Privacy notice

Who holds what, on what basis, for how long, and what you can do about it. Written to be read, not skimmed past. Last updated 20 August 2026.

Staffbook wears three hats, and your rights depend on which one applies to you. Each section below says which hat we are wearing, what we hold, why we are allowed to, and how long it stays.

1. If you visit this website

We are the controller for this one.

• Analytics without cookies. This site counts visits with GoatCounter, which stores no cookies and builds no profile of you. We can see that a page was viewed; we cannot see who you are.
• Server logs. The site is served by GitHub Pages behind Cloudflare. Like every host, they process standard connection logs (IP address, pages requested) to run and protect the service. Legal basis: legitimate interests in keeping the site up and safe.
• The “Book a look” form. If you leave your email address, it is used to reply to you and arrange the call, and for nothing else. It is not added to a marketing list, because there is no marketing list. Legal basis: legitimate interests in answering the enquiry you made. Ask and it is deleted.

2. If you have a Staffbook login

We are the controller for your account itself.

• What we hold: your name, work email address, role, and the sign-in records needed to run a secure account.
• Why: to provide the service your organisation signed up for. Legal basis: contract.
• How long: for as long as your organisation uses Staffbook, then deleted with the rest of its data.

3. If your employer keeps your staff record in Staffbook

This is the biggest category and the one to be clearest about: your employer is the controller, and Staffbook is the processor. Your employer decides what goes in your file; we process it on their written instructions under a data processing agreement, and we do nothing else with it.

• What the file holds: employment and compliance records: training dates, DBS certificate number, dates and status (never what a disclosure says, there is nowhere to type it), the safer recruitment checklist, supervision records, rotas and hours, emergency contacts, health assessment dates and any agreed adjustments (the arrangement, not the reason for it).
• What it never holds: records about children. There is no field for one, by design.
• Who sees it: your managers, under permissions enforced in the database. You see your own record. Pay is visible to the Responsible Individual alone.
• Your rights: requests to see, correct or erase your record go to your employer, because the record is theirs. We help them answer within the legal timescales.
• How long: your employer sets retention. When an organisation leaves Staffbook, its data is exported to it and deleted in the same month.

Where the data lives

Staffbook runs on managed infrastructure: Supabase (database and private file storage), Vercel (application hosting), and Resend (email, sent from EU infrastructure). Documents are held in private storage and opened through links that expire after sixty seconds, with every open recorded in an append-only audit trail. The longer engineering answer, written for your DPO, is at the detailed version.

Your rights, whoever you are

UK GDPR gives you the right to see the data held about you, to have it corrected or erased, to restrict or object to its processing, and to receive a copy in a portable form. Where we are the controller, write to colby@staffbook.co.uk and it will be handled within a month. Where your employer is the controller, they lead and we assist.

If you think we have got something wrong and we have not put it right, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this notice changes in any way that matters, the date at the top moves and the change is described here, not slipped in quietly.