Privacy Policy

1. Introduction & Operating Scope

StaffSync Portal ("StaffSync", "we", "us", or "our") provides a multi-tenant cloud Software-as-a-Service (SaaS) workforce management platform. Our platform enables businesses and employers ("Customers" or "Clients") to manage employee directories, shift scheduling, timeclock attendance, leave and absence records, and gross payroll preparation.

This Privacy Policy explains how personal data is collected, used, processed, stored, and protected across our public website (www.staffsyncportal.com), Client Admin Dashboards, and Employee Self-Service Portals. We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025.

2. Who We Are & Contact Details

StaffSync Portal is operated in the United Kingdom. For data protection enquiries, exercising data subject rights, or questions regarding this Privacy Policy, please contact our data protection team:

3. Our Operational Roles: Controller vs Processor

Under UK data protection law, our responsibilities depend on the context in which personal information is processed:

4. Categories of Personal Data Handled

We process the following categories of personal data across the platform:

• Account & Workspace Administration: Names, business email addresses, company names, business phone numbers, physical addresses, user roles, and account status.
• Authentication & Security Data: Cryptographically hashed passwords (using bcrypt; plaintext passwords are never stored), cryptographically signed session tokens (JWT HS256), expiring token hashes for password resets and employee invitations, login timestamps, and lockout records.
• Workforce & Profile Records: Employee codes, employee full names, job titles, department assignments, phone numbers, email addresses, employment start dates, employment status, contract types, contracted weekly hours, preferred weekly hours, and emergency contact details.
• Rota & Scheduling Data: Shift assignments, start and end times, shift notes, published rotas, employee availability submissions, shift swap requests, and open shift claims.
• Attendance & Timeclock Data: Clock-in and clock-out timestamps, recorded break minutes, calculated total hours, timesheet period summaries, lateness markers, missing clock-out records, and manager correction logs.
• Location & Work Location Verification Data: Employer-configured Work Location coordinates and allowed geofence radii; one-time device geolocation coordinates, accuracy readings, and distance calculations captured exclusively during clock-in and clock-out actions; verification statuses; and manager review decisions.
• Leave, Holiday & Absence Data: Holiday allowance allocations, remaining balances, holiday request dates and reasons; absence types (such as Sickness, Unpaid Leave, Compassionate, Other), absence date ranges, and employee-submitted or manager-recorded reasons.
• Gross Payroll Preparation Data: Hourly pay rates, overtime rates, salary structures, effective date histories, derived gross pay calculations, overtime pay, gross adjustment entries, and labour cost reporting summaries.
• Communications & Notification Data: In-app notification messages, notification preference choices (in-app and email toggles), transactional email delivery records, and public contact form messages.
• Documents & Compliance Data: Metadata for employee documents (titles, document types, expiry dates, external URL references, in-app policy acknowledgement text, Google Drive file references where configured), and compliance tracking checklists.
• Subscription & Payment Data: Stripe customer identifiers, Stripe subscription identifiers, billing contact email, plan status, and transaction summaries. Full payment cardholder numbers are processed directly by Stripe and are never stored on our servers.
• Persistent Audit & Technical Logs: Security and operational activity logs recording key workspace actions, entity modifications, timestamped actor identities, browser/server network logs, and essential session identifiers.

5. Location Data & Attendance Verification Policy

StaffSync includes an optional location-verified attendance feature designed to assist employers in verifying that attendance timestamps correspond to assigned work premises. We apply strict privacy-by-design safeguards to location data:

• One-Time Action Trigger: Geolocation is requested solely and exclusively at the moment an employee clicks "Clock In" or "Clock Out" via their browser.
• NO Continuous or Background Tracking: StaffSync does not track employee location continuously, does not poll GPS coordinates in the background, does not monitor movements between shifts, and does not operate live tracking maps.
• User Control & Permission Testing: Device location access is controlled by browser permissions. When a user tests location permission in the interface, coordinates are discarded immediately and are never saved or transmitted.
• Fail-Safe Execution: If location permission is denied, unavailable, timed out, or outside the designated radius, the employee's clock record is never blocked. The record is created and flagged for managerial review.
• Data Minimization & Scoped Access: Raw coordinates are excluded from standard shift listings, CSV reports, and Master Admin oversight consoles. Raw coordinates can only be viewed on-demand by authorized managers with specific attendance management permissions.
• Audited Evidence Views: Manager access to raw coordinate evidence is recorded in our persistent audit log (ATTENDANCE_LOCATION_EVIDENCE_VIEW).
• No Automated Disciplinary Action: StaffSync provides location verification solely as an informational review signal. The platform does not make automated wage deductions or automated disciplinary decisions.

6. Special Category Data: Sickness & Health Information

When workers record sickness absence or employers log absence notes, the free-text reason and notes fields may contain information relating to physical or mental health. Health data constitutes "special category personal data" under Article 9 of the UK GDPR.

Where workforce sickness information is stored on a Customer's instructions, StaffSync generally processes this data as a Data Processor on behalf of the Customer. The Customer (as Data Controller) is responsible for establishing an appropriate lawful basis under Article 6 and identifying a valid special category condition under Article 9(2) (such as employment, social security, and social protection obligations) under UK data protection law.

We encourage all users to practice data minimization by recording only necessary operational sickness notes without entering detailed medical histories.

7. Gross Payroll Preparation Boundary

StaffSync provides timecard aggregation, hourly rate calculations, gross wage estimations, and labour-cost reporting to assist employers in preparing payroll data for review and export.

Operational Boundary: StaffSync does not calculate net pay, does not calculate income tax (PAYE), National Insurance, student loans, or pension contributions, does not generate statutory payslips, and does not submit Real Time Information (RTI) returns to HM Revenue & Customs (HMRC). StaffSync does not provide professional tax, payroll, or legal advice. Customers remain responsible for reviewing prepared figures and using appropriate payroll processes, software, and professional advice where required.

8. Lawful Bases for Processing (Controller Processing)

Where StaffSync acts as a Data Controller, we process personal data under the following specific lawful bases under Article 6 of the UK GDPR:

• Performance of a Contract / Pre-Contractual Steps (Article 6(1)(b)): Managing Customer account registration, provisioning workspace environments, delivering core workforce management services, authenticating user sessions, taking steps at a prospective customer's request prior to entering into a contract, and sending essential service onboarding communications.
• Legitimate Interests (Article 6(1)(f)): Maintaining platform security, monitoring system health, investigating operational errors, maintaining persistent security audit trails, preventing fraud, and responding to general support, product, or business enquiries.
• Legal Obligation (Article 6(1)(c)): Maintaining statutory financial, tax, and billing records, handling statutory data protection complaints, and complying with applicable regulatory obligations or lawful authority requests.
• Consent (Article 6(1)(a)): Where consent is required for optional storage or access technologies, we rely on the consent choices you provide through our Cookie Preference Centre. We also retain the necessary first-party preference record so that StaffSync can remember and apply those choices.

Note: For workforce records uploaded or entered into a workspace by our Customers, the Customer acts as the Data Controller and determines its own lawful bases under UK GDPR.

9. Third-Party Service Providers (Subprocessors)

We share personal data with trusted third-party service providers necessary to operate the platform:

• Vercel Inc.: Application hosting, serverless edge routing, and Content Delivery Network (CDN) services.
• Neon (Neon, LLC / Databricks, Inc.): Managed cloud PostgreSQL database infrastructure.
• Stripe Payments Europe, Limited / Stripe, LLC: Subscription payment processing, checkout sessions, and customer billing portal management.
• Resend (Plus Five Five, Inc.): Transactional email distribution for invitations, security alerts, and system notifications.
• Google LLC (Google Drive API): Platform-configured cloud document storage option for employee files, certificates, and policy records.
• Google LLC (Gemini) / OpenAI OpCo, LLC: Artificial intelligence providers supplying draft scheduling suggestions for the AI Rota Assistant and summary tools, depending on the configured AI provider.

10. International Data Transfers

Some of our third-party infrastructure providers maintain servers or operations in jurisdictions outside the United Kingdom, including the United States.

Where personal information is transferred outside the UK, we ensure appropriate safeguards recognised under applicable UK data protection law are implemented where required (such as the UK Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement (IDTA), the UK Extension to the EU-US Data Privacy Framework, or recognised adequacy arrangements).

11. Data Retention Principles

We apply principled data retention standards to ensure personal data is held no longer than necessary:

• Active Workspace Data: Customer workforce directories, rotas, attendance timestamps, and leave logs are maintained during the active subscription lifecycle of the Customer's workspace.
• Financial & Billing Records: Invoices, billing summaries, and subscription event records are retained for the statutory period required under UK tax and corporate reporting law (typically at least six years from the end of the relevant financial year).
• Security & Audit Logs: System audit logs and authentication records are retained persistently for security review, fraud prevention, and regulatory accountability.
• Ephemeral Security Tokens: Password reset tokens, recovery tokens, and onboarding invitation tokens are time-limited, expire automatically, and become invalid upon use.
• Workspace Deletion: Workspace owners can initiate workspace data deletion through platform administrative controls. Detailed retention schedules are maintained as part of our ongoing compliance governance.

12. Technical & Organizational Security Safeguards

We implement defence-in-depth technical safeguards to protect personal data against unauthorized access, loss, or alteration:

• Tenant Isolation: Logical workspace isolation enforced server-side across all database queries.
• Role-Based Access Controls (RBAC): Granular permissions restricting features between Master Admins, Client Admins, Managers, Viewers, and Employees.
• Cryptographic Password Hashing: Passwords hashed with bcrypt; plaintext credentials are never stored.
• Signed Session Tokens: Authenticated sessions managed via cryptographically signed JWTs (HS256) stored in HttpOnly, SameSite=Lax, Secure cookies.
• Subdomain Segmentation: Administrative control planes separated from public and employee routing via Next.js middleware.
• Stripe Webhook Verification: Cryptographic HMAC signature verification on all incoming billing webhooks.
• CSV Export Sanitization: Automatic formula escaping to mitigate spreadsheet injection risks when downloading CSV files.
• Defensive HTTP Headers: Strict-Transport-Security (HSTS), X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and Permissions-Policy headers.

13. Data Subject Rights

Under UK GDPR and the Data Protection Act 2018, individuals have specific statutory rights regarding their personal data:

• Right of Access (Article 15): The right to obtain confirmation and a copy of personal data processed about you.
• Right to Rectification (Article 16): The right to request correction of inaccurate or incomplete records.
• Right to Erasure (Article 17): The right to request deletion of personal data where no overriding legal grounds require retention.
• Right to Restriction of Processing (Article 18): The right to restrict processing under certain statutory conditions.
• Right to Data Portability (Article 20): The right to receive personal data in a structured, machine-readable format.
• Right to Object (Article 21): The right to object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time.

How to Exercise Your Rights

Where StaffSync is the Controller: For direct Customer account data, platform login credentials, billing records, public contact enquiries, or platform security records (including where employee users interact directly with StaffSync platform security features), you can exercise your rights by emailing support@staffsyncportal.com or using our Contact Form.

Where Your Employer is the Controller: For workforce management records entered or managed by your employer (such as shift schedules, attendance records, holiday allocations, and absence notes), your employer acts as the Data Controller. Requests concerning employer-managed records should normally be submitted directly to your employer's HR or management team. Where required by law, StaffSync assists employer Customers in fulfilling valid data subject requests.

14. Cookies & Storage Technologies

StaffSync uses strictly necessary session cookies to authenticate users and maintain secure logins. We also use browser local storage to record visual theme choices and notice acknowledgments. We do not currently load third-party advertising or cross-site tracking cookies.

For a complete inventory of all cookies and storage keys, their lifespans, and instructions on managing your preferences, please view our full Cookie & Storage Technologies Policy.

15. Data Protection Complaints & Regulatory Oversight

In accordance with UK data protection legislation, including the complaint handling requirements under the Data (Use and Access) Act 2025:

A. Raising a Complaint with StaffSync

If you have a concern or complaint regarding how StaffSync has handled your personal data where StaffSync acts as a Data Controller, you may raise a formal data protection complaint through our preferred channels:

• By Email: Send your complaint to support@staffsyncportal.com, including "Data Protection Complaint" in the email subject line.
• Via the Contact Form: Submit an enquiry via our Contact Form selecting "Data protection/privacy request" from the enquiry options and clearly stating in your message that you are raising a data protection complaint.

While these are our preferred contact routes, a data protection complaint submitted through any other StaffSync communication channel will still be recognized and routed into our complaints process.

When a data protection complaint is submitted regarding processing for which StaffSync is the controller:

• StaffSync will acknowledge receipt of your complaint within thirty (30) days of receipt;
• StaffSync will take appropriate steps to investigate the complaint without undue delay;
• StaffSync will inform you of the outcome of the investigation and any steps taken in response.

For complaints regarding workforce records managed by your employer (the Data Controller), complaints should normally be directed to your employer in the first instance.

B. Complaining to the Information Commissioner's Office (ICO)

You have the statutory right to lodge a complaint with the UK supervisory authority:

16. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect product updates, operational changes, or legal and regulatory developments. Any modifications will be posted directly to this page, and the "Last updated" date at the top will be revised accordingly.