Privacy notice

How your employer uses Staffory to handle your information.

Who processes your data

Your employer is the data controller. Staffory (staffory.io) is the data processor that runs the platform on your employer’s instructions. Questions about your data go first to your employer’s HR/People team; platform questions can go to support@staffory.io.

What we hold, and who can see it

Staffory classifies every piece of information and shows it only to those who should see it:

• Directory (Class 1), name, job title, team, work contact. Visible to colleagues in your organisation.
• Confidential (Class 2), leave and absence dates (shown as “absent”, never the reason), access records, assets. Visible to you, your manager and HR.
• Restricted (Class 3), date of birth, emergency contact, sickness reason, leaver reason, right-to-work notes and any restricted custom fields. Visible to you and HR only; every access is logged.
• Secret (Class 4), shared system credentials in the Vault. Stored encrypted; every reveal requires re-authentication and is logged.

Sensitive details never appear in search, notifications, exports or error logs, they are simply not placed on those paths for anyone who may not see them.

Why we hold it (lawful basis)

• Contract, to administer your employment (leave records, onboarding, access to systems).
• Legal obligation, e.g. right-to-work checks, statutory record-keeping.
• Legitimate interests, running the workforce securely (access reviews, audit trails), balanced against your rights.

Where it lives, and for how long

Data is hosted in the UK (London). Files are stored privately and served only through short-lived, permission-checked links. Records are kept for as long as your employment and applicable law require, then deleted or anonymised by retention jobs; audit records are retained (append-only) as a security requirement.

Processors used to run the service (hosting, database, file storage, email) are engaged under data-processing terms and listed in our sub-processor register (available on request).

Your rights

Subject to law, you can ask to access, correct, or delete your information, object to certain processing, and complain to the ICO. Because Staffory acts for your employer, please raise requests with your employer’s HR/People team, who will action them through the platform.