Privacy notice for staff

Castle Davitt Furniture Ltd., Unit 6 Castlebar Retail Park, Breaffy Road, Castlebar, Co. Mayo F23 CD58, is the controller of the personal data in the Hub. For any question or request about it, email info@castledavitt.ie.

Your account

Name, work email address, role and access level, job role, shop, and start and leaving dates. Entered by an administrator.

Sales figures and targets

Your figures for each period and the targets set for you, uploaded from spreadsheets or typed in by a manager, and the spellings of your name used in those spreadsheets.

Hours worked

When you clock in and out, the shop, and whether your phone said you were at the shop, away from it, or could not tell. Corrections record who made them and why.

Rosters

The shifts you are rostered for, with the shop and any notes.

Time off

Holiday, unpaid and sick leave: the dates, the number of days, and the decision. Your leave entitlement and standard working day.

Announcements

Whether you have read each announcement.

Sofa designs

When you design a sofa with a customer, the design is saved with your name as its designer, and each save records who made it and when.

Notifications

If you turn them on: a delivery address for your phone or browser and a short description of the device, such as "iPhone".

An audit log

A record of important actions, such as changing someone's access, correcting hours, deciding leave or exporting a person's data: who did it, to what, and when.

Clocking in, rosters and time off are part of Work, which is built but not yet switched on. Until it is, none of that is recorded. Messaging between staff and management is also switched off.

No location is ever stored. When you clock in, your phone is asked once where it is. That reading is compared with the shop’s position and thrown away straight after. All that is kept is “at the shop”, “away” or “not known”. Nothing is checked between clock-ins, and there is no tracking in the background. If your phone will not share its position you can still clock in; the record just says “not known”.

The Hub does not hold your home address, personal phone number, PPS number, bank or payroll details, date of birth, next of kin, photographs, medical certificates or any detail of an illness. It does not use your camera or microphone, and it keeps nothing about you on your phone.

Hours and time off

To pay you correctly and keep the working-time and leave records the law requires (legal obligation, and your employment contract).

Sick leave

Recorded as a day of sick leave only. Because it concerns health, it is handled under employment law obligations (GDPR Article 9(2)(b)) and only managers can see it.

Rosters

To staff the shops (your employment contract, and our legitimate interest in running the business).

Sales figures and targets

To measure sales performance against targets, which is a normal part of a sales role (legitimate interests).

Sofa designs, announcements, notifications and the audit log

To serve customers, make sure notices are seen, reach you if you ask us to, and be able to explain any change later (legitimate interests).

We do not rely on your consent for any of this, because an employee cannot really refuse their employer. Notifications are the one thing you choose to turn on, and nothing depends on them. Nothing in the Hub makes decisions about you automatically. Targets are set, and performance is read, by a manager.

You can see your own figures, targets, hours, time off and shifts. You can see who else is working on a given day, but not their hours, figures or reasons for being off.

Managers can see everybody’s rosters, timesheets, time off and figures. Administrators also manage accounts and access, and are the only people who can export everything held about one person. Every export is logged.

These rules are enforced by the database itself, not only by what a screen shows. The shop-floor screen account cannot open anything about a person.

We use these service providers to run the Hub. They handle your data only to provide their service to us.

Supabase

Stores the database, sign-in and uploaded files, in Ireland.

Vercel

Runs the Hub, from Dublin.

Resend

Sends the Hub's emails. Resend is a US company, so emails pass outside the EEA.

Apple and Google

Deliver notifications to your phone, if you turn them on. Notifications carry no figures, no reasons for leave and no one else's name.

The Hub has no advertising, no analytics and no third-party tracking.

Your records are kept while you work with us and for six years after you leave, the usual period for employment records, and are then deleted. Some records must be kept for a set time by law, and will not be deleted sooner even if you ask.

Saved sofa designs are removed 90 days after they were last changed. A notification address is removed when you turn notifications off.

When you leave, your sign-in and roster are removed. Your hours and leave records stay under your name, as the law requires. Your sales figures and targets are moved to an unnamed record, so the shop’s totals still add up without being about you.

You can ask us to:

• give you a copy of everything the Hub holds about you
• correct anything that is wrong
• delete it, where we are not required to keep it
• limit how we use it, or object to a use that relies on our legitimate interests

Most of your own records are already visible to you in the Hub. For anything else, email info@castledavitt.ie. We will reply within one month. If you are unhappy with how we have handled your data, you can complain to the Data Protection Commission at dataprotection.ie.

If the Hub starts to record something new about you, or uses it differently, this notice will be updated before that happens, and you will be told.