Staff privacy notice - PTG Staff Hub
Controller: Beyond Card Grading, 263-269 Cleethorpe Road, Grimsby, DN313BH (beyondcardgrading@gmail.com). This notice explains how staff data in this system is used under UK GDPR and the Data Protection Act 2018. Your employer should review and adapt it before use.
What we collect and why
- Account and employment details (name, work email, optional phone, job, department, start/end dates, contract hours) - to run your employment contract.
- Attendance (clock-in/out times recorded by our server, breaks, corrections) - to pay you correctly and meet working-time record duties.
- Network checks - when you clock in or out we record the public internet (IP) address your request came from and whether it matched the approved workplace network (“PTG-Shop”). This is used only to confirm clocking happens via the workplace connection and to detect misuse. We do not collect GPS location and a website cannot see which Wi-Fi network you are connected to.
- Pay information (hourly rates and their history, tax code, NI category, pension and student loan settings, estimates and payroll summaries) - to calculate and pay wages and meet HMRC obligations. Only authorised payroll users can see this.
- Holidays and sickness - dates, hours and optional brief notes or fit notes. Sickness information is health data (special category). It is visible only to you and specifically authorised managers, and we do not ask for diagnoses.
- Tasks, rota, messages and announcements - to organise work. Task statistics are not used on their own to judge performance.
- Security logs and an audit trail of important changes - to protect records and show who changed what and why.
Lawful bases
Performance of your employment contract; legal obligations (payroll, tax, working time, statutory sick pay, right-to-holiday records); legitimate interests in security and running the business; and for health data, employment-law obligations (UK GDPR Art. 9(2)(b) and DPA 2018 Schedule 1 Part 1).
How long we keep it
Attendance records: 6 years. Payroll records: 6 years (HMRC requires at least 3 years after the end of the tax year). Sickness records: 3 years after the absence. Network logs: 365 days. Read notifications: 180 days.
Your rights
You can ask for a copy of your data, ask for corrections, and in some cases object or ask for erasure (records we must keep by law cannot be deleted early). You can complain to the Information Commissioner's Office (ico.org.uk). Contact beyondcardgrading@gmail.com to make a request.