Staff privacy notice

Who we are

Aspire Parkour Academy is run by [Aspire Parkour Ltd, company number …], [registered address]. We decide how your information is used, which makes us the controller under UK data protection law. Our data protection lead is [name], at [email].

This notice is for everyone who works with us: coaches, the office and Young Leaders, whether employed, self-employed or volunteering.

What we keep about you

• Your name, email, phone number, the emergency contact you give us, and how you’d like to be contacted (for example text only, or written messages only).
• Your staff record: staff number, job, how you’re engaged, start and end dates, contracted hours, pay rate, holiday allowance, working days, date of birth, invoice address if you’re self-employed, and the office’s notes.
• Certificates: first aid, safeguarding, coaching levels and others, with the copies you upload. For DBS checks we record the certificate number, issue date and level only — we don’t keep copies.
• Your rota, shifts, hours and timesheets, the availability you give us, and time off, including sickness.
• Expenses and their receipts, training requests and courses, quiz and course results, documents you’ve read and signed, and forms you’ve answered. If you’re self-employed, the invoices the office has marked paid, with the bank reference.
• Team chat messages (including voice notes and the words typed with them), updates and comments, recognitions, and your Meet the team profile and photo.
• Your invitation to join the team (your name, email and the details the office entered), and that you’ve read this notice.
• Worries you raise with Raise a worry, and messages you report to the office: kept as safeguarding records, with what was done about them.
• HR records, if there are any: notes of a concern raised with you, investigations, suspensions, disciplinary hearings and their outcomes (including warnings and the date each stops counting), appeals, performance improvement plans, grievances you raise and their outcomes, and other meetings (probation reviews, return to work, 1-to-1s) — who was there, what was said, the next steps, and letters or notes about them. For under-18s, whether your parent or carer was invited (they’re invited to anything formal).
• If you’re hurt at work: the entry in our accident book (what happened, any injury and treatment, whether you went to hospital), and whether the office had to report it (RIDDOR).
• If you’re the safeguarding lead or a deputy: that role, and each time you open a safeguarding record.
• For Young Leaders: your parent or carer’s name, relationship, phone and email, how and when they agreed (in the app: who they are to you, that they have parental responsibility, and whether your photo may be on Meet the team), your induction, check-in notes, next steps and recognitions, and the weekly emails with your shift times we send them.

Why, and the law that allows it

• To run your work with us — the rota, pay, time off, training — under our contract or agreement with you.
• To meet our legal duties: pay and tax records (HMRC), working time, the rules for under-18s, and health and safety.
• To keep children safe: DBS and safeguarding checks (criminal records information, under Article 10 and the safeguarding conditions of the Data Protection Act 2018, with our Appropriate Policy Document).
• Sickness absence is health information: we keep it to run the rota and meet employment law (Article 9(2)(b) and Schedule 1 paragraph 1 of the Data Protection Act 2018).
• To run the team well (our legitimate interests): team chat, updates, recognition, Meet the team, and the records below.
• Worries you raise and messages you report: to keep children and staff safe (our legitimate interests, and the safeguarding conditions of the Data Protection Act 2018).
• The accident book: health and safety law asks us to keep it (legal obligation); an injury is health information, kept under employment law (Article 9(2)(b)).
• HR records: to deal with conduct, performance and grievances fairly, following the Acas Code of Practice (our contract with you and our legitimate interests; health or an alleged offence in them under employment law, with our Appropriate Policy Document), and to defend or bring legal claims.

What the app records about your work

We want you to know this before you start:

• When you open a class’s register, and when you mark it. If nobody has opened the register 15 minutes after a class with children booked starts, the office (and the coaches on it) are told.
• Every time you open a child’s health details. The family can see who opened them and when: your name (Young Leaders: your first name and “Young Leader”).
• Changes the office makes to records, in an audit trail.
• Rota activity: shifts you claim, swap or give back.
• If the signal drops, your register marks wait on your phone until they can send; they’re cleared when you sign out.
• If you’re the safeguarding lead or a deputy, every time you open a safeguarding record (only the lead and deputies see that list).
• Office logins sign in with a second step: a code from an authenticator app.

We don’t track where you are, and there’s no clock-in.

Who sees it

• The office sees your staff record, pay, time off, expenses, certificates and training.
• Colleagues see your name and, when the office shares the team’s week, your published shifts, and can message you in the team chat — but not your email or phone number: only the office has those.
• Families see your Meet the team profile when you’ve chosen to share it, your first name on their child’s classes, and your name when you open their child’s health details.
• Nobody but you and the office sees your pay, expenses or time off.
• The office can read every chat that has someone under 18 in it, Young Leaders included.
• A worry you raise goes to the safeguarding lead and deputies, never to anyone it names, and nobody can read a worry about themselves.
• The accident book: the office, and you for entries you wrote or that are about you.
• HR records: only the owner and the office, signed in with the second step — never other staff, and every opening is logged. They aren’t shown to you in the app: ask the office or [data protection lead] for a copy and we’ll send it (a data request, answered within a month). You’ll also get a copy of the notes of any formal meeting with you.

Who else receives it

• Supabase (our database and sign-in, [London]), Vercel (hosting, [London]), Resend (email) and Upstash (protecting sign-in).
• Apple, Google, Mozilla or Microsoft carry phone notifications, encrypted, if you allow them.
• A Young Leader’s parent or carer (under 16; 16 and 17 only if the office switches it on): the week’s shift times by email each Monday — the day, time and place only.
• If the office switches on Ask (an AI search for the office, run by Anthropic in the US), it can see your hours, time off (shown only as “Absence” — never sickness by name) and whether your certificates are up to date. Names are swapped for codes before anything leaves the app.
• HMRC, our accountant and our insurer, where the law or our insurance needs it, and the police or safeguarding services if a child is at risk.

How long we keep it

• Your staff records: until [6] years after you leave, then they’re deleted or cleared — except your name on incident and safeguarding reports, worries, the accident book and the list of who opened safeguarding records, which stays with those records.
• A Young Leader’s parent or carer’s details and the office’s check-in notes: [1] year after they leave.
• Your Meet the team photo: taken off the families’ page when you leave, and deleted a month later.
• Your phones for notifications and your calendar link: removed the day you leave.
• DBS: the number, date and level only, for as long as the rest of your record.
• Worries, reported messages and other safeguarding records, and the list of who opened them: [the period our safeguarding lead sets — suggested: for allegations about staff, 10 years or until retirement age, whichever is longer].
• The accident book: [at least 3 years, as the law asks — Kieran to confirm the period with his insurer].
• HR records, including warnings that have stopped counting, and their letters and notes: as long as your staff records — [6] years after you leave — then deleted. A warning stops counting on the date it says, but stays on the record as history.
• Paid invoices, if you’re self-employed: 6 years after the end of the tax year they were paid in; after that, once you’ve left, only the amounts and dates.
• Your invitation to join the team: 90 days after it was sent.
• A Young Leader’s weekly emails to their parent or carer: 90 days (they stop the day the Young Leader leaves). The parent or carer’s phone and email come off the record 30 days after the 18th birthday.

Your rights

You can see what we keep (My profile → Download my data), ask us to correct it, object to how we use it, ask us to restrict it or, in some cases, delete it. Ask the office or [data protection lead] — we answer within a month.

If you’re not happy with how we’ve handled your information, tell us first. You can also complain to the Information Commission, the UK’s data protection regulator: ico.org.uk or 0303 123 1113.

Changes

When this notice changes in a way that matters, we’ll ask you to read it again in the app.