Payroll & employee data practices
This page supplements our Privacy Notice with specific information about how we handle the most sensitive categories of data in our platform — employee PII, banking information, and health plan data. Last updated: July 15, 2026.
Employee personal identifiers (SSNs, dates of birth)
- Collected solely to process payroll, generate tax forms (W-2, 1099-NEC, Form 941), and comply with federal and state employment law.
- Encrypted at rest using AES-256 and in transit using TLS 1.2+.
- Accessible only to account users with Owner or Admin roles. All other roles see masked values (e.g., ***-**-1234).
- Never sold, rented, or shared with third parties for marketing or advertising.
- Retained for a minimum of 7 years per IRS recordkeeping requirements. Deletion requests honored after account termination subject to applicable legal obligations.
Bank account and routing numbers
- Collected for the sole purpose of processing payroll via ACH direct deposit.
- Stored encrypted; never held in plaintext in our systems.
- Transmitted only through NACHA-compliant banking partners under data processing agreements.
- Accessible only to account users with Owner or Admin roles.
Health plan elections and benefits data
- Collected to administer benefits enrollment on your behalf.
- Treated as sensitive health-adjacent information.
- Shared only with the benefits carriers and administrators you have selected for your account.
- Not used for advertising, profiling, or any purpose other than benefits administration.
Our role as a data processor
- When you use Ogo Ops to manage employee data, we act as a data processor on your behalf.
- You, as the employer, are the data controller responsible for the lawful basis of collecting and processing your employees' personal information.
- We process that data only as directed by you and as described in our Privacy Notice and Terms of Use.
- We do not use employee data for any purpose beyond providing the Ogo Ops platform to you.
California privacy rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). To exercise any of these rights, email [email protected]. We will respond to verifiable requests within 45 days as required by law.
Right to Know
Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties with whom we share it.
Right to Delete
Request deletion of personal information we have collected from you, subject to certain exceptions required by law.
Right to Correct
Request correction of inaccurate personal information we maintain about you.
Right to Opt Out of Sale or Sharing
We do not sell personal information as defined under the CCPA. We do not share personal information for cross-context behavioral advertising.
Right to Limit Sensitive Data Use
Direct us to limit our use of sensitive personal information (including SSNs and financial account numbers) to the purposes necessary to provide our Services.
Right to Non-Discrimination
We will not discriminate against you for exercising any of these rights.
Questions about your data?
Contact our privacy team at [email protected]. For security vulnerability reports, email [email protected].