Staff privacy notice: template for businesses

Last updated: 6 October 2026

If your business uses Staff Checklist, you must tell your staff how you use their personal data in it. You can use this template. Replace the parts in [square brackets], remove anything you don't use, and share it before staff start using the app, for example in your staff handbook or by email. This template is not legal advice.

How [Business name] uses Staff Checklist

Who is responsible. [Business name], [address] ("we") decides how your data is used in Staff Checklist. Contact: [name or role, email].

Staff Checklist is provided by IT Nest Limited, which stores and processes the data for us under a data processing agreement. Its own privacy policy is at staffchecklist.com/legal/privacy.

What we record about you:

• your name, email address, role, team and the sites you work at;
• the work you record: which checks and tasks you did and when, readings such as fridge temperatures, notes, and any photos, videos, voice notes or signatures you add;
• reviews of your work by managers, comments, read confirmations of announcements, and a log of changes you make;
• [if you use it] whether you were on site when you completed a checklist. Only "yes" or "no" is stored, never your exact location, and nothing is tracked in the background;
• [if you use it] absence marks, without any reason;
• [if you use a shared tablet] your personal PIN, which is stored in protected form.

Photos you take in the app are stamped with the time, date, your name and the site name.

Why. To keep the food safety and health and safety records the law requires us to keep, to plan and run shifts, to check that work is done to our standards, and to show records to inspectors.

Lawful basis. Legal obligation (food hygiene and health and safety law) and our legitimate interests in running the business. We don't rely on your consent.

Your right to object. You can object at any time to uses based on our legitimate interests.

Transfers. IT Nest (Hong Kong) and its US providers process your data under standard contractual clauses and the UK International Data Transfer Addendum. You can ask us for a copy.

Who can see it. [Owners and managers / list roles] at [Business name]. IT Nest, which provides the app. Inspectors, when we share an inspection report with them.

How long we keep it. Records are kept for [2 years / 5 years / until we close our Staff Checklist account]. Photos are kept for [12 months / 24 months / as long as the records].

Your rights. You can ask us for a copy of your data, ask us to correct it, and in some cases ask us to delete or restrict it, or object to how we use it. Contact [name or role, email]. You can also complain to the Information Commissioner's Office (ico.org.uk) or, outside the UK, to your local data protection authority.

Notes for the business (delete before sharing)

• Some countries have extra rules about monitoring at work, for example Poland (Labour Code) and Spain (data protection law on digital rights at work and geolocation). They can require you to tell staff in advance and set the rules out in workplace regulations. Check them before you use the on-site check, photo proof or review of work.
• If you plan to use Staff Checklist records for disciplinary decisions, or use the on-site check, consider doing a data protection impact assessment first. IT Nest can give you information about how these features work.
• Don't record health details. Mark absences without a reason, and keep sickness information outside Staff Checklist.