudflare delivers pages from its network location nearest you, which can be outside the UK;
  • Claude, on Google Vertex AI, answers some AI requests in the European Union;
  • Customer.io, Deepgram, Datadog and PostHog work in the European Union but are US companies;
  • Apple and Google deliver app notifications through their worldwide services, carrying only a device token and a short general message.

The European Union is recognised by the UK as protecting personal information to UK standards. For the United States, we use companies certified to the UK Extension of the EU-US Data Privacy Framework (the UK-US data bridge), which the UK recognises in the same way, or the UK's approved contract terms (the UK Addendum to the EU Standard Contractual Clauses).

How long we keep it

We keep your benefits information for as long as your employer tells us to. Unless your employer chooses otherwise, that is while you work there and for 6 years after you leave, which is how long claims about employment and benefits can usually be brought. Some records have their own, shorter periods: sign-in history 24 months, notification delivery records 13 months, and the scrambled form of your number if you call the phone line 30 days. Our encrypted backups are kept for 30 days, so deleted information leaves them within about 5 weeks. A record of who saw or changed what is kept for as long as your employer uses Halo Benefits, without copying sensitive details into it. When your employer stops using Halo Benefits we delete or return your information as our contract with them sets out, except where the law requires us to keep a record for longer.

Your rights

You can ask to see, correct or delete your information, to limit or object to how it is used, or to have a copy to take elsewhere. Because your employer controls your benefits information, please ask your employer's HR team first; we will help them answer. You can also contact us at hello@halobenefits.com.

If you are unhappy with how your information is handled, you can complain to the Information Commissioner's Office at ico.org.uk.

Keeping it safe

Your information is encrypted when it moves and when it is stored. Each employer's information is kept apart from every other employer's. Administrators sign in with an emailed code and an authenticator app, and every view and change of sensitive information is recorded. We keep sign-in history for 24 months to help protect accounts. This includes the sign-in time, browser family, country and an approximate network, rather than the full network address. You can see your recent sign-ins. Authorised administrators can see events linked to their employer, and Halo security operators can check them in a recorded support session. These records are for account security.

Changes and contact

We will update this page if anything changes and show the date at the top. Questions: hello@halobenefits.com.