Staff privacy notice

Draft — last updated October 2026. Items in [square brackets] must be confirmed by HR or legal before this notice is relied on.

Who we are

Babul's is the controller of the personal data you give us during onboarding and employment.
Contact for data protection questions: [HR to confirm name, email and postal address; and Data Protection Officer details if one is appointed].

Identity and contact details: name, sex, date of birth, home address, mobile, email, and emergency contact name, phone number and relationship to you.
Payroll details: National Insurance number, name of bank, name on account, bank sort code and account number.
Right to work evidence: nationality, photo ID, share code or Home Office check results, and expiry dates.
Proof of address documents.
Uniform sizes.
Ethnicity, only if you choose to provide it, for equal opportunities monitoring.
A staff profile photo.

To employ and pay you (performance of your employment contract).
To check your right to work in the UK and meet tax and payroll duties (legal obligation).
To keep emergency contact details and run the workplace safely (legitimate interests).
Ethnicity is special category data. It is optional and used only for equal opportunities monitoring under UK GDPR Article 9(2)(b)/(g) and the Data Protection Act 2018 Schedule 1 [legal to confirm condition and appropriate policy document].

Purpose: so authorised managers at your workplace can identify you on site and in your employee record.
Lawful basis: our legitimate interests in workplace security and staff administration. We do not rely on your consent, because a photo is required for all staff.
We do not use your photo for facial recognition or biometric identification, and we do not share it outside the company.
Access: only managers authorised for your workplace and senior administrators can view it, through short-lived secure links.
Retention: the photo is deleted when you leave.
Objection: you can object to the use of your photo at any time by contacting your manager or HR. We will consider your circumstances and stop using it unless we have compelling reasons to continue, which we will explain to you.

Managers authorised for your workplace and senior administrators. Access is logged.
Our service providers that host and store data on our behalf, including our cloud hosting, file storage (Google Drive) and an AI service used to read dates from uploaded documents. Bank details, NI numbers and addresses are not sent to the AI service. [Legal to confirm processor contracts and any transfers outside the UK.]
Government bodies where the law requires, such as HMRC and the Home Office.

Right to work records: for your employment and 2 years after it ends, as required by Home Office guidance.
Payroll and tax records: at least 3 years after the end of the tax year they relate to.
Other onboarding records: for your employment and [HR to confirm period] after you leave.
Profile photo: deleted when you leave.

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy in a portable format. Some rights are limited where we must keep data by law.
Changes to your details after onboarding are requested through the app and approved by a manager.
You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would appreciate the chance to resolve your concern first.

Data is stored in private, encrypted storage. Managers must use two-step sign-in. Bank and NI details are hidden by default and every reveal is logged.