1. Who We Are
FlexiWork Ltd is a company incorporated in England and Wales (Company Number 17116161), registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
We operate the FlexiWork platform at joinflexiwork.co.uk, which provides scheduling and wage-calculation software (the "SaaS Service") and, when launched, a managed agency platform through which we supply workers to shift-based businesses (the "Agency Platform").
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), FlexiWork Ltd is the data controller for the personal data described in this policy.
Our privacy contact: privacy@joinflexiwork.co.uk
2. What This Policy Covers
This policy covers personal data we collect and use in our capacity as a data controller. That includes data about:
- business customers and their authorised users ("Employers") who use our SaaS Service or Agency Platform;
- individuals who register with FlexiWork as workers available for shifts via the Agency Platform ("Workers"); and
- visitors to our website at joinflexiwork.co.uk.
This policy does not cover personal data that Employers upload to the SaaS Service about their own staff. When Employers use our platform to manage their workforce data, we process that data as a data processor acting on Employer instructions. That arrangement is governed by the Data Processing Agreement (Schedule 1 to our Terms of Service), not by this policy.
In plain terms: if you are an Employer using FlexiWork to manage your team's rotas and wages, this policy covers your own Account and contact data. The data about your staff members that you enter into the platform is covered separately by the Data Processing Agreement in our Terms.
3. The Personal Data We Collect
3.1 Business Customers (Employers)
When you register as a business customer or use the SaaS Service, we collect:
Account and contact information
- Your name, job title, and business email address.
- Your business name, trading name, and registered address.
- Your phone number (if provided).
Billing and payment information
- Payment card details are collected and stored by our payment processor. We receive only a tokenised reference and the last four digits of your card; we do not store full card numbers.
- Billing address and invoice history.
Platform usage data
- Log-in timestamps, features accessed, and support requests submitted.
- Any information you provide when contacting our support team.
Communications
- Records of emails, messages, or other communications between you and FlexiWork.
3.2 Workers
When you register as a Worker on the Agency Platform, we collect:
Identity and contact information
- Full legal name, date of birth, and home address.
- Email address and phone number.
- Right-to-work documentation (e.g. passport, visa, or other acceptable documents under the Immigration, Asylum and Nationality Act 2006).
Work profile information
- Previous work experience, skills, and any relevant certifications or licences.
- Preferred work locations and availability.
- Profile photograph (optional).
Financial information
- Bank account details (account number and sort code) for payroll purposes.
- National Insurance number, for payroll tax reporting purposes.
- Records of pay received for each Shift, including rolled-up holiday pay.
Shift and attendance data
- Shift bookings, clock-in and clock-out records, and timesheets.
- Ratings and reviews left by Employers following completed Shifts.
- GPS-verified location data at the point of clock-in and clock-out, to confirm attendance at the correct location.
Communications
- Records of messages exchanged through the Platform, support enquiries, and any dispute correspondence.
Sensitive personal data
- We may collect health-related information if you voluntarily disclose a medical condition relevant to a role, or if you submit a medical certificate in connection with a Shift cancellation or dispute. We will only use this information for the specific purpose for which it was disclosed.
- We do not collect data about your race, ethnicity, religion, political opinions, trade union membership, sexual orientation, or gender identity for profiling or any other purpose.
3.3 Website Visitors
When you visit joinflexiwork.co.uk, we may collect:
- Technical data, including your IP address, browser type and version, device type, operating system, and referring URL.
- Usage data, including pages visited, time spent on each page, and interactions with page elements.
- Any information you submit via our contact or sign-up forms, including your name, business name, email address, phone number, industry, and team size.
This data is collected using cookies and similar technologies. See Section 6 for full details.
4. How and Why We Use Your Personal Data
4.1 Business Customers
We use Employer personal data for the following purposes:
| Purpose | Description |
|---|---|
| Account management | Creating and maintaining your Account, verifying your identity and business details, and managing your subscription. |
| Service delivery | Providing access to the SaaS Service, processing your configurations, and maintaining your platform data. |
| Billing and payments | Processing subscription payments, generating invoices, and managing payment failures. |
| Customer support | Responding to queries, resolving technical issues, and handling complaints. |
| Service improvements | Analysing how the platform is used to improve features and fix issues. We use aggregated or anonymised data for this purpose wherever possible. |
| Legal compliance | Meeting our obligations under applicable law, including tax, financial reporting, and data protection law. |
| Security | Detecting and preventing fraud, abuse, and unauthorised access to the platform. |
| Communications | Sending service notifications (e.g. payment confirmations, feature updates, planned maintenance). Where you have opted in, we may also send marketing communications about FlexiWork products and services. |
4.2 Workers
We use Worker personal data for the following purposes:
| Purpose | Description |
|---|---|
| Registration and vetting | Verifying your identity, right to work in the UK, and relevant qualifications or certifications before you are approved to take Shifts. |
| Matching and booking | Displaying your profile to Employers for relevant Shifts, processing Bookings, and managing confirmations and cancellations. |
| Attendance tracking | Recording your clock-in and clock-out data (including GPS verification) to generate accurate timesheets. |
| Payroll processing | Calculating pay (including rolled-up holiday pay), processing weekly wage payments to your bank account, and fulfilling payroll tax reporting obligations with HMRC. |
| Ratings and feedback | Displaying Employer ratings on your profile to build your work history on the Platform. |
| Communications | Sending Shift confirmations, payment notifications, platform updates, and other service-related messages. |
| Legal compliance | Complying with employment law, tax law, right-to-work obligations, and the Agency Workers Regulations 2010. |
| Security and fraud prevention | Detecting and preventing fraudulent activity, including false timesheets or identity fraud. |
| Dispute resolution | Retaining records necessary to investigate and resolve disputes about Shifts, timesheets, or pay. |
4.3 Website Visitors
We use website visitor data to:
- maintain and improve the performance and security of our website;
- understand how visitors interact with our pages, so we can improve content and layout; and
- respond to enquiries submitted through our contact and sign-up forms.
5. Legal Bases for Processing
Under the UK GDPR, we must have a lawful basis for each type of processing we carry out. The table below sets out the legal bases we rely on:
| Legal Basis | When We Rely on It |
|---|---|
| Contract (Article 6(1)(b)) | Processing necessary to perform our contract with you — including providing the SaaS Service, processing Bookings, and paying Workers. This is our primary basis for most operational processing. |
| Legal obligation (Article 6(1)(c)) | Processing necessary to comply with a legal obligation, including right-to-work checks, payroll tax reporting, responding to regulatory requests, and retaining records as required by law. |
| Legitimate interests (Article 6(1)(f)) | Processing for our legitimate business interests where these are not overridden by your rights — including fraud prevention, platform security, service improvements, and sending service-related communications to existing customers. |
| Consent (Article 6(1)(a)) | Where you have given us clear, specific consent — including for marketing communications and for non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing. |
| Vital interests (Article 6(1)(d)) | In an emergency where processing is necessary to protect someone's life. We do not anticipate relying on this basis in the normal course of our operations. |
For sensitive personal data (such as health data), where applicable, we rely on Article 9(2)(b) (employment and social protection obligations), Article 9(2)(c) (vital interests), or explicit consent under Article 9(2)(a).
6. Cookies and Similar Technologies
Cookies are small text files placed on your device when you visit a website. We use cookies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR.
We will ask for your consent before placing any non-essential cookies on your device. You can manage your preferences at any time using the cookie settings on our website.
6.1 What Cookies We Use
| Category | Details |
|---|---|
| Strictly necessary | Cookies essential to the operation of our website and platform. These include session cookies that keep you logged in, security tokens, and cookies that remember your cookie preferences. These do not require your consent and cannot be disabled without breaking core functionality. |
| Functional | Cookies that remember your preferences and settings (e.g. language or region). These require your consent. If you decline, functionality may be reduced but the platform will remain accessible. |
| Analytics | We do not currently use analytics cookies. If we introduce analytics tools in future, we will update this policy and request your consent before they are placed. |
| Marketing | We do not currently use marketing or advertising cookies. If we do so in future, we will update this policy and obtain your consent. |
6.2 Managing Your Cookie Preferences
You can manage or withdraw your consent for non-essential cookies at any time:
- Cookie settings: Use the cookie preferences panel on our website, accessible via the link in our website footer.
- Browser settings: Most browsers allow you to refuse or delete cookies through their settings. Doing so may affect your ability to use the platform. Please refer to your browser's help documentation for instructions.
Withdrawing consent for non-essential cookies does not affect the lawfulness of any processing carried out before your withdrawal.
7. Who We Share Your Data With
We do not sell your personal data. We may share it with the following categories of recipients:
| Recipient | Purpose and Basis |
|---|---|
| Payment processor | To process subscription payments (Employers) and wage payments (Workers). We share only the data necessary for the transaction. The processor is contractually bound to handle data securely and only for this purpose. |
| Email delivery service | To send transactional emails such as account confirmations, Shift notifications, and invoices. Only your email address and the content of the message are shared. |
| HMRC and tax authorities | For payroll tax reporting obligations in respect of Workers. We are legally required to make these disclosures. |
| The Employment Agency Standards Inspectorate | If requested in connection with a regulatory inspection or investigation. |
| Employers (for Workers) | Your name, profile, ratings, and attendance record are shared with Employers for the purpose of Shift matching and Bookings. Employers are not permitted to use this data for any other purpose. |
| Workers (for Employers) | Where a Booking is confirmed, we share the Worker's name and relevant work details with you as Employer for the purpose of the Shift. |
| Professional advisers | Our solicitors, accountants, and insurers, where necessary and subject to confidentiality obligations. |
| Law enforcement and regulators | Where we are required to disclose data by law, court order, or at the request of a competent authority. We will notify you of such a request unless prohibited from doing so. |
| Prospective buyers of our business | In the event of a merger, acquisition, or sale of FlexiWork Ltd, personal data may be disclosed to the prospective buyer as part of due diligence, subject to confidentiality obligations. We will notify you before your data is transferred to a new controller under different terms. |
8. International Transfers
We store and process your personal data on servers located in the United Kingdom. We do not routinely transfer personal data outside the UK.
Where any of our sub-processors (such as payment processors or email delivery services) process data outside the UK, we ensure that appropriate safeguards are in place. These safeguards may include:
- transfers to countries that the UK Government has recognised as providing an adequate level of data protection;
- use of the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses; or
- other approved transfer mechanisms under UK GDPR Article 46.
If you would like more information about the safeguards we have in place for any specific transfer, please contact us at privacy@joinflexiwork.co.uk.
9. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:
| Category of Data | Retention Period |
|---|---|
| Account data (Employers) | For the duration of your subscription, plus 6 years after termination (to comply with HMRC requirements for business records). |
| Billing and payment records | 7 years from the date of the transaction, as required by HMRC and Companies House regulations. |
| Worker identity and right-to-work documents | 2 years after the end of the last Shift worked, or longer if required by right-to-work legislation. |
| Worker payroll records (including NI number, pay history) | 6 years after the end of the relevant tax year, as required by HMRC. |
| Shift records and timesheets | 6 years from the date of the Shift, to meet potential employment law claim limitation periods. |
| Clock-in/clock-out GPS data | 12 months from the date of the Shift, unless retained longer in connection with an active dispute. |
| Dispute records | 3 years from the date of resolution of the dispute. |
| Marketing consent records | Until you withdraw consent, plus 3 years thereafter. |
| Website enquiry data | 12 months from the date of submission, unless you become a customer. |
| SaaS platform content (Employer staff data) | 30 days after Account termination, then deleted. You may request an export within the 30-day period. See Schedule 1 to the Terms of Service. |
Where we are required by law to retain data for longer than the periods above, we will retain the minimum necessary data for the legally required period only. We will notify you if any change to applicable law requires us to retain your data for a materially longer period.
10. Your Rights Under UK GDPR
You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at privacy@joinflexiwork.co.uk. We will respond within one calendar month of receiving your request. We will not charge a fee for requests unless they are manifestly unfounded or excessive.
| Right | What It Means |
|---|---|
| Right of access (Article 15) | You have the right to request a copy of the personal data we hold about you and information about how we use it. This is sometimes called a Subject Access Request (SAR). |
| Right to rectification (Article 16) | You have the right to ask us to correct inaccurate personal data or complete incomplete data. We will action this without undue delay. |
| Right to erasure (Article 17) | You have the right to ask us to delete your personal data where there is no longer a legitimate reason for us to hold it. This right is not absolute — we may need to retain certain data to comply with legal obligations or to establish, exercise, or defend legal claims. |
| Right to restriction of processing (Article 18) | You have the right to ask us to restrict processing of your data in certain circumstances — for example, while we investigate a dispute about the accuracy of your data. |
| Right to data portability (Article 20) | Where we process your data on the basis of your consent or a contract, and by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller. |
| Right to object (Article 21) | You have the right to object to processing based on our legitimate interests. We will stop that processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms. |
| Right to withdraw consent (Article 7(3)) | Where we rely on consent as our legal basis, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. |
| Rights related to automated decision-making (Article 22) | We do not make decisions that significantly affect you based solely on automated processing without any human involvement. If this changes, we will update this policy and provide appropriate safeguards. |
Workers: If you are a Worker, some of your data (such as payroll records and right-to-work documents) must be retained by law regardless of an erasure request. We will tell you clearly which data we are legally required to keep, and why, if you make such a request.
11. Children's Data
The FlexiWork platform and services are intended solely for individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a person under 18, please contact us immediately at privacy@joinflexiwork.co.uk and we will delete it promptly.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. Where we make material changes, we will notify you by email to the address registered on your Account at least 14 days before the changes take effect. We will also update the "Effective Date" at the top of this policy.
We encourage you to review this policy periodically. The most current version will always be available at joinflexiwork.co.uk/policies/privacy-policy.
13. How to Contact Us and Make a Complaint
13.1 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at:
| privacy@joinflexiwork.co.uk | |
| Post | FlexiWork Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ |
We aim to respond to all privacy enquiries within 14 days and to complete any formal request within one calendar month.
13.2 Right to Complain to the ICO
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the ICO, which is the UK supervisory authority for data protection:
| Website | ico.org.uk |
| Phone | 0303 123 1113 |
| Post | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
We would, however, ask that you contact us first to give us an opportunity to address your concern before approaching the ICO.
— End of Privacy Policy —