Privacy Policy

1. Who we are

TeamAgenda is a staff scheduling, time and attendance, absence and payroll-preparation service for UK businesses, available on the web at teamagenda.co.uk and as a phone app. It is provided by TeamAgenda (“we”, “us”).

For anything about this policy or your personal data, email privacy@teamagenda.co.uk.

2. Our two roles

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 we act in two different ways:

• As a data processor for your employer. When a business uses TeamAgenda to manage its staff, that business (your employer) is the data controller. It decides what information about its staff goes into TeamAgenda and what it's used for. We process that information only on the business's instructions, under our Data Processing Agreement. If you work for a business that uses TeamAgenda, your employer's own privacy notice explains how it uses your data, and your employer is the first place to go with questions or requests.
• As a data controller for our own customers and visitors. We decide how to use the details of the people who sign up and run a business account (for example retailers and their billing contacts), people who contact us, and visitors to our website.

3. What we collect

Business account holders and contacts (we are the controller)

• Name, work email, phone number and job role.
• Business details: business name, registered company name and number, VAT number, address, contact and billing details.
• Subscription and payment records (what was charged and paid, and when). We don't store full card numbers.
• Messages you send us, and records of the Terms you accepted.

Staff data a business puts into TeamAgenda (we are the processor)

Depending on what the business uses, this can include:

• Identity and contact details: name, email, phone, address, date of birth, emergency contact and profile photo.
• Employment details: job title, sites, roles, contracted hours, start and end dates, access level and payroll ID.
• Pay details: hourly rates or salary, pay supplements, and, if the business adds them, National Insurance number, tax code, student loan plan and bank details.
• Work records: schedules, shifts, punch clock times, breaks, approvals, timesheets and payroll calculations.
• Absence: holiday and other leave, balances, and sickness absence. Sickness information can be health data (a special category under UK GDPR); the business is responsible for having a lawful basis to record it.
• Documents the business uploads (for example contracts, right-to-work documents and payslips) and contracts signed in the app.
• Messages, news, events and requests (swaps, cover and open shifts) sent within TeamAgenda.
• Location: when someone punches in from the phone app at a business that requires it, the app checks the phone's location once at that moment to confirm they're at the site. We don't track location at any other time.

Collected automatically when anyone uses TeamAgenda

• Login and security records: sign-in times, IP address, device and browser type, and two-factor settings.
• An activity log of changes made in the app (who changed what, and when), which businesses rely on for their records.
• Which days someone used the website or the phone app, used only as counts to understand and support how a business uses TeamAgenda.
• A notification token, if you allow notifications in the phone app.

4. How we use it, and our lawful basis

We don't sell personal data, show advertising, or use staff data for our own marketing. We don't make automated decisions about people that have legal or similarly significant effects.

5. Cookies

We only use cookies that are strictly necessary: the ones that keep you logged in securely. We don't use advertising or analytics cookies, so we don't ask for cookie consent. The phone app keeps your login on your phone in the same way.

6. Who we share data with

We use these trusted providers (sub-processors) to run TeamAgenda. Each is bound by a contract that protects the data and only allows them to use it to provide their service to us.

When a business sets a site's location, TeamAgenda looks up the postcode with postcodes.io and shows a map from OpenStreetMap. Only the site's address or postcode is sent, never staff data.

We may also share data if the law requires it, to protect people's safety, or with a buyer if our business is sold (who would have to protect it in the same way). A business can export or download its own data, for example payroll files for its accountant; that is the business's decision as controller.

7. Where data is stored

TeamAgenda's database and files are stored in London. Some providers are US companies or deliver part of their service from outside the UK (for example email and phone notifications). Where personal data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, so it stays protected.

8. How long we keep it

• Staff data is kept for as long as the business keeps it in TeamAgenda. Businesses can delete leavers, and can set leavers to be deleted automatically after a chosen number of months.
• When a business closes its account, or asks us to, we delete all of its data, including staff logins and files, and keep only a short record that the deletion happened.
• Business account and billing records are kept while the account is open and for up to six years afterwards, for tax and accounting purposes.
• Backups are overwritten on a rolling basis, so deleted data disappears from backups within 30 days.

9. How we protect it

Data is encrypted in transit and at rest. Access inside each business is limited by role (for example, only retailers and admins can see pay and bank details, and only retailers can download payroll). Retailers and admins can be required to use two-factor login. Files are stored privately and only ever served to signed-in people with permission. Our staff only access customer data where needed to provide support or keep the service secure.

10. Your rights

Under UK GDPR you have the right to:

• ask for a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, or its use restricted, in some circumstances;
• object to processing based on legitimate interests;
• receive data you provided in a portable format.

If you work for a business that uses TeamAgenda, please make your request to your employer, because they control your data; we help them respond. You can also see and correct some of your own details yourself under My account. For data we control, email privacy@teamagenda.co.uk. We'll respond within one month.

11. Children

TeamAgenda is a workplace tool for businesses and their staff. It isn't intended for children under 13, and we don't knowingly collect their data.

12. Complaints

If you're unhappy with how we've handled your data, please contact us first at privacy@teamagenda.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

13. Changes to this policy

We'll update this policy when our services or the law change, and show the new date at the top. If a change is significant, we'll tell business account holders by email or in the app.