Legal
Snappy Staff privacy policy
Snappy Staff holds rotas and staff records for other people's businesses. Who answers for that data depends on whose it is, so this policy starts there.
Who we are
Snappy Staff is made and operated by Neirfeno Limited.
| Who runs Snappy Staff | Neirfeno Limited |
|---|---|
| Company number | SC514019, registered in Scotland |
| Registered office | 7 Thorter Way, Dundee, DD1 3DF |
| Support and data protection | support@snappystaff.co.uk |
| ICO registration | ZB673603 |
This policy covers the Snappy Staff app on iOS and Android, and this website. It should be read alongside our terms and conditions, which contain the data-processing terms between us and the businesses that use Snappy Staff.
Who controls what
This is the part that decides who you should go to, so it comes first.
Snappy Staff is used by businesses to manage their own staff. That produces two different sets of data with two different people answerable for them.
| Data | Who is the controller | Our role |
|---|---|---|
| Rotas, shifts, shift notes, availability, holidays, team lists, roles and locations | The business you work for | We are its processor — we hold and handle this on the business's instructions and do not use it for our own purposes |
| Your sign-in and account record, support messages you send us, analytics, and the security logs of the service | Neirfeno Limited | We are the controller |
If you are a member of staff and your question is about your rota, your hours, your availability or your holidays, ask your employer first. They decide what goes in, what it is used for and how long it is kept. We cannot change or delete their records on your say-so, and it would be wrong of us to — but we will help them respond to you, and we are required to.
If your question is about your sign-in, an email you sent us, or this app itself, come to us at support@snappystaff.co.uk.
What we collect
Your account
You sign in with Google or with Apple. We receive an account identifier and your email address. If you use Sign in with Apple and hide your email, we receive Apple's relay address and that is all we see. We do not operate passwords for Snappy Staff and never hold one.
We also hold which business or businesses you belong to and your role in each — whether you are staff or run the place.
What the business puts in
Under the business's control, the app holds team members' names and roles, the locations they work at, published rotas and shift assignments, notes attached to a shift, availability, holiday and time-off records and their approval, and any photograph a user uploads to their profile.
The business decides what goes in here. If it enters something it should not — a health detail in a shift note, for example — that is its responsibility as controller, and we would ask it to stop.
Your device
If you turn on notifications, we hold a push token for your device so we can send you a shift alert. You can turn this off in your phone's settings at any time, and the token stops working.
We collect technical information through Google Analytics for Firebase: app version, device model, operating system version, language, approximate location derived from your IP address at country or city level, a randomly generated app instance identifier, and which screens are used. Your consent governs this — see analytics and your device.
What we do not collect
Snappy Staff does not track where you are. It has no clock-in or clock-out feature, it does not record your position when you are working or at any other time, and it does not record audio. If you have seen a location or microphone permission requested by an older build, it was not used for anything and we are removing the request.
We do not monitor individual staff for the business, and we do not build a productivity or attendance profile of anyone.
When you contact us
If you email us, or send a message through the support screen in the app, we hold your email address or account identifier, what you wrote, and anything you include.
Why we use it, and our legal basis
These bases are the ones we rely on for the data we control. For rota and staff data, the business is the controller and it decides the basis — usually the performance of your employment contract, or its own legitimate interests in running the place.
| What we do | Data | Legal basis |
|---|---|---|
| Sign you in and connect you to the right business | Account, membership | Performance of a contract |
| Provide the app to the business | Rota and staff data | The business's instructions, under our contract with it |
| Send you a notification about a shift | Push token | Consent, given by turning notifications on |
| Keep the service secure and stop abuse | Account, technical | Legitimate interests — protecting the service and its users |
| Answer your support message | Your correspondence | Legitimate interests — dealing with an enquiry you sent |
| Understand which features are used, and fix what is broken | Analytics | Consent |
| Meet legal obligations and defend legal claims | Whatever is relevant | Legal obligation, and legitimate interests |
Analytics and your device
Analytics involves storing and reading information on your device, which under the Privacy and Electronic Communications Regulations needs your consent. It is not necessary to run Snappy Staff — the app works fully without it — so we ask, and you can decline.
You can withdraw consent at any time in the app's settings. Withdrawing stops further collection. We do not use advertising SDKs or cross-app tracking in Snappy Staff.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. Our sub-processors are:
| Provider | What they do for us |
|---|---|
| Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage) | Sign-in, the database, the server logic and file storage |
| Google (Firebase Cloud Messaging) | Delivering push notifications |
| Google (Analytics for Firebase) | Usage analytics, only where consented |
| Google Workspace | Our support mailbox |
Within the app, your rota data is visible to the people your employer gives access to — normally the managers and owners of the business you belong to, and colleagues where the business publishes a shared rota. Your employer controls that.
Google and Apple act as controllers in their own right for the sign-in you use, under their own policies.
Otherwise we disclose data only where legally required — a court order, or a lawful request from a regulator or law enforcement — or to our professional advisers under a duty of confidence, or to a buyer if the business is sold, in which case we would tell customers first.
Where it is kept
Accounts, rotas and staff records are stored in the United Kingdom and the European Economic Area.
Analytics is the exception: Google processes it on servers in the United States. That transfer is covered by the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, which forms part of our contract with Google. Decline analytics and none is collected, so none is transferred.
How long we keep it
| Data | Kept for |
|---|---|
| Rota and staff data | For as long as the business's account is open. When a business closes its account we delete it within 90 days, unless the business asks for it back first. The business may ask us to delete sooner. |
| Your account and sign-in record | While you have a role in at least one business. Deleted within 30 days of you asking — see deleting your account. |
| Analytics | Up to 14 months from collection, then deleted automatically. |
| Support correspondence | 24 months from the last message. |
| Encrypted backups | Deleted data persists in backups for up to 90 days before being overwritten. |
Your employer may have its own obligation to keep working-time records — under the Working Time Regulations 1998 that is two years. That is its duty and its retention decision, not ours.
Your rights
UK data protection law gives you rights over the personal data we hold about you. They are not all absolute: some apply only in particular circumstances, and some are limited where we have to keep data to meet a legal obligation or to establish, exercise or defend a legal claim.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and for an explanation of how and why we use it. |
| Rectification | Have inaccurate data corrected, and incomplete data completed. |
| Erasure | Ask us to delete your data — for example where we no longer need it, where you withdraw consent we were relying on, or where you object and we have no overriding grounds to continue. |
| Restriction | Ask us to stop using your data, while keeping it, when you are contesting its accuracy or our grounds for holding it. |
| Objection | Object to processing we carry out on the basis of our legitimate interests. Where we process for direct marketing, your objection is absolute and we must stop. |
| Portability | Receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another provider where that is technically feasible. |
| Withdraw consent | Withdraw consent at any time where consent is the basis we rely on. This does not affect the lawfulness of processing carried out before you withdrew it. |
| Automated decisions | Not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. |
To exercise any of these, email support@snappystaff.co.uk. We may need to confirm your identity before we act, so that we do not disclose your data to somebody else. We respond within one month. We can extend that by a further two months where a request is complex or where you have made several — if we need to, we will tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we have a chance to put it right, but you do not have to.
One qualification specific to Snappy Staff: for rota, shift, availability and holiday data, your employer is the controller, so exercise those rights against your employer. If you ask us, we will tell you and pass the request on, but the decision is theirs to make.
Security
Data is encrypted in transit and at rest. Our database rules separate each business's records, so one business cannot read another's, and a member of staff cannot read a business they do not belong to. Access to production systems is restricted and protected by multi-factor authentication.
No system is perfectly secure. Where we are the controller and a breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it and tell you directly if the risk is high. Where we are the processor, we will tell the business without undue delay so it can meet its own obligations.
Young workers
You must be at least 16 to hold a Snappy Staff account. A business may lawfully employ someone younger under the rules on child employment, but they should not be given an account — the business should manage their shifts outside the app.
Being replaced by Kupaly
Snappy Staff is being replaced by Kupaly, our newer rota product. Businesses still on Snappy Staff are expected to move across.
Nothing has moved yet, and nothing will move without the business being told first. When a business does migrate, it decides — as controller of its own staff data — what comes across, and we act on that instruction. Kupaly has its own privacy policy, and a business moving over should read it before it does.
We will give reasonable notice before Snappy Staff is withdrawn, so businesses can export what they need. We will not delete a business's data without telling it.
Changes to this policy
When we change this policy we publish it with a new version date. Where a change materially affects how we use data we will tell affected businesses by email or in the app before it takes effect, and where a change needs consent we will ask rather than assume.
Contact us
Email support@snappystaff.co.uk or write to Neirfeno Limited, 7 Thorter Way, Dundee, DD1 3DF.