Your information

What is recorded about you

• Your name, the name payroll knows you by and your role.
• Timesheets: the date, times, hours and mileage of each visit, and any notes you add.
• Time off requests, including sickness, and whether they were approved.
• Expenses and the receipt photos you attach to them.
• Sign-in details: a scrambled copy of your sign-in link and password, and any passkey you set up.
• Your sessions: the device and browser each one used, its internet address and when it was last active. The internet address is deleted within an hour of the session ending.
• Whether you have opened the install steps or opened the app from your home screen.
• A record of changes made to your account and submissions, and who made them.

Why it is recorded

To run your employment contract: paying you for the hours you work, handling your time off and repaying your expenses. Some of it is also required by law, for example the payroll records HMRC requires an employer to keep. Sickness absence is health information and is recorded because employment law requires your employer to handle sick pay and absence.

The people you support

The app also records which people you visited and when. You see the people you are assigned to visit, by name, and not the rest of the people your employer supports. Reviewers and administrators see the whole list, which they need to check and pay for the work.

Who can see it

You can see your own information. Reviewers and administrators in your organisation can see the information of the staff they manage in order to review work, run payroll and manage accounts.

Visitsheet Ltd runs the service for your employer. Its people can reach the data only to keep the service running and backed up, or to sort out something your employer asks about. They keep it confidential. Nobody else receives it, and the app does not use advertising, analytics or tracking of any kind.

Where it is kept, and for how long

The data is stored on servers in the UK and the European Economic Area, with an encrypted backup copy in the European Economic Area. It is kept while you work for your employer, and afterwards for as long as payroll law requires. That is at least three years after the end of the tax year it relates to. When you leave, your account is closed rather than deleted so that payroll history stays complete.

Your rights

You can:

• ask for a copy of your information
• ask for anything wrong to be corrected
• ask for it to be deleted, where the law does not require it to be kept
• object to how it is used, or ask to limit how it is used

Ask your administrator.

If you filled in the sign-up form you have no administrator to ask, because your organisation does not exist yet. The section on the details you sent with the sign-up form says who holds them and what you can do about them. You can also write to Visitsheet at hello@visitsheet.com.

Anybody can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

On this device

The app sets one cookie, which keeps you signed in and is cleared when you sign out. It remembers which client you last chose on the timesheet form. None of your timesheets, time off or expenses is stored on the device. The app sets no tracking or advertising cookies, which is why it does not ask you to accept any.

Notifications

If you turn notifications on, the app can tell your phone when one of your timesheets has been sent back to you for correction. It can also tell reviewers when a timesheet needs checking. Sending one goes through the notification service your phone already uses: Apple’s on an iPhone, Google’s on an Android phone, Mozilla’s in Firefox. That service is told where to deliver the message, and receives the message itself in a form only your phone can read.

A notification carries:

• the date of the shift
• the name of the client it was for
• the sentence the reviewer typed when they sent it back

Turn notifications off on the Account page in the app, or in your phone’s own settings, and nothing further is sent.

If you filled in the sign-up form

If you filled in the sign-up form, Visitsheet stores:

• your organisation's name
• your name
• your email address, and whether you have confirmed it
• your mobile number and your UK charity number, if you gave them
• how you heard about Visitsheet, if you chose an answer
• which version of the terms you agreed to, and when
• the internet address the form was sent from

We store the details you typed to set your organisation up and to reach you about it. We store how you heard about Visitsheet to learn which ways of telling people about it work. You choose it from a list, such as LinkedIn or a web search, so it says nothing about you or anyone else. We store your agreement to the terms as the record of what your organisation agreed to. We store the internet address to tell a run of spam from real requests. We use them for nothing else.

We email you a link to confirm your email address, which sets your organisation up when you open it. A second email carries your admin setup link, which signs you in. Resend, the service that sends Visitsheet's email, handles your email address and those emails in order to deliver them.

Your details are also kept in our email (Google Workspace) and our customer records (Attio). Google and Attio may store or handle them outside the UK, including in the United States. Google does so under the UK–US data bridge, and Attio under the EU standard contractual clauses with the UK Addendum.

We delete the following from your request once your organisation is set up, or when we tell you we cannot take you on:

• your name
• your mobile number
• the internet address the form was sent from

Your email address is deleted then too if we cannot take you on. If we set your organisation up, it stays as the email address of your administrator account.

If we set your organisation up, Attio keeps your name, email address and mobile number as our contact there while it is a customer. If we cannot take you on, we delete them from Attio when we delete them from your request.

We keep the following as a record of what happened:

• the organisation's name and charity number
• how you heard about Visitsheet
• the date and outcome of the request
• which version of the terms it agreed to, and when

The form used to ask which of mileage, expenses and time off you wanted to record. If you answered that question, we keep your answer as part of this record.

Visitsheet Ltd holds these details and is responsible for them (the “data controller”). Until we have set your organisation up, there is no organisation and no administrator to ask about them, so ask us. Write to hello@visitsheet.com to see what we hold, to have it corrected or to have it deleted.

To correct what you sent, fill the sign-up form in again with the right details. Where two requests arrive from the same organisation, we go by the newer one. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

If we have contacted you, or you have emailed us

We hold:

• your organisation's name and public contact details
• the name, role, work email address and phone number of a person there, where your organisation publishes them
• the emails between us

Visitsheet Ltd holds these details and is responsible for them (the “data controller”).

We take these from your organisation's own website and from public registers. The registers are the Charity Commission, Companies House and the care regulators (CQC, CIW, the Care Inspectorate and RQIA). Attio, our customer records service, also adds details from public sources to the records it holds. If you wrote to us, we take your details from your email.

We hold them to tell organisations that may need Visitsheet about it, and to answer people who write to us. Our lawful basis for this is legitimate interests.

They are kept in our email (Google Workspace) and our customer records (Attio). Google and Attio may store or handle them outside the UK, including in the United States. Google does so under the UK–US data bridge, and Attio under the EU standard contractual clauses with the UK Addendum.

We delete them two years after our last contact with you, unless your organisation becomes a customer.

You can tell us at any time to stop contacting you. Write to hello@visitsheet.com. We then keep only your organisation's name and the email address you asked about. We mark them not to be contacted, so that we do not contact you again.

Write to the same address to see what we hold, to have it corrected or to have it deleted. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.