Who is responsible?
The application operator is Civik Limited. A workspace business decides how its customer and staff records are used. The operator and workspace business must document their respective controller and processor responsibilities before live use.
Privacy contact: not yet configured.
What the application can hold
- Account email, authentication identifiers and security/session information.
- Customer contacts, correspondence addresses, locations and optional service/billing preferences.
- Staff profiles, assignments, working times, approved pay, task outcomes and job photos.
- Restricted staff identity/payroll/driving fields where authorised users choose to enter them.
- Recorded customer charges, receipts, reversals, reviews, updates and activity records.
Information may be entered by you, your workspace organisation or its authorised users. Optional fields should only be filled when needed; do not add unrelated sensitive information to notes or photos.
Website enquiries and trial requests
Civik Limited uses the name, email, business name, requested team size and optional message you submit to respond and arrange a trial or handle your enquiry. The operator stores the request, the offer shown and a one-way keyed rate-limit identifier derived from hosting request information to reduce abuse. The application does not store a raw IP address in the request table or add you to a marketing mailing list. Hosting-provider logs are separate. Requests are visible to the application operator, not customer workspace members. Unconverted enquiries are reviewed for removal after 90 days; the current cleanup process is manual. Use the contact form for operator enquiries and information requests.
Why information is used
The application supports account access, work scheduling, completing tasks, managing staff time, recording money and security. Each organisation must identify and explain the applicable lawful bases for its processing. A separate condition is needed where special-category information is processed. These bases, any legitimate interests and any mandatory data requirements are still to be documented for launch.
Who can receive it
Access is limited by workspace membership, role and assignment. Supabase supplies authentication, database and private file-storage services in the current build. The final hosting provider, subprocessors, support access, hosting regions and any international-transfer safeguards must be recorded before launch. A European project region alone does not settle every transfer question.
Retention and deletion
The live retention schedule has not been set. It must specify periods or criteria for account details, staff/customer records, identity fields, photos, finance records, logs and backups. Archiving a staff record is not deletion. The application does not currently promise automatic erasure when a record is archived or a job closes.
Your rights and concerns
Depending on the processing, rights may include access, correction, erasure, restriction, portability and objection. Where consent is relied on, it may be withdrawn. These rights have conditions; some records may need to be retained.
You may have a right to object, particularly where processing relies on legitimate interests or involves direct marketing.
For workspace employment/customer records, contact the organisation that added your information. For application-account or operator matters, use the privacy contact above. Requests need secure identity checks and review; this page does not automatically delete or export records.
You can also raise a concern with the Information Commissioner’s Office.
Cookies and external links
Read the cookie information. Directions links open an external map provider only when selected; that provider has its own privacy information. No automated hiring or eligibility decision feature is implemented in this build.