What we do with information about you.

Information about you

If you book a call or email us, we hold your name, organisation, email, any phone number you give us and what you told us, so that we can reply and keep track of the conversation. Our lawful basis is legitimate interests — responding to someone who contacted us.

We do not sell it, we do not pass it to a third party for their own purposes, and we do not put you into an automated sequence you have to escape from.

We keep enquiry correspondence for up to two years from your last contact, then delete it.

Information about your workers

When you use Stamped HR, the records you put in about your workers remain yours. You decide what goes in and why; we process it on your instructions to provide the service. In data protection terms you are the controller and we are the processor, and the details are set out in the data processing agreement.

If you are a worker and want to know what your employer holds about you, the request goes to your employer — they decide, and we help them answer.

The employee app and worker accounts

A worker gets an account only when their employer invites them, and only if they are 18 or over. The Stamped HR employee app for phones is a way of using that same account; it does not have its own sign-up. Signing in opens your phone’s web browser, not a form inside the app.

What a worker puts in is limited to what the employer has asked for: contact details (address, mobile number, and an email address if you give one), a tap to confirm that the name the employer holds is right, a tap to say how you expect to show your right to work, and, where your employer asks for one and sending photos is switched on, a photo of a document. The employer is the controller of that information and we are the processor, as above; they decide what it is used for.

Nothing a worker sends changes the employer’s record until the employer reviews it and accepts it.

The camera and photos

The app uses the camera only when you tap to photograph a document your employer asked for. It does not open or read your photo library, and does not ask your phone for permission to.

The photo is a temporary file on your phone while it is sent. The app deletes that file afterwards, whether the photo was sent, refused as too large, or failed to send.

In Stamped HR the photo is stored encrypted, with the location and camera details removed from it, in your employer’s workspace. You cannot download it again, and only your employer’s authorised users can. A photo that only helped your employer prepare is removed automatically thirty days after the request it came with is closed, unless your employer is legally required to hold it, or has used it in their own evidence, when it follows the life of that record. Removal from the live system is not removal from backups: backup copies can hold it for up to twelve months. If your records are erased, the key that opens the photo is destroyed, so it can no longer be read.

What the app keeps on your phone

Your sign-in tokens, in your phone’s secure storage (the Keychain on iPhone, the Keystore on Android), along with the name of your employer’s workspace so that the app can ask for them again. The app does not keep your photos or your answers on your phone.

The app does not currently use push notifications. If a later version does, this page will say what is stored for that before it is switched on.

Advertising, tracking and sale

The app contains no advertising and no analytics or tracking code, and does not track you across other apps or websites. We do not sell personal information.

Asking for your information to be deleted

A worker’s records belong to their employer, so the request goes to them; they can erase a worker’s account and records. If you cannot reach your employer, write to us from the support page. We cannot answer for your employer, so we will point your request to them.

What we are the controller for

Our own account, billing and security records, including the logs that tell us the service is working and has not been attacked. We hold those because we have to run a business safely, not because a customer instructed us to.

Where it is held

In the European Union, under UK GDPR. Our sub-processors and the countries they operate in are named on the security page, including backups, which are in a different country from the servers on purpose.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it. Write to AVS Digital Ltd at 21 Heath Drive, Romford, Essex, RM2 5QH, United Kingdom, or email enquiries@stampedhr.com.

If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.