Privacy Policy

Who we are

Merriwood ("we", "us") supplies care and cleaning staff. We are the data controller for the personal information described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For anything about your data, contact office@merriwood.example or 020 7946 0000.

If you're a worker or applicant, our privacy notice for workers and applicants explains in plain terms what happens to your documents and checks.

Whose information we hold

• Applicants and workers: people who register with us, apply for work or work shifts through us.
• Clients: the people who book staff from us and their contacts.
• People receiving care or cleaning: limited details our clients give us so staff can find the right place and know what to do, such as an address, access instructions and the tasks needed.
• Website visitors who contact us or use our forms.

What we collect

• Applicants and workers: name, contact details, address, date of birth, National Insurance number, work history and references, skills and availability, training certificates, identity and right to work documents or share code results, DBS check details, a health declaration where the role needs one, and an emergency contact.
• While working: the times you clock in and out, your phone's location at those moments to confirm you're at the right address, tasks completed and any problems reported. We don't track your location at other times.
• Clients: organisation and contact details, booking details, your CQC registration where you book care staff, and your agreement to our terms of business.
• Everyone: messages you send us, and technical information needed to keep the website secure.

Where it comes from

Mostly from you. We also get information from your referees, the Disclosure and Barring Service or the umbrella body that processes DBS checks, the DBS Update Service, the Home Office right to work service, and the clients you work for, for example feedback about a shift.

Why we use it, and our lawful basis

• To find you work, or find you staff, and run the bookings: to take steps towards and perform a contract with you.
• To carry out right to work checks, keep agency and pay records, and pay tax and National Insurance: legal obligation.
• To check workers are safe and suitable, including DBS checks, references and training records: legal obligation and our legitimate interest in protecting the people our workers support.
• To confirm arrival and completed tasks to clients, and to settle disputes: legitimate interests.
• To send job alerts and our weekly email: your consent, which you can withdraw at any time by replying STOP, unsubscribing, or changing your settings.

Health and criminal record information

Health information and criminal record information need extra protection. We use them only where the law allows: for employment and safeguarding purposes under Schedule 1 of the Data Protection Act 2018. We keep a written policy on how we handle them. We record the details of a DBS certificate (its number, date, level and outcome) but don't keep copies of the certificate itself.

Who we share it with

• Clients, when you're booked to work for them: a worker profile with your name, photo, role, experience and the checks completed. We don't send clients your identity documents or full DBS details.
• Organisations that help run checks and pay: the DBS umbrella body, the Home Office online checking service, our payroll provider or accountant, HMRC and the workplace pension provider.
• Service providers who store or send data for us, under contracts that protect it: website hosting (Vercel), our database (Supabase), email (Resend) and text messages (Twilio).
• Regulators, local authorities, the police and the DBS, where the law requires it or to protect someone from harm.

Some of our service providers store data outside the UK. Where they do, it's protected by UK adequacy regulations or the UK's approved data transfer agreements. We never sell your information.

How long we keep it

• Applicants who aren't taken forward: 6 months after our decision, unless you ask us to keep your details for future roles.
• Registered workers who never work a shift: deleted after 2 years without activity.
• Workers' files, timesheets and pay records: 6 years after your last shift, for tax, minimum wage and legal claims.
• Right to work check records: for the time you work through us, plus 2 years, as the Home Office requires.
• Clients' booking and visit records: 6 years after the last booking.
• Enquiries that don't lead to work: 2 years.

Decisions about you

Our system shows whether a worker's checks are complete, but a person always makes the decision to accept or place a worker. We don't make decisions about you by automated means alone.

Keeping it safe

Access is limited to the staff who need it. Documents are stored securely, and door codes and access details are only shown to the workers booked for that visit, on the day.

Your rights

You can ask for a copy of your information, and ask us to correct it, delete it or restrict how we use it. You can also object to how we use it and withdraw consent at any time. Some information we must keep by law, and we'll tell you if that applies. Contact office@merriwood.example. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We'll update this policy when the way we use information changes, and show the date at the top.