Privacy information

Working draft · 6 October 2026 · Not approved for live staff use

This describes the private online Kinselo Rotas preview. The current attendance release is for testing with fictional staff records. Use fictional staff details. Do not enter real staff, resident, health or DBS information. The live operator, contact details, hosting, retention periods and lawful bases must be confirmed before this becomes a live privacy notice.

Who is responsible?

For a live service, the employer would normally decide why staff scheduling data is used and act as controller. Kinselo would generally process that data on the employer’s instructions. Any separate Kinselo purposes, such as account administration, need their own assessment and notice. This allocation must match the actual service and contract.

Before release: insert the employer’s legal name and privacy contact, the Kinselo contracting entity and contact, and any applicable data protection officer or representative. The office contact route is bookings@tmtys.co.uk; the final privacy contact still needs approval.

Information and purposes

• Names, contact details, job role, contracted hours, pay rates, service addresses and rota records: planning and managing staffing. The pilot starts with fictional examples.
• Your account identifier and email are checked by the same Supabase sign-in service used for Kinselo Training. Passwords are checked by that service and are not stored in the rota database. A shared Kinselo account directory stores organisation and product memberships, permissions and hashed session records. Each organisation’s rota and attendance records stay in its separate workspace database.
• Cover requests and publication: coordinating proposed and confirmed shifts. A cover offer does not book a shift automatically.
• Security events and saved revisions: identifying account activity and recovering earlier saved data. Avoid putting sensitive details in free-text fields.

The employer must document an appropriate lawful basis for each purpose. Staff consent is not a blanket basis for routine employment processing. Health information and criminal-offence data require additional assessment; neither should be added to this pilot.

Who can see it?

Only approved rota accounts can access records. Administrators can see the organisation’s team, pay details and rotas. Staff accounts can see only their own published shifts and offers addressed to them. A Training account alone does not grant access to Rotas. Rota service managers are restricted to their permitted services. Staff attendance accounts are linked to an explicit staff record. Training and Compliance have separate product permissions; permission for one product does not automatically grant another. No payroll or attendance messaging provider is connected.

Where it is stored and how long

Each organisation’s online rota and attendance workspace is stored in a separate Cloudflare D1 database, with separate private file and backup storage. The shared account directory contains routing and access information, rather than client rota or attendance records. The landing and login pages are public. Rota records are protected by email-and-password sign-in and separate server-side permissions. Local passwords, sessions and reset links have not been uploaded. No email or push service is connected. Hosting location, processor terms and transfer arrangements have not yet been approved for real staff records.

Audit events and saved revisions are retained in online storage; automatic deletion is not yet configured. Workspace retention and backup deletion periods are not set. Before live use, agree justified retention periods for each record type, configure deletion and recovery procedures, and name the hosting region and all subprocessors and transfer safeguards.

Cookies and browser storage

The rota uses a Secure, HttpOnly, SameSite session cookie, expiring after at most one hour. State changes also require a session-specific request token and a same-origin request. Signing out of the shared Kinselo portal ends the shared session. Connected product services recheck the shared authority before granting access. It has no analytics or advertising cookies. The earlier visual prototype separately stores its demo rota in browser local storage; that data is not automatically imported into this version.

Your information rights

In a live service, contact your employer’s privacy contact to ask about access, correction, deletion, restriction, objection or portability where the relevant right applies. The employer should verify identity proportionately, record and assess the request, and respond within the applicable deadline. A rota account is not a complete subject-access export.

You may raise concerns with the employer and complain to the Information Commissioner’s Office. Insert the confirmed contact route before publication.

Attendance and scheduling

No AI or automated employment decision-making is connected. Overlap and waking-night checks are scheduling rules, not a safe-staffing or compliance certification. Staff attendance is self-reported through Clock in and Clock out. The server records UTC timestamps, account and permission identifiers, the assigned published booking, and review history. Staff can see their own records; authorised organisation or service managers can review the records in their permitted services. Original clocking events are retained alongside reasoned manager corrections. Elapsed time includes breaks and Sleep-In; it is not verified physical presence or automatic payroll evidence. When you tap Clock in or Clock out, the website asks your phone for a fresh location reading. Location permission and a sufficiently accurate reading within the confirmed service boundary are required. Coordinates are sent securely to the server for this one check and are not stored in attendance events, audit records or backups. Only a passed check, distance, reported accuracy and boundary size are retained. The service entrance coordinates are stored separately as service settings. Device-reported location cannot prove physical presence. There is no background location tracking, camera or biometric collection. If you cannot clock, contact your manager; reasoned manager reviews preserve the original events. Attendance retention, correction/dispute procedures, the employer notice and lawful basis must be agreed before real staff use. No automatic attendance deletion or retention policy is enabled in this fictional release.

Service directions

Directions to service opens Google Maps only when selected, with the service address or confirmed entrance coordinates as the destination. Kinselo does not send your clocking coordinates to Google Maps. Google may request location under its own settings and privacy notice. Administrators may look up a service postcode using Postcodes.io; only the service postcode is sent, never staff location. A postcode lookup is approximate and must be checked against the service entrance before clocking is enabled.

The administrator entrance map loads only when selected. OpenStreetMap receives map tile requests for the displayed service area, the browser IP address and the Kinselo site origin. No staff GPS readings, staff records, organisation identifiers or session tokens are sent. See the OpenStreetMap Foundation privacy policy. Moving a pin changes the form only; the administrator must confirm and save the service.

Shift amendments retain the authenticated account identity, date and time, and before-and-after booking details in append-only history. Active clocked-in bookings are locked until staff clock out or a reasoned manager attendance review closes the session. A documented correction to an earlier inconsistent booking finish can change clock-out eligibility without changing the original clock-in event or its booking snapshot.

Sources and approval

Prepared using ICO guidance on privacy information, controllers and processors, and employment records. Attendance design was also checked against the ICO’s worker monitoring guidance. These drafts do not establish UK GDPR compliance. The operator and employer must complete the missing decisions and obtain appropriate review before live use.

Missed clockings

After a clock-out window closes, the record remains unresolved for manager review. A later, non-overlapping shift can be clocked without assuming a finish for the earlier shift. Managers can record a confirmed finish with a reason. They can also reopen a missed clock-in for up to 30 minutes while the booked shift is still in progress; staff still need to pass the location check, and their actual tap time is retained. Reopenings are recorded in the attendance audit and private client backups.