Here is some security and GDPR questions and answers regarding Oscar

Data Retention & Deletion

Q. How long is data collected via Oscar retained? 

A. Data is retained in line with Bright’s Data Privacy Policy: Privacy Notice | Privacy Policy | Bright 

Q. What are the deletion processes for this data, including any data held within intermediary platforms (e.g. WhatsApp or email)? 

A. Twilio logs are cleared within 30 days. WhatsApp (Meta) logs are cleared within 30 days. All other data is retained/deleted in line with Bright’s Data Privacy Policy. 

Q. Please confirm there is no function creep, during this process (Only data collection between Brightpay and WhatsApp – No Other Parties)? 

A. BrightPay, Twilio, WhatsApp (Twilio provide the gateway to send WhatsApp messages)

Geographical Storage & Transfers

Q. Where is the data stored geographically?  
 
A. Data is stored in EU data region 

Q. Are there any transfers of data outside of the UK/EU, particularly in relation to WhatsApp or other third-party services?  
 
A. Data is never at rest outside of the EU.  

Oscar messages are sent and received via Twilio and WhatsApp (Meta), which means they are processed in the US. 
 
The only data captured via Oscar in the WhatsApp conversation itself is: will this be their only job or income, their title, middle name(s), gender and address. 
 
Sensitive personal identifiers (Date of Birth, National Insurance Number, Bank Account details, and P45 details) are collected by a webform that is hosted by BrightPay in EU, meaning these details are not processed by Twilio or WhatsApp and never leave the EU.  
 

Q. If so, what safeguards are in place? 

A. WhatsApp Business messages are end-to-end encrypted as per these terms: https://faq.whatsapp.com/820124435853543 and their data processing terms are here: WhatsApp Data Processing Terms 
Twilio data protection addendum is here: Data Protection Addendum 
 

High-Risk Processing Classification

Q. Has this feature been assessed as involving any high-risk processing under GDPR (e.g. AI decision-making, profiling, or large-scale data processing)? 

A. We completed a Data Protection Impact Assessment (DPIA) before deploying Oscar, which is the formal process required under GDPR when AI is used to process personal data. The assessment confirmed that Oscar does not make any automated decisions about individuals, does not profile people, and does not process data at large scale. All data collected by Oscar is reviewed and approved by a human administrator before it enters your payroll system.

Data Subject Groups

Q. Is the feature intended solely for new employee use, or are there plans to extend the nature of Oscar AI in the future? 

A. Oscar is intended for onboarding new employees. It may extend beyond the current data gathering to, for example, facilitating legal-right-to-work checks.

Security & Validation Controls

Q. Are there any additional validation or verification controls beyond formatting and manual approval? 

A. Oscar conducts the same validation checks that BrightPay currently does already.

Q. Will there be an audit trail functionality? 

A. All Oscar conversations have a full audit trail, although this is not fully exposed in the user interface at present. We are working to expose a full conversational audit trail in the user interface of Oscar.