ORLAGH’S
Staff privacy notice
The short version
- Your phone’s location is recorded only while you have a walk or visit in progress in the app, never between visits or outside work.
- We don’t track how you use the app: team accounts are excluded from usage statistics.
- The app doesn’t record why you’re off: a day off ill is just “unavailable”. Please don’t put health details in the note. Tell the owner directly if you’re off sick, so sick pay can be sorted outside the app.
- You must use two-step sign-in (multi-factor authentication) to use team features.
- You may only look at customer information you need for your work.
1. Who we are
ORLAGH’S (“we”), 11/15 Albion Gardens, Edinburgh EH7 5NS, is the controller of your personal information. Contact: orlaghs2025@gmail.com.
This notice explains how we use information about you as a member of the ORLAGH’S team, in the ORLAGH’S app and in our HR and payroll records. It doesn’t form part of any contract of employment or engagement. Our customer privacy notice covers anything you do in the app as a customer.
2. What we hold about you
In the ORLAGH’S app
- Your account: name, email, phone, profile picture, verification selfie (checked by a person, no facial recognition), your team role(s) and the clients you are assigned to.
- Security: whether you have set up two-step sign-in. The secret for your authenticator app is held by our hosting provider’s sign-in service, not shown to us.
- The rota: your shifts, and your time off (holiday, unavailable or other, with any note you add).
- Walk routes: the GPS location of your phone while a visit is in progress (see section 4).
- Your work records: visit and care notes, photos and videos you take on visits, bookings you are assigned to, messages with customers and colleagues, and records of moderation and verification decisions you make.
- Ratings and reviews customers leave about services you delivered.
- If you are a manager with access to the team email inbox: that you connected it and when.
Outside the app
- Recruitment information: CV or application, interview notes, references.
- Contract, pay, tax code, National Insurance number, bank details, pension, holiday and absence records.
- Right-to-work documents, driving licence and insurance details if you drive for work.
- Any criminal record check we carry out for the role (for example a Disclosure Scotland basic check). We keep only what is needed, as described in our policy.
- Emergency contact details, training records, performance and any disciplinary or grievance records.
- Accident and incident records.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Recruiting you, managing your contract, paying you, rota planning, holidays | Contract; legal obligation (tax, National Insurance, pensions, working time, right to work) |
| Recording sickness absence and paying Statutory Sick Pay; adjustments for health conditions | Legal obligation and contract. Because this is health information (special category data), we also rely on our obligations in employment law (UK GDPR Article 9(2)(b) and Data Protection Act 2018, Schedule 1, Part 1, condition 1), with an appropriate policy document in place |
| Recording walk routes and sharing them with the dog’s owner | Legitimate interests (dog safety, customer reassurance, and evidence of the service if there is a problem) |
| Two-step sign-in and limiting what each role can see | Legitimate interests and legal obligation (keeping customer data secure) |
| Verification selfie and profile picture checks | Legitimate interests (making sure every account belongs to a real person) |
| Quality, customer feedback, training, health and safety, incidents, disciplinary and grievance matters | Contract, legal obligation (health and safety) and legitimate interests |
| Criminal record checks for roles involving access to customers’ homes | Legitimate interests (protecting customers and their homes), with Data Protection Act 2018, Schedule 1, Part 1, condition 1 and our appropriate policy document |
| Contacting your emergency contact | Legitimate interests, or vital interests in an emergency |
4. Location during walks and visits
- The app only asks for location permission while in use. It does not track you in the background.
- Your location is recorded only while a visit is in progress and you have that visit open in the app with location sharing on. If your phone locks or you switch to another app, recording pauses. It stops when the visit is no longer in progress.
- The route is shown to the dog’s owner(s) and to managers, and is deleted automatically 90 days after the visit.
- We don’t use routes to monitor your performance in general. We may look at a route if there is a concern, complaint or incident about a particular visit, and we will tell you if we do.
5. Monitoring
- No usage tracking: the app doesn’t record when team accounts open the app or which screens you use.
- We don’t read your personal email or personal messages. The team inbox in the app is the business’s email account; anything sent to it belongs to the business.
- Messages you send to customers in the app are business records and may be read by managers if there is a complaint or concern.
6. Who can see your information
- Colleagues see the rota (who is working when) and your name and picture. They see your time off only as “unavailable”: the reason and any note are visible to managers only.
- Managers see time-off reasons, assignments, verification selfies and reports as needed for their role.
- Customers see your name and picture when you are their carer, the walk routes and visit notes for their dog, and messages you send them.
- Service providers: our app hosting (Supabase, EU/Ireland), app delivery and push notifications (Expo, US, via Apple and Google), business email (Google), and our payroll provider and accountant. US transfers are protected by the UK International Data Transfer Agreement/Addendum or the UK–US data bridge.
- Others where the law requires: HMRC, pension providers, the Home Office, Disclosure Scotland, the police or courts.
7. Your responsibilities with customer information
- Only look at information about clients and dogs you are assigned to, and only for your work.
- Never write key-safe, alarm or door codes in the app, chat, email or your phone’s notes. Follow the key and access procedure.
- Keep your phone locked with a passcode, keep two-step sign-in on, and don’t share your login.
- Don’t save customer photos or details to personal accounts or social media. Only the business posts to ORLAGH’S Instagram, and only photos of dogs whose owners have consented.
- Tell a manager immediately if your phone is lost or stolen, a key or code goes missing, or you think customer information has gone to the wrong person.
8. How long we keep it
| Information | How long |
|---|---|
| Walk GPS routes | 90 days after the visit |
| Rota and time-off entries in the app | Shifts: 2 years. Time off: the current tax year plus 3 years |
| App account | Until you leave, then your team access is removed straight away and the account is deleted or converted to a customer account at your choice |
| Messages and visit records you wrote | As part of the customer’s records (messages 2 years; bookings 6 years) |
| Personnel file, contract, disciplinary and grievance records | 6 years after you leave |
| Payroll, tax and pension records | 6 years after the end of the tax year they relate to |
| Right-to-work documents | 2 years after you leave |
| Criminal record check result | Certificate deleted within 6 months of the decision; we keep only a note that it was done and the outcome |
| Accident records | At least 3 years |
| Unsuccessful applications | 6 months after the decision |
9. Your rights
You have the right to access, correct, delete or restrict your information, to data portability, to object to processing based on legitimate interests (including walk routes), and to withdraw any consent you have given. Some rights are limited where we must keep records by law. Ask a manager or email orlaghs2025@gmail.com; we will respond within one month. You can also use Profile → Download my data in the app.
If you are unhappy, talk to us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
10. Changes
We will update this notice when how we use staff information changes and tell you about significant changes.