In brief. BMS Prime is business software. The data a business puts into its workspace belongs to that business, and we process it only to run the service for them. We collect the minimum we need about our own customers and visitors. We show no ads, we do not sell or rent personal data, and we do not track you across other websites.
1. Who we are and what this policy covers
BMS Prime (“we”, “us”) provides cloud business management software for HR, payroll, attendance, accounting and inventory (the “Service”). This policy explains how we handle personal data on the website bmsprime.com, in the BMS portal, and in the BMS apps for Android (package com.newbacklink.bmsapp) and Windows.
You can contact us about privacy at any time at info@bmsprime.com.
2. Our two roles: controller and processor
The Service is used by businesses (our “customers”). Depending on the data, we play one of two roles:
- Data a customer puts into its workspace, such as records about its employees, job applicants, customers and vendors, payroll, attendance and documents, is processed by us on behalf of that customer. The customer is the controller and decides what is collected and why; we are its processor and follow its instructions under our Data Processing Addendum. If you are an employee or other person whose data a business keeps in BMS Prime, please contact that business first about your data. If you contact us, we will pass your request on to them.
- Data about our own customers and visitors, such as the people who sign up, administer a workspace, pay for a subscription, request a demo or visit our website, is processed by us as controller. Most of this policy describes that processing.
3. What we collect
Information you give us
- Account data: name, email address, username, phone number, role, password (stored only as a secure hash) and two-step sign-in settings.
- Business profile: the details we ask for at sign-up to verify every business, such as legal name, industry, country, state and city, phone, number of employees, website, optional tax ID, and which features you plan to use, together with your acceptance of the Terms.
- Billing data: the plan and period you choose, the payment proofs you upload (a bank transfer screenshot or receipt, which may show an account name, part of an account number and the amount), and the receipts we issue. We never receive or store payment card details.
- Demo requests and messages: your name, email, company, phone, country, company size, industry and message when you contact us or request a demo.
- Support communications: what you write to us and our replies.
Information collected automatically
- Usage and security logs: IP address, browser and device type, app version, date and time of sign-ins and requests, and errors. Inside a workspace, an audit log records who created, changed or deleted which record, and when.
- Device data for notifications: if you allow notifications, a push token that lets us deliver alerts to your device.
- Cookies and local storage: only essential cookies and stored preferences, as described in our Cookie Policy.
Customer data
The data a customer stores in its workspace (section 2) can include names, contact details, identity and employment documents, pay and bank details, attendance punches, leave, provident fund, performance and training records, invoices and other business records. We process it only for that customer, as described in the DPA.
4. How we use personal data
| Purpose | Data used | Legal basis (where GDPR-style laws apply) |
|---|---|---|
| Create and run your account and workspace, provide the Service and support | Account, business profile, usage | Performance of our contract with you |
| Verify businesses and prevent fraud and abuse | Business profile, account, logs | Legitimate interests in keeping the platform safe; legal obligations |
| Review payment proofs, issue receipts, keep financial records | Billing data | Contract; legal obligations (tax and accounting) |
| Send service emails (sign-in codes, approvals, renewal reminders, security and policy notices) | Account data | Contract; legitimate interests |
| Send push notifications you have allowed | Push token, notification content | Consent, which you can withdraw in your device settings |
| Answer demo requests and enquiries | Demo request and message data | Steps taken at your request before a contract; legitimate interests |
| Keep the Service secure, diagnose problems and improve it | Logs, aggregated usage | Legitimate interests |
| Comply with law and enforce our terms | As needed | Legal obligations; legitimate interests |
We do not use personal data for advertising, we do not sell or rent it, and we do not “share” it for cross-context behavioural advertising. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated checks in the Service (such as late-arrival detection or payroll calculations) run on your employer’s rules, and your employer reviews their results.
We send occasional product news to customer administrators only where the law allows, and every such email has an unsubscribe link. Service emails that you need to use the Service cannot be switched off.
5. Service providers (subprocessors)
We use a small number of providers to run the Service. Each receives only what it needs for its task and is bound by contract to protect it.
| Provider | What it does for us | Data involved |
|---|---|---|
| Hostinger (hosting provider) | Hosts the application, database, uploaded files, backups and our email server | All account, billing and customer data stored in the Service |
| Google Firebase Cloud Messaging | Delivers push notifications to the BMS Android app | Device push token and the notification text |
| Google Drive (only if a customer connects it) | Stores the backups or files the customer chooses to send to its own Google Drive | What the customer chooses to send |
| Attendance device services (only if a customer connects one) | Sends attendance punches from the customer’s device to its workspace | Employee names or IDs and punch times |
| Machine translation (only when a user asks to translate a training lesson) | Translates training lesson text | Lesson text only, no personal data |
| Open-Meteo | Weather shown on the dashboard | A location’s coordinates; no personal data |
Your browser also loads fonts from Google Fonts and, inside the portal, some open-source libraries from public content delivery networks (jsDelivr and cdnjs). Like any website request, these providers see your IP address and browser details; they receive no account or business data from us. Public data feeds that the Service reads, such as exchange rates, fuel prices and news, receive no personal data.
We will update this list before adding a new subprocessor that handles customer data. Customers can ask us to notify them of changes, as described in the DPA.
We may also disclose personal data: when the law, a court or a public authority lawfully requires it; to protect the rights, property or safety of our customers, users or BMS Prime; or to a successor if our business is merged or sold, in which case this policy continues to protect the data.
6. How long we keep data
- Account, business profile and customer data: for as long as the workspace exists. After an account is closed, we keep the data for 30 days so that an export can be requested, then delete it from our live systems within a further 30 days. Backup copies are overwritten as backups roll over, normally within 90 days.
- Billing records and payment proofs: for as long as tax and accounting law requires us to keep them.
- Demo requests and enquiries: up to 24 months after our last contact, unless you become a customer.
- Security and server logs: for a limited period, normally no longer than 12 months, unless they are needed to investigate an incident. The audit log inside a workspace is part of that customer’s data.
- Push tokens: until you sign out of the app, turn notifications off, or the token expires.
7. How we protect data
We use encrypted connections (HTTPS) everywhere, keep every company’s data separated from every other company’s, check permissions on the server for every request, store passwords only as secure hashes, offer two-step sign-in, keep an audit log of changes, and take automated backups that we test by restoring them. Read more on our Security page.
No system is perfectly secure. If a personal data breach affects you, we will notify you and, where required, the relevant authorities, as the law requires. For customer data, we notify the customer as set out in the DPA.
8. International transfers
BMS Prime serves businesses in several countries, and our providers operate data centres in different countries. Your data may therefore be stored or processed outside the country where you live, including in the United States and the European Union. Where the law requires it, we protect such transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism, and we require our providers to protect the data to the standard described in this policy.
9. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data, where we have no legal reason to keep it;
- export your data in a commonly used, machine-readable format (data portability);
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing;
- complain to your local data protection authority.
California residents have the right to know what personal information we collect, use and disclose, to access, correct and delete it, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal information for purposes that would give a right to limit its use.
How to exercise your rights. Many changes can be made directly in the Service: you can update your profile, and workspace administrators can correct records and export data at any time. For anything else, email info@bmsprime.com. We may need to verify your identity, and we answer within 30 days (or sooner where the law requires). You may use an authorised agent where the law allows. If your request concerns data a business keeps about you in its workspace, we will refer it to that business, because it decides how its data is used.
You can also change your choices on your device at any time: turn off notifications, deny camera or microphone access, or turn off biometric unlock.
10. Children
BMS Prime is a workplace tool for businesses. It is not directed to children, and accounts may only be created and used by people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. Where a customer keeps records about young workers, as the law of its country may allow, the customer is responsible for that processing.
11. The BMS mobile app
The BMS Android app (package com.newbacklink.bmsapp) is a secure way to open the same BMS Prime service on your phone. It shows the same pages as bmsprime.com, and the same rules in this policy apply. In addition:
- Notifications (optional): if you allow them, the app registers a push token with Google Firebase so that we can deliver work alerts, such as approvals and reminders. You can turn notifications off in your device settings at any time.
- Camera and files (only when you choose): the app uses the camera or your files only when you choose to take a photo or attach a file, for example a receipt or a document, and only for that upload. If your employer sets up a supervised online test that requires the camera, the test asks for camera access first and saves still pictures during the test to your employer’s workspace. The app never uses the camera in the background.
- Microphone (optional): used only when you choose voice input. Your device’s speech service turns your words into text; we do not record or store audio.
- Biometric unlock (optional): if you turn it on, your fingerprint or face check happens on your device to unlock the app. We never receive or store biometric data.
- No ads, no tracking: the app contains no advertising and no third-party analytics or tracking libraries.
To delete your app account, ask your workspace administrator, or email info@bmsprime.com. Uninstalling the app removes its data from your device.
12. Changes to this policy
We may update this policy as the Service or the law changes. We post the new version here with a new “Last updated” date and, for material changes, notify customer administrators by email or in the Service before the change takes effect.
13. Contact
Questions, requests or complaints about privacy: info@bmsprime.com. We reply within 1 business day and resolve requests within 30 days.
Last updated: 22 October 2026.