HCM Integrations & Analytics Hub logo with text around a circle conating a graphic of three people in a rising bar graph split with an right upward arrow.
Tap Innovations Logo and Paycor logo side-by-side
Privacy Notice

Privacy Notice

How TAP Innovation LLP collects, uses, stores, shares, and protects personal information when you visit tapinnov.com or engage with our software integration, analytics, and data migration services.

GDPR
TDPSA
HIPAA
SOC 2
Last Updated: June 1, 2026

privacy@tapinnov.com

TAP Innovation LLP — Privacy Notice


This Privacy Notice describes how TAP Innovation LLP (“TAP Innovation,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you visit https://tapinnov.com or engage with our software integration, analytics, data migration, and related SaaS solutions (collectively, the “Services”). We operate primarily as a data processor on behalf of our business clients and, in limited circumstances, as a data controller in our own right.

Privacy at a Glance


The summary below provides a quick overview of our privacy practices. Please read the full Notice for complete details.

What We CollectIdentifiers, employment records, financial data, tax information, system login IDs, IP addresses, and usage metadata.

How We Use ItTo deliver contracted software integration, data migration, payroll processing, analytics, and to maintain security and audit logs.

Do We Sell Your Data?No. TAP Innovation LLP does not sell personal information to third parties.

Who Sees Your Data?Only authorized personnel with role-based access. Azure is our CSP. No data is shared for marketing purposes.

How Long We Keep ItGenerally up to one year post-engagement. Deletion requests are fulfilled within 90 days of DSAR approval.

Your RightsAccess, correction, deletion, and portability rights. Contact privacy@tapinnov.com for all privacy requests.

Data SecurityAES-256 encryption at rest, TLS 1.2+ in transit, Azure RBAC, MFA, Azure Key Vault, and continuous monitoring.

ChildrenServices are not directed at individuals under 13 or under 18.

1. Introduction


TAP Innovation LLP is a software integration, analytics, and data migration company headquartered at 6210 N Belt Line Rd #150, Irving, TX 75063, United States. We are committed to protecting the privacy and security of personal information that we process on behalf of our clients and their employees in connection with our services.

This Privacy Notice describes how TAP Innovation collects, uses, stores, shares, and protects personal information when you visit our website at https://tapinnov.com or engage with our software integration, analytics, data migration, and related SaaS solutions (collectively, the “Services”).

We operate primarily as a data processor on behalf of our business clients (“Controllers”) and, in limited circumstances, as a data controller in our own right. This notice addresses both roles where applicable.

By using our Services or providing us with personal information, you acknowledge that you have read and understood this Privacy Notice.

2. Scope of This Privacy Notice


This Privacy Notice applies to:

  • Personal information collected through the TAP Innovation website (https://tapinnov.com) and associated digital properties
  • Personal information processed by TAP Innovation in connection with the delivery of our data migration, software integration, analytics, and IT services
  • Information about prospective clients, vendors, and business contacts
  • Employee and end-user personal data that our clients entrust to us for processing as part of our service engagements (including HR, payroll, and related records)

This Privacy Notice does not apply to:

  • Third-party websites or services that may be linked from our website
  • Personal information processed solely by our clients as data controllers under their own privacy notices
  • Anonymous or aggregated data that cannot reasonably identify an individual

TAP Innovation currently provides Services nationwide within the United States. We do not actively target users outside the United States at this time. However, applicable provisions of GDPR, HIPAA, the Texas Data Privacy and Security Act (“TDPSA”), and ISO 27701 are integrated into our practices as described below.

3. Information We Collect


TAP Innovation collects personal information in the course of providing services to its business clients and their employees. We only process data necessary for the specified service purpose.

3.1 Personal Data (Provided by Clients or Their Employees)


We collect the following categories of personal data primarily through direct engagement with our clients’ HR, payroll, and enterprise systems:

  • Identifiers: Employee name, employee ID, email address, contact number and postal address, account name and user ID (passwords are never stored in plain text)
  • Employment and Professional Information: Employee role, department, and title; compensation, attendance records, and timesheets; employment history and HR records
  • Financial Information: Bank account details and salary payment information; tax deductions and financial liabilities
  • Records Information: Employment contracts and personnel files; tax forms (including W-2, W-3, Form 941, Form 940); benefits, deductions, and garnishment information

3.2 Sensitive Data


In the course of payroll migration and tax-related service engagements, TAP Innovation may process the following categories of sensitive personal data on behalf of its clients:

  • Tax identifiers, including Social Security Numbers (SSNs) or equivalent government-issued identifiers
  • Income details and tax return information
  • Health insurance and benefits-related information (where provided by client HR systems)

Such sensitive data is processed exclusively as a data processor under explicit instruction from the data controller (our client). TAP Innovation does not use sensitive data for any secondary purpose, and access is strictly controlled as described in Section 8 (Data Security Measures).

HIPAA ConsiderationWhere our services involve the processing of Protected Health Information (PHI) as defined under HIPAA, TAP Innovation operates as a Business Associate and enters into appropriate Business Associate Agreements (BAAs) with covered entities.

3.3 Automatically Collected Data


When you visit https://tapinnov.com or use our web-based services, we automatically collect certain technical information:

  • IP address and approximate geographic location based on IP
  • System logs and usage metadata
  • Browser type and operating system
  • Pages visited, session duration, and referring URL

This information is collected automatically via system logs and is used solely for security monitoring and audit logging purposes. It is not shared with third parties.

4. How We Use Information


TAP Innovation uses personal information only for the purposes for which it was collected or as otherwise described in this Privacy Notice. The primary purposes of our data processing activities include:

  • Service Delivery: To perform data migration, software integration, payroll processing, analytics, and related IT services as contracted by our clients
  • Payroll and HR Processing: To process employment records, compensation, tax forms, benefits, and related data on behalf of employer-clients
  • Authentication and Access Management: To provide secure system access through Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA)
  • Security and Audit: To monitor system usage, maintain audit logs, detect unauthorized access, and respond to security incidents
  • Compliance: To fulfill legal, regulatory, and contractual obligations, including applicable IRS reporting requirements and data protection laws
  • Client Communication: To respond to inquiries, support requests, and communicate service-related updates
  • Service Improvement: To analyze aggregated, anonymized usage patterns to improve our platform and services

TAP Innovation does not currently use personal data for automated decision-making or profiling that produces legal effects. We do not use personal data for advertising purposes, do not sell personal information, and do not use personal data to create consumer profiles for behavioral marketing.

5. Legal Basis for Processing


TAP Innovation processes personal data on one or more of the following legal bases, depending on the nature of the processing activity:

  • Contract Performance: Processing necessary for the performance of a contract with our business clients, including data migration, payroll processing, and software integration services
  • Legitimate Interests: Processing necessary for our legitimate business interests, including maintaining service security, detecting fraud, and improving our platform
  • Legal Obligation: Processing necessary to comply with applicable legal obligations, including tax reporting and employment law compliance
  • Consent: Where required by law, particularly for optional marketing communications, we obtain explicit consent prior to processing. Consent may be withdrawn at any time by contacting privacy@tapinnov.com
  • Controller Instructions (Processor Role): In our capacity as a data processor, we process personal data only pursuant to documented instructions from the data controller (our client)

6. How We Share Information


TAP Innovation does not sell personal information. We do not share personal data with third parties for their independent marketing or commercial purposes. We may share personal information in the following limited circumstances:

6.1 Azure


We use Azure as our Cloud Service Provider (CSP). Contact information (such as name, company, and email) provided by prospective or current clients may be stored in Azure cloud infrastructure.

6.2 Legal and Regulatory Disclosure


We may disclose personal information where required to:

  • Comply with applicable laws, regulations, court orders, or valid legal process from governmental authorities
  • Protect the rights, property, or safety of TAP Innovation, its clients, or the public
  • Investigate, prevent, or address suspected fraud, security incidents, or violations of our Terms of Service
  • Respond to regulatory examinations, audits, or enforcement actions

6.3 Business Transfers


In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of our assets, personal data we hold may be transferred to the acquiring entity, subject to confidentiality obligations and continued compliance with this Privacy Notice. Affected individuals will be notified as required by applicable law.

6.4 No Other Third-Party Sharing


As of the effective date of this Notice, TAP Innovation does not share personal information with any other third-party vendors, service providers, advertising networks, data brokers, or strategic partners. Reports provided to any party contain only anonymized or aggregated data.

7. Data Retention


TAP Innovation retains personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law or contract.

  • Active Engagement Data: Generally retained for up to one (1) year following the conclusion of the engagement, unless a longer period is required by law or contract
  • Tax and Financial Records: May be retained for up to seven (7) years to comply with IRS recordkeeping requirements
  • Audit Logs: Retained in accordance with our security monitoring requirements, generally for a minimum of twelve (12) months
  • Data Subject Access Requests (DSARs): Logs of all DSARs are maintained for legal and accountability purposes

7.1 Data Deletion


When personal data is no longer required, TAP Innovation securely purges or anonymizes it from our systems. Upon receiving a valid and approved deletion request, we will complete the deletion process within ninety (90) days of approval. Some data may be retained in anonymized form for aggregate analytics or as required by law beyond this period.

Upon termination of a client contract, client data is returned or deleted in accordance with the terms of the applicable services agreement.

8. Data Security Measures


TAP Innovation takes data security seriously and has implemented a comprehensive set of administrative, technical, and organizational safeguards to protect personal information from unauthorized access, disclosure, alteration, or destruction.

8.1 Technical Safeguards


  • Encryption at Rest: All data stored in our systems is encrypted using AES-256 encryption
  • Encryption in Transit: All data transmitted between systems is protected using TLS 1.2 or higher
  • Cloud Infrastructure Security: Data is hosted on Microsoft Azure, with Azure Firewall, Network Security Groups (NSGs), and private endpoints
  • Access Controls: Managed through Azure Role-Based Access Control (RBAC) and enforced with Multi-Factor Authentication (MFA)
  • Key Management: Sensitive PII is protected using Azure Key Vault for encryption key management
  • Data Masking: Data masking and secure storage mechanisms are applied where applicable
  • Monitoring and Detection: Continuous security monitoring via Azure Security Center and Microsoft Sentinel; database audit logs maintained for all access to sensitive data

8.2 Administrative Safeguards


  • Access to personal information is restricted to authorized personnel only, on a need-to-know basis consistent with the principle of least privilege
  • All database access is enforced through RBAC, ensuring individuals can only access data categories required by their role
  • Employees and contractors with access to personal data are subject to confidentiality obligations
  • A Data Subject Access Request (DSAR) process is in place, and all requests are logged and tracked

8.3 Incident Response


In the event of a data security incident, TAP Innovation will take prompt corrective action and notify affected clients and, where required by law, affected individuals and relevant regulatory authorities within applicable timeframes.

Data Breach Notification Timeline: We notify affected parties without undue delay and not later than 72 hours for privacy-related data, or within 60 days for HIPAA-regulated data.

SOC 2 AlignmentTAP Innovation’s security practices are designed to align with the Security, Availability, Confidentiality, and Privacy Trust Service Criteria of the SOC 2 framework. Our use of RBAC, encryption, audit logging, and continuous monitoring reflects these principles.

9. International Data Transfers


TAP Innovation is a U.S.-based company, and all personal data we process is currently stored and processed within the United States on Microsoft Azure infrastructure. We do not transfer personal data outside of the United States in the ordinary course of our operations.

Should our business operations expand to involve international data transfers in the future, we will ensure that any such transfers comply with applicable data protection law, including, where applicable, GDPR requirements for transfers to third countries (e.g., Standard Contractual Clauses, adequacy decisions, or other appropriate safeguards). This Privacy Notice will be updated accordingly.

GDPR NoteFor any EU/EEA data subjects whose personal data may be processed by TAP Innovation in connection with cross-border service engagements, we will implement the requisite GDPR-compliant transfer mechanisms prior to processing.

10. Your Privacy Rights


TAP Innovation respects your rights over your personal information. The rights available to you may vary depending on your jurisdiction. To exercise any of the rights described below, please submit a written request to privacy@tapinnov.com. We will respond within the timeframes required by applicable law and will verify your identity before processing any request.

GDPR

EU/EEA Residents — 30 day response

  • Right of Access (Art. 15)
  • Right to Rectification (Art. 16)
  • Right to Erasure (Art. 17)
  • Right to Restriction of Processing (Art. 18)
  • Right to Data Portability (Art. 20)
  • Right to Object (Art. 21)
  • Right Not to Be Subject to Automated Decision-Making (Art. 22)

TDPSA

Texas Residents — 45 day response (+45 day extension)

  • Right to Know
  • Right to Correct
  • Right to Delete
  • Right to Data Portability
  • Right to Opt Out of targeted advertising, sale, or profiling

HIPAA

Exercisable through the Covered Entity

  • Right of access to PHI maintained by the Covered Entity
  • Right to request amendments to PHI
  • Right to an accounting of disclosures
  • Right to request restrictions on certain uses and disclosures

10.4 SOC 2 Privacy Trust Services Criteria


TAP Innovation’s data processing practices are designed to align with the Privacy criteria of the SOC 2 Trust Services framework, which includes commitments to:

  • Notice and Communication: Providing clear notice regarding the collection, use, and disclosure of personal information
  • Choice and Consent: Obtaining consent where required and respecting data subject choices
  • Collection: Limiting collection of personal information to that which is necessary for the identified purpose
  • Use, Retention, and Disposal: Using and retaining personal information only as described in this Notice and disposing of it securely when no longer needed
  • Access: Providing data subjects with access to their information and procedures to correct inaccuracies
  • Disclosure to Third Parties: Disclosing personal information to third parties only as described in this Notice
  • Security: Protecting personal information from unauthorized access, disclosure, modification, or destruction

11. Cookies and Tracking Technologies


TAP Innovation uses cookies and similar technologies on its website. Cookies are small data files stored on your device that help us operate and improve our platform.

11.1 Types of Cookies We Use


  • Strictly Necessary Cookies: Required for the operation of our website, including session management and authentication
  • Analytics Cookies: Used to collect information about how visitors interact with our website for usage monitoring and service improvement. Data is aggregated and anonymized where possible
  • Functionality Cookies: Used to remember your preferences and settings to improve your experience

We do not use marketing cookies or allow third-party advertising cookies on our Services.

11.2 Cookie Management


You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website or services. Most browsers allow you to view and delete cookies, block all cookies or third-party cookies, and accept or reject cookies on a site-by-site basis.

Global Privacy Controls (GPC)As of the effective date of this Notice, our website does not automatically respond to GPC signals. We are evaluating our obligations under applicable state laws and will update this Notice accordingly. In the interim, you may opt out of non-essential cookies by adjusting your browser settings or by contacting privacy@tapinnov.com.

12. Third-Party Links and Services


Our website and services may contain links to third-party websites or services, including Zoho (our CRM platform). TAP Innovation is not responsible for the privacy practices of such third parties and this Privacy Notice does not apply to their data practices.

We encourage you to review the privacy notices of any third-party websites or services you visit or use. The inclusion of a link on our website does not imply our endorsement of the third party’s privacy practices.

When you interact with Zoho-powered forms or portals on our website, the information you submit may be processed by Zoho in accordance with their own privacy policy. We maintain data processing restrictions with Zoho to limit the use of any shared information to the provision of CRM services to TAP Innovation.

13. Children’s Privacy


The Services provided by TAP Innovation are not directed to, and we do not knowingly collect personal information from, individuals under the age of 13 or individuals under the age of 18. Our Services are designed for and marketed to businesses and their adult employees.

If we become aware that we have inadvertently collected personal information from a minor without appropriate parental or guardian consent, we will take prompt steps to delete such information from our records. If you believe we may have collected information from a minor, please contact us at privacy@tapinnov.com.

14. Changes to This Privacy Notice


TAP Innovation reserves the right to update or modify this Privacy Notice at any time to reflect changes in our data practices, applicable law, or business operations. When we make material changes to this Notice, we will post the updated Privacy Notice on our website with a revised “Effective Date,” update the version number of the document, and where required by applicable law or where changes are material, provide additional notice such as email communication to registered clients or a prominent notice on our website.

These changes might be minor, such as updating an address or fixing a typo, or they might be material, such as making a change that affects yourThese changes might be minor, such as updating an address or fixing a typo, or they might be material, such as making a change that affects your rights. If we make changes that affect your rights, we will provide advance notice to you. We will comply with applicable law with respect to any changes we make to this notice and seek your consent to any material changes if required by applicable law.

Your continued use of our Services following the posting of changes constitutes your acceptance of the updated Notice.These changes might be minor, such as updating an address or fixing a typo, or they might be material, such as making a change that affects your rights. If we make changes that affect your rights, we will provide advance notice to you. We will comply with applicable law with respect to any changes we make to this notice and seek your consent to any material changes if required by applicable law.

Your continued use of our Services following the posting of changes constitutes your acceptance of the updated Notice.

15. Contact Information


If you have any questions, concerns, or requests regarding this Privacy Notice, our data practices, or the exercise of your privacy rights, please contact us using the information below:

Company TAP Innovation LLP
Privacy Contact Sunil Ravi
Privacy Email privacy@tapinnov.com
Website https://tapinnov.com
Registered Address 6210 N Belt Line Rd #150, Irving, TX 75063, United States
DSAR Process Submit a written request to privacy@tapinnov.com. Include your full name, a description of your request, and sufficient information to verify your identity. We aim to respond within 45–60 days.
Response Time 30 days (GDPR) | 45 days (TDPSA, extendable by 45 days) | 60 days (HIPAA)
GET IN TOUCH

Questions About Your Privacy?

Reach out to our Privacy Team for any questions about this Notice, your data rights, or to submit a DSAR.

Contact Privacy Team

Regional Addenda


Addendum A

Texas Residents (TDPSA)

This Addendum supplements our Privacy Notice for residents of Texas and is provided in compliance with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024.

  • Sensitive Data: We collect sensitive data including precise geolocation (if applicable), financial data, and tax identifiers, processed only as a data processor under instruction from our business clients
  • Sale of Personal Data: TAP Innovation does not sell personal data as defined under TDPSA
  • Targeted Advertising: TAP Innovation does not engage in targeted advertising
  • Profiling: TAP Innovation does not engage in profiling that produces legal or similarly significant effects
  • Appeal Rights: Appeal a response by contacting privacy@tapinnov.com with subject line “Privacy Rights Appeal.” We respond within 60 days; denied appeals may be escalated to the Texas Attorney General

Addendum B

GDPR (EU/EEA Data Subjects)

While TAP Innovation’s Services are currently U.S.-focused, this section governs the processing of personal data of EU/EEA individuals to the extent such data is processed by us.

  • Data Controller vs. Processor: TAP Innovation may act as a data controller for its own client and vendor contact data, and as a data processor for data processed on behalf of clients
  • Data Protection Officer (DPO): TAP Innovation has not formally designated a DPO at this time. Privacy inquiries should be directed to privacy@tapinnov.com
  • Supervisory Authority: EU/EEA residents have the right to lodge a complaint with their local data protection supervisory authority
  • Transfers: All personal data is currently processed in the United States. Where GDPR applies, we will implement appropriate transfer safeguards (e.g., Standard Contractual Clauses) prior to processing

Addendum C

HIPAA Business Associate Obligations

Where TAP Innovation processes Protected Health Information (PHI) or Electronic PHI (ePHI) in connection with its services to HIPAA Covered Entities:

  • TAP Innovation acts solely as a Business Associate and will execute a Business Associate Agreement (BAA) with each applicable Covered Entity
  • PHI will only be used or disclosed as permitted under the applicable BAA and HIPAA
  • Appropriate administrative, physical, and technical safeguards are implemented as required by the HIPAA Security Rule
  • Any breach of unsecured PHI will be reported to the applicable Covered Entity in accordance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D)
TAP Innovations | the App Place