Privacy Policy

Last updated: 07 November 2026

1. Who we are

StaffSync is a compliance and HR platform used by UK employers ("Companies") to manage their workforce, including sponsored workers under a UK Home Office Sponsor Licence. For data protection purposes, the Company using StaffSync is the data controller of its employees' personal data. StaffSync acts as a data processor, processing that data only on the Company's instructions.

2. What data we process

Depending on your role (Company user or Employee), this may include:

• Contact details — name, email, phone, address
• Employment details — job title, salary, working hours, work location
• Attendance and holiday records
• Special category / immigration data (for sponsored workers) — passport details, visa type and dates, Certificate of Sponsorship (CoS) numbers, and right-to-work check records
• Documents you upload — passports, right-to-work evidence, employment contracts
• NEST pension enrolment status and reference numbers

3. Why we process it (lawful basis)

• Contract — to provide the account and features you or your employer have signed up for
• Legal obligation — UK Sponsor Licence holders are legally required to retain right-to-work and immigration records, and to report certain changes to the Home Office within statutory timeframes
• Legitimate interest — maintaining accurate employment records, audit trails, and account security

4. How long we keep it

Right-to-work and sponsorship records are retained for the period required by UK Home Office guidance for sponsor licence holders, even after an employee leaves — this is a legal retention obligation that can override an otherwise-applicable erasure request for that specific compliance data. Other personal data is retained only as long as necessary for the purposes above, or until deletion is requested and actioned by your employer.

5. Your rights

Under UK GDPR, you have the right to:

• Access the personal data held about you
• Correct inaccurate data (via your employer, who controls your record)
• Request erasure of your data, subject to the legal retention obligations described above
• Request a portable, machine-readable copy of your data (available from your Profile page)
• Object to or restrict certain processing

Employees can exercise these rights via their StaffSync profile, or by contacting their employer directly, since the employer is the data controller. Company users can contact us directly at the address below.

6. Where data is stored

Documents and records are stored with encryption at rest. We use third-party processors — including Stripe for payment processing and cloud storage providers for file storage — under data processing agreements that require GDPR-equivalent protections.

7. Contact

For privacy questions or to exercise a data subject right, contact us via the Contact page.