Staffology Payroll Cookie Policy
We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.
The cookies that are categorised as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site.
We also use third-party cookies that help us analyse how you use this website, store your preferences, and provide the content and advertisements that are relevant to you. These cookies will only be stored in your browser with your prior consent.
The tables below explain the cookies we use and why. To make this information as clear as possible, as well as listing the cookies we use, we’ve categorised them to help explain what they do.
Strictly Necessary Cookies
Our software uses essential cookies to perform activities strictly required for the operation and delivery of our services. These cookies enable functions that are vital to delivering the service you requested and do not require user consent.
Essential Cookies - Pendo:
When Pendo is used to enhance the product experience, such as improving usability, tracking feature engagement, or capturing user insights, it is classified as strictly necessary. These cookies help ensure our products operate effectively and continuously improve.
| Name of Cookie | Used By | Description | Expiry |
| debug-enabled | Pendo | Written and read when the following function is triggered: pendo.isDebuggingEnabled(). This gets and uses information from the cookie in several places, such as log.js, guides.js, and exports.js. | Session |
| _pendo_meta.SUB_KEY_VALUE | Pendo | Written and read to store a hash of the current metadata so that Pendo can see when it's changed and update it. | 100 days |
| _pendo_lastStepAdvanced. SUB_KEY_VALUE, _pendo_latestDismissedAutoAt. SUB_KEY_VALUE, and _pendo_finalDismissedAutoAt. SUB_KEY_VALUE | Pendo | Written and read in the web SDK to keep guides from showing again after they've been dismissed. | 10 seconds |
| active-contexts | Pendo | Written and read in the web SDK based on what is and isn't logged in the console. | 100 days |
| _pendo_guides_blocked. SUB_KEY_VALUE | Pendo | Avoid guide errors when we detect the visitor has an ad blocker. | 30 minutes; increases to 4 hours if we don't detect an ad blocker. |
| _pendo_accountId. SUB_KEY_VALUE | Pendo | Identify and record the visitor's Account ID in Pendo. | 100 days |
| _pendo_visitorId. SUB_KEY_VALUE | Pendo | Identify and record the visitor information for Pendo. | 100 days |
| _pendo_launcher-closed.SUB_KEY_VALUE | Pendo | Identify and record the visitor information for use in analytics and guide delivery. | 10 days |
| log-enabled | Pendo | Record additional details for troubleshooting purposes. | Session |
* 'Essential analytics' refers to data that is required to deliver core features of the product, such as in-app guidance and session continuity, and does not require user consent.
Essential Cookies
| Cookie | Duration | Description |
| .AspNetCore.Session | session | Maintains server-side session state required for the Staffology application to function. |
| DT | 1 year 1 month 4 days | Used by the Okta identity service during authentication to support security and device recognition. |
| xids | session | Used by the Okta identity service to maintain technical state during authentication and sign-in flows. |
| autolaunch_triggered | past | Stores technical state used by the Okta identity service during automatic sign-in flows. |
| activate_ca_modal_triggered | past | Stores temporary technical state used by the Okta identity service. |
| ARRAffinity | session | Maintains request affinity so subsequent Staffology requests are routed to the appropriate Azure App Service instance during a session. |
| ARRAffinitySameSite | session | Supports Azure App Service session affinity while applying SameSite cookie protections. |
| JSESSIONID | session | Maintains technical session state used by the identity service during the authentication flow. |
| sid | session | Maintains authenticated session state with the identity service. |
| cookieyes-* | 1 year | CookieYes sets this cookie for consent solution management. |
| .AspNetCore.Cookies | Session | Maintains the authenticated Staffology login session. |
| .AspNetCore.Antiforgery.* | Session | Helps protect Staffology forms and requests against cross-site request forgery attacks. |
| currentEmployer | 30 days | Stores the currently selected employer so Staffology can maintain the correct employer context between pages. |
| __cf_bm | 1 hour | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
Measurement & Analytical Cookies
Our software also uses cookies to measure product usage and user behaviour. These insights help us improve the services we deliver and optimise the user experience.
| Cookie | Duration | Description |
| _ga | 1 year 1 month 4 days | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. |
| _ga_* | 1 year 1 month 4 days | Google Analytics sets this cookie to store and count page views. |
| kndctr_C5944C6E6297C5D40A495CFC_AdobeOrg_identity | 1 year 1 month | Stores Adobe Experience Cloud visitor identity to recognize returning users, unify sessions, enable analytics, personalization, and audience segmentation across site. |
| com.adobe.reactor.core.visitorTracking.cookiesMigrated | Never Expires | Adobe sets this cookie in context with the cache function on the website, facilitating data transfer between Adobe DTM onto Adobe Launch. |
| com.adobe.reactor.core.visitorTracking.sessionCount | Never Expires | Adobe sets this cookie to store data on user navigation, interaction and time spent on the website and its sub-pages. |
| com.adobe.reactor.core.visitorTracking.pagesViewed | Never Expires | Adobe sets this cookie to store data on user navigation, interaction and time spent on the website and its sub-pages |
Functional Cookies
Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.
| Cookie | Duration | Description |
| employerswitch_* | 365 days | Remembers when an employer was last used to support employer navigation ordering. |
| items_per_page | 30 days | Remembers the preferred number of items displayed per page. |
| contextual-help-disabled | 365 days | Remembers whether contextual help has been disabled. |
| employees-grid-sorting | 365 days | Remembers the selected employee-grid sorting. |
| employer-grid-sorting | 365 days | Remembers the selected employer-grid sorting. |
| payroll-grid-sorting | 365 days | Remembers the selected payroll-grid sorting. |
| pre-page-* | 1 hour | Remembers pagination position within pay run entries. |
| significantChangesOnly | 365 days | Remembers whether the pay run view is filtered to significant changes only. |
| p45Type | 365 days | Remembers the selected P45 report type. |
| benefitsViewTaxYear | 1 day | Remembers the tax year selected on the benefits screen. |
| create-employee-skipwizard | 365 days | Remembers whether the employee creation wizard should be skipped. |
| create-employee-employee-type | 365 days | Remembers the last employee type selected during employee creation. |
| employer-copyyrti-fromid | 365 days | Remembers the source employer selected when copying YRTI information. |
| csv-importer-payments-*-TemplateId | ~1000 days | Remembers the last CSV payment-import template selected. |
| peopleplanner_*_code | 365 days | Remembers the mapping between a People Planner payment reference and payroll code. |
| brand | 365 days | Remembers the applicable Staffology tenant or white-label branding. |
| employee-details-tab | 5 days | Remembers the last selected employee-details tab. |
| role-details-tab | 5 days | Remembers the last selected role-details tab. |
| occupational-details-tab | 5 days | Remembers the last selected tab on the occupational policy screen. |
| spine-details-tab | 5 days | Remembers the last selected pay-spine view or effective date. |
| pay-grade-details-tab | 6 days | Remembers the last selected pay-grade view or effective date. |
| allowance-grade-details-tab | 4 days | Remembers the last selected allowance-grade view or effective date. |
| spine-allowance-details-tab | 10 days | Remembers the last selected spine-allowance view or effective date. |
| holiday-entitlement-details-tab | 6 days | Remembers the last selected holiday-entitlement view or effective date. |
| full-calendar-view | Session | Remembers the selected calendar display mode for the browser session. |
| leave-view | Session | Remembers the selected leave-list display mode for the browser session. |
| currentPaySpineEditUrl | 1 day | Remembers the return location while editing a pay spine. |
| hide-row-* | ~1000 days | Remembers whether a dismissible row or message has been hidden. |
| rti-status-filter | Session | Remembers the selected RTI status filter for the browser session. |
| dismiss-go-faster | 60 days | Remembers that the Go Faster pay-run message has been dismissed. |
| csv-importer-*-* | ~1000 days | Remembers CSV import column mappings selected by the user. |
| employee-UpdateBehaviour | ~1000 days | Remembers the selected bulk pay-run update behaviour. |
| apiexplorer.store-values | 30 days | Remembers whether the user chose to retain entered values in the API Explorer. |
| apiexplorer.use-api-key | 30 days | Remembers the authentication mode selected in the API Explorer. |
| apiexplorer.* | 1 day | Remembers API Explorer URL path or query parameter values that the user chose to retain, such as employer or employee identifiers. |
| li_gc | 6 months | Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes. |
| lidc | 1 day | LinkedIn sets the lidc cookie to facilitate data center selection. |
Performance Cookies
Performance cookies are used to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for the visitors.
| Cookie | Duration | Description |
| _dd_s | 15 minutes | Used by Datadog Real User Monitoring to associate browser activity with a short-lived monitoring session and measure application performance. |
| dd_cookie_test_* | 1 minute | Temporary cookie used by Datadog Real User Monitoring to test whether the browser supports cookies. |
| kndctr_C5944C6E6297C5D40A495CFC_AdobeOrg_cluster | 1 hour | Stores Adobe Experience Cloud Edge Network region, ensuring requests route to the nearest data center for faster analytics and personalization. |
Advertisement Cookies
Advertisement cookies are used to provide visitors with customised advertisements based on the pages you visited previously and to analyse the effectiveness of the ad campaigns.
| Cookie | Duration | Description |
| _gcl_au | 3 months | Used by Google Ads to measure advertising and conversion effectiveness. |
| test_cookie | 15 minutes | doubleclick.net sets this cookie to determine if the user's browser supports cookies. |
| MUID | 1 year 24 days | Bing sets this cookie to recognise unique web browsers visiting Microsoft sites. This cookie is used for advertising, site analytics, and other operations. |
| _uetsid | 1 day | Bing Ads sets this cookie to engage with a user that has previously visited the website. |
| _uetvid | 1 year 24 days | Bing Ads sets this cookie to engage with a user that has previously visited the website. |
| BIGipServer* | session | Maintains session affinity for the Marketo service used for marketing tracking. |
| _mkto_trk | 1 year 1 month 4 days | This cookie, provided by Marketo, has information (such as a unique user ID) that is used to track the user's site usage. The cookies set by Marketo are readable only by Marketo. |
| demdex | 6 months | The demdex cookie, set under the domain demdex.net, is used by Adobe Audience Manager to help identify a unique visitor across domains. |
| bcookie | 1 year | LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs. |
| _fbp | 3 months | Facebook sets this cookie to store and track interactions. |
Uncategorised Cookies
Other uncategorised cookies are those that are being analysed and have not been classified into a category as yet.
| Cookie | Duration | Description |
| s_inv | 1 month | No description available. |
| s_nr30 | 1 month | No description available. |
| s_tslv | 1 year 1 month 4 days | No description available. |
Purpose and Legal Basis for Processing
We use Pendo to collect information that helps us understand how users interact with our products. This insight allows us to enhance usability and provide more relevant in-app experiences.
-
Legal Basis: We rely on legitimate interest as the legal basis for placing essential cookies such as Pendo. These are critical to delivering and improving our software.
-
Consent: Where cookies are used for marketing or non-essential analytics, we will request separate user consent.
Reason/Benefit of Data Collection
| Reason/Benefit | Description |
| User Experience | Personalised walkthroughs and in-app prompts to support navigation based on actual usage patterns. |
| User Profiling | Enables targeted features such as language packs, region-specific capabilities, and usage-based software configurations. |
| Personalised engagements | Delivers contextual help, release notes, or other guidance relevant to the user’s journey. |
Data Collection and Retention
As part of the in-product user experience, we collect:
-
Email address, first name, and last name (no additional consent required).
-
Usage activity within the product (e.g., frequently used features, session duration).
-
Commercial data (e.g., company name, country code, industry, licence number).
Data is retained within Pendo for a rolling 12-month period and is automatically deleted after this time.
Data Sharing and Storage
We share data with our subprocessor Pendo. Your data is stored on secure servers within the EU. IRIS has implemented industry-standard security measures to protect personal data from loss, misuse, or unauthorised alteration or destruction, in compliance with data protection laws.
Managing Your Cookie Preferences
As Pendo is classified as strictly necessary, it does not require consent. However, for any non-essential marketing engagements, users must provide explicit consent before tracking can occur.
Your Data Rights
Under data protection law, you have the right to:
-
Access: Request copies of your personal data.
-
Rectification: Ask us to correct inaccurate or incomplete information.
-
Erasure: Request deletion of your personal data in certain circumstances.
-
Restriction: Ask us to restrict the processing of your data in certain circumstances.
-
Objection: Object to processing if we process your data based on legitimate interests.
Contact Details
Owner and Data Controller:
IRIS Group Limited (470 London Road, Slough, SL3 8QY)
Contact email:
For more information, contact our Support team by phone on 0344 815 5555 and choose option 2 for customer support, or create a support ticket.