Privacy notice

Your employer, Clean4Me LTD, 2 Parade Spur North, Elgin IV30 6AL, decides what is recorded here and why. In data protection terms they are the controller.

Worksheets is the software they use to do it, and processes that information only on their instructions. Questions about your own record go to your employer at clean4mepayroll@gmail.com.

• Your name, work email address, start date and payroll reference.
• Which sites you are assigned to, and whether your account is active.
• The shifts you log: date, start and finish time, site, and any description you add.
• Your timesheets, when you submitted them, and whether they were approved.
• Holiday and unpaid leave: the dates, the hours, and any reason you choose to give.
• Requests to change a shift after submitting, and the reason given.
• Documents shared with you, and notifications sent to you.
• A record of decisions about you and your pay: who approved a timesheet or a holiday request, who reset your PIN, and when you signed in. Failed sign-ins record the username that was tried, never the PIN.
• Your sign-in PIN, stored only as a scrypt hash. Nobody, including your employer, can read it back.

No health information is recorded. There is no sickness category, and you should not put medical details in a leave reason or a shift description.

Somebody has to be able to answer "who approved this?" when a payslip is queried, and you are entitled to ask it about your own hours. The same record shows if anyone tried to sign in as you.

It is kept alongside the pay records it explains, for the same period: six years from the end of the tax year it relates to. It is visible to whoever administers the system, not to your colleagues.

• To pay you correctly. Performance of your employment contract.
• To keep records the law requires. Working time records under the Working Time Regulations 1998, and pay records for HMRC. Legal obligation.
• To manage the workforce. Approving timesheets and leave, and knowing who is at which site. Legitimate interests.

Your information is not sold, not used for advertising, and no automated decision is made about you.

Your managers and whoever runs payroll at your employer. Colleagues cannot see your shifts, timesheets or leave.

Data is held on infrastructure operated by Supabase (the database), Vercel (the website) and Resend (invitation emails), each acting as a processor under contract and none of them permitted to use it for anything else. The database is hosted in Ireland. Where any processing happens outside the UK or the European Economic Area, it is covered by the standard contractual clauses in our agreements with those providers.

Working time records are kept for at least two years from the period they cover, as the Working Time Regulations require. Pay records are kept for at least three years for HMRC. Clean4Me LTD keeps timesheets, leave and the decisions about them for six years from the end of the tax year they relate to. That is the longer of the two legal minimums plus enough margin to answer a query about pay, or defend a claim about hours or holiday, for as long as one can realistically be brought.

If you leave, your account is deactivated rather than deleted, so those records survive. An account with no approved or paid timesheets can be deleted outright.

You can ask for a copy of what is held about you, ask for it to be corrected, object to how it is used, or ask for it to be deleted. Deletion can be refused where a record must be kept by law. A timesheet already used to pay you is one.

Ask your employer at clean4mepayroll@gmail.com. They must respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.

• Everything travels over HTTPS, and the site refuses plain HTTP.
• PINs and passwords are hashed with scrypt and never stored readably.
• Sign-in sessions use a signed, httpOnly cookie that scripts in the browser cannot read.
• Five wrong PINs lock an account until a manager unlocks it.
• Each company's data is separated, and one employee cannot read or change another employee's records.
• Invitation links work once and expire after fourteen days.

One cookie, to keep you signed in. It is strictly necessary, so no consent banner is required. There is no tracking or analytics.