Your rights as a data subject
- Access - request a copy of the personal data we hold about you.
- Rectification - correct inaccurate data.
- Erasure - request deletion (subject to legal retention requirements such as right-to-work record keeping).
- Restriction - ask us to pause processing while a dispute is resolved.
- Portability - receive your data in a machine-readable format.
- Objection - object to processing based on legitimate interest.
- Withdraw consent - for any consent-based processing (e.g. Google Calendar integration), at any time from Settings.
- Complain - to the Information Commissioner's Office (ICO).
To exercise any of these rights, email privacy@stafflo.co.uk. We respond within 30 days.
Where data lives
Stafflo operates primarily on UK and Western European infrastructure (Supabase in the UK / Ireland, Vercel in UK / EU regions). Where data crosses borders we rely on UK adequacy decisions, Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.
Sub-processors
Stafflo uses a small number of sub-processors to deliver the platform. Current sub-processors:
- Supabase - database, authentication, file storage.
- Vercel - application hosting + CDN.
- Resend - transactional email delivery.
- Twilio - SMS and WhatsApp message delivery.
- Anthropic - AI processing for the optional WhatsApp assistant (message content only; not used to train AI models).
- Apple Push Notification service & Firebase Cloud Messaging - mobile push notification delivery.
- Capgo - mobile app over-the-air updates (no personal data beyond a device app-version identifier).
- Google Cloud - Calendar API integration (only data the connecting user explicitly authorises).
- OpenSanctions - global sanctions and politically-exposed-persons screening when triggered by a tenant during recruitment vetting.
- Experian - UK identity, address-history and financial-sanctions screening when triggered by a tenant during recruitment vetting.
- HMRC Employer Checking Service - right-to-work verification when triggered by a tenant during recruitment vetting.
Tenants are notified of changes to the sub-processor list at least 30 days in advance via email to administrators.
Data Processing Agreement
A signed Data Processing Agreement (DPA) is available to all customers. Email legal@stafflo.co.uk to request one.
Breach notification
If we become aware of a personal-data breach, we notify affected customers without undue delay so they can meet their own obligations as controllers, and - where we act as controller and the breach is likely to result in a risk to individuals - we notify the Information Commissioner's Office within 72 hours, in line with Articles 33 and 34 of the UK GDPR.
Data Protection Officer
Contact our DPO at dpo@stafflo.co.uk.
