Staff privacy notice

This notice explains how Swindlers Ltd (company number 17477672, 19 Aberdeen Walk, Scarborough) uses personal information about the people who work for us: employees, casual and irregular-hours workers, and agency staff. Swindlers Ltd is the controller of this information. It doesn't form part of your contract, and we may update it.

For anything about your personal information, contact [TO CONFIRM: owner or data protection contact name and email].

What we hold about you, and why

Information	Why we need it	Lawful basis
Name, contact details, date of birth, job title, start date, employment type, contracted hours, pay rate or salary	To employ you, pay you, and plan rotas. Your date of birth is also needed for young worker rules and minimum wage rates	Contract; legal obligation
Bank details, National Insurance number, payroll reference and tax information	To pay you and meet tax and pension duties	Contract; legal obligation
Emergency contact details	To contact someone if you're taken ill or injured at work	Legitimate interests; your emergency contact's vital interests
Right-to-work check: the date, the method, who checked it and any expiry date. We don't store your document numbers in our systems	To comply with immigration law	Legal obligation
Rotas, availability, shift swaps, holiday requests and balances	To plan staffing and manage your holiday entitlement	Contract; legal obligation (Working Time Regulations)
Clock-in and clock-out times and breaks	To pay you correctly, keep working time records, and check rest breaks	Contract; legal obligation
Your location when you clock in or out on your phone: a single location reading at that moment only	To confirm you're at the venue when you clock in or out. We don't track your location at any other time, and we don't show your location to managers, only whether the clock-in was at the venue	Legitimate interests (accurate time records and preventing false clock-ins). You can always clock in on the till instead
Sickness absence: dates, whether it was self-certified or covered by a fit note, the reason you give, and return-to-work notes	To manage absence, pay Statutory Sick Pay, and support you back to work	Legal obligation; employment law. Health information is special category data, processed under Article 9(2)(b) UK GDPR and Schedule 1 of the Data Protection Act 2018
Food safety, cleaning and safety checklists you complete or sign off, including any photos you take	To meet food hygiene and health and safety law, and show inspectors our records	Legal obligation; legitimate interests
Till records: your till PIN (stored securely, never readable), sales, refunds, discounts and cash handling linked to your name	To run the till, keep accurate accounts and prevent losses	Contract; legitimate interests
Logins, and an audit log of actions in our systems	To keep our systems secure and see who did what	Legitimate interests
Training records, performance and disciplinary records	To manage your employment fairly	Contract; legitimate interests; legal obligation
[TO CONFIRM: CCTV, if operated]

Who can see it

Access depends on your manager's role and is limited to what they need:

Managers can see rotas, timesheets and holiday requests for their venue.
Sickness details are visible only to people who approve absence, and to you.
Pay rates are visible only to people with wages access.
Bank details and National Insurance numbers are encrypted, visible only to the owner, and every time they're viewed it's logged.
Everyone can see the team rota and who's on holiday on a given day, but not the reason.

Who we share it with

[TO CONFIRM: payroll provider or software, e.g. Xero / BrightPay / Sage / accountant], to run payroll
[TO CONFIRM: workplace pension provider], for auto-enrolment
HMRC, and other authorities where the law requires, for example the Home Office for right-to-work purposes, and environmental health or licensing officers inspecting our records
Brevo, which sends our emails and texts (for example rota and holiday notifications), and [TO CONFIRM: hosting provider], which hosts our systems. Both act only on our instructions
anyone else only if the law requires it, or with your agreement (for example, a reference)

How long we keep it

[TO CONFIRM: these proposed periods need your approval.]

Information	How long
Your employment record, pay and tax records	6 years after you leave
Right-to-work check records	2 years after you leave (as required by the Home Office)
Timesheets and working time records	2 years (clock-in location readings: 13 months)
Sickness records	6 years after you leave, where needed for employment claims; otherwise 3 years (SSP)
Food safety and cleaning records	[TO CONFIRM: for example 2 years]
Bank details	Deleted when your final pay has been made

Your rights

You have the right to ask for a copy of your information, have it corrected, and in some cases have it deleted or restricted, or object to how we use it. You can see and update your own emergency contact and bank details in the staff hub under Me. For anything else, contact the person named above.

If you're unhappy with how we've handled your information, please talk to us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.