Who We Are

The data controller responsible for your personal data is:

As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that processing is lawful.

Definitions

The following terms are used throughout this Privacy Policy:

• Company / We / Us refers to Hospo.work Ltd.
• Service refers to our website (hospo.ltd), our WhatsApp Business channel, and all related digital platforms and tools we operate.
• Freelancers refers to hospitality professionals registered with us to find work through the Service.
• Business Partners refers to venues that have signed up to use the Service to request staff.
• Venue Managers refers to the managers or owners of a Business Partner authorised to make staffing and financial decisions on behalf of the venue.
• Personal Data means any information relating to an identified or identifiable individual.
• Special Category Data means sensitive personal data such as health information, biometric data, or data relating to criminal convictions.
• Usage Data means data collected automatically when you use the Service, such as your IP address or browser type.
• Cookies means small text files placed on your device by websites you visit.
• Third-Party Processors means external companies we engage to process data on our behalf in order to deliver the Service.
• UK GDPR means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018.

Personal Data We Collect

3.1 Data you provide to us

We collect the following personal data that you give us directly:

• Identity data: first name, last name, and date of birth.
• Contact data: email address, phone number, and postal address.
• Identity verification data: copies of identity documents (e.g. passport or driving licence), collected for the purpose of verifying your right to work. Collected at the point of onboarding as a Freelancer only.
• Financial data: bank account details, collected for the sole purpose of paying Freelancers for completed shifts. We do not store card payment details.
• Professional data: work history, skills, and hospitality experience, provided when registering as a Freelancer.
• Communications data: messages you send to us via WhatsApp, email, or other channels, including shift requests, enquiries, and feedback.

3.2 Data we collect automatically

When you use our website or digital platforms, we may collect:

• Usage Data: your IP address, browser type and version, pages visited, time and date of your visit, and other diagnostic data.
• Device data: the type of device you use to access the Service, your device's unique identifier, and your mobile operating system (where applicable).
• Cookie data: see Section 6 for full details.

3.3 Data we collect from WhatsApp

Hospo operates its primary staffing service via WhatsApp Business, operated by Meta Platforms Ireland Ltd. When you communicate with us through WhatsApp, we receive the content of those messages and the phone number from which they are sent. We use this information to process shift requests, confirm bookings, and manage the staffing process.

WhatsApp processes your data under its own privacy policy, which you should review separately. Meta may transfer your data internationally. Where we instruct Meta to process data on our behalf, it acts as a data processor under a data processing agreement.

3.4 Data from third-party forms

We use Jotform to collect shift applications from Freelancers. When you submit a shift application via Jotform, we receive the information you enter in that form. Jotform processes this data on our behalf as a data processor.

How We Use Your Personal Data

We only use your personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our purposes, the types of data we use, and the legal basis for each.

Who We Share Your Data With

We do not sell your personal data. We share your data only in the following circumstances:

5.1 Business Partners (Venues)

When a Freelancer is confirmed for a shift, we share their name and relevant professional information with the Business Partner hosting the shift. We do not share Freelancers' contact details with Business Partners without the Freelancer's explicit consent.

5.2 Third-party data processors

We engage the following third-party processors who handle personal data on our behalf under data processing agreements:

• Airtable (Formagrid Inc., USA) — our core database for managing Freelancer and venue records, shifts, and applications.
• Twilio Inc. (USA) — provides the WhatsApp Business API and SMS messaging infrastructure we use to broadcast shifts and communicate with users.
• Meta Platforms Ireland Ltd (Ireland / USA) — WhatsApp Business platform through which we operate our primary communication channel.
• Jotform Inc. (USA) — our online form platform, used for collecting shift applications from Freelancers.
• Stripe Inc. (USA / Ireland) — payment processing for venue charges. Stripe handles card data under PCI DSS compliance.
• Google LLC (USA) — we use Google Analytics to analyse website usage. Data collected may include anonymised usage and device data.

All processors are required to handle your data securely and only for the purposes we instruct. We do not permit them to use your data for their own purposes.

5.3 Other disclosures

We may also share your data:

• With law enforcement or regulatory bodies where required by law or court order.
• With professional advisers (lawyers, accountants, insurers) where necessary.
• In connection with a business sale, merger, or acquisition, where your data may form part of the transferred assets. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Cookies

We use cookies on the hospo.ltd website. Cookies are small files stored on your device that help us recognise you and improve your experience.

• Essential cookies: Necessary for the website to function. They enable core features like user authentication and security. You cannot disable these without affecting how the site works.
• Functionality cookies (persistent): These remember your preferences and settings so you do not have to re-enter them each time you visit.
• Analytics cookies (persistent): We use Google Analytics to understand how visitors use our site. This data is aggregated and anonymised. You can opt out at tools.google.com/dlpage/gaoptout.
• Cookie consent cookies (persistent): These record whether you have accepted or declined our cookie policy.

When you first visit our website, you will be asked to consent to non-essential cookies. You can change your preferences at any time via the cookie settings link in our website footer. Refusing non-essential cookies will not affect your ability to use the core Service.

International Transfers of Personal Data

Some of our third-party processors are located outside the UK, including in the United States. Transfers of personal data to countries that do not benefit from a UK adequacy decision are carried out using one or more of the following safeguards:

• International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses, as approved by the UK Information Commissioner.
• The processor's participation in a recognised framework providing adequate protections for UK personal data.

By using the Service, you acknowledge that your data may be transferred to and processed in countries outside the UK. We take all steps reasonably necessary to ensure your data is handled securely and in accordance with this Privacy Policy.

How Long We Keep Your Data

We keep your personal data only for as long as it is needed for the purpose it was collected:

• Freelancer account data: Retained for the duration of your active registration and for up to 6 years after your last interaction with us, to comply with legal and tax obligations.
• Identity verification documents: Retained for the duration of your registration and deleted within 12 months of account closure, unless a longer period is required by law.
• Bank account details: Retained only for as long as needed to process payment for a completed shift, then deleted. We do not retain bank details for future use without an active payment mandate.
• Shift records and communications: Retained for up to 6 years for accounting and legal purposes.
• Usage and analytics data: Retained for up to 26 months in line with Google Analytics defaults, unless anonymised sooner.
• Marketing data (where you have consented): Retained until you withdraw consent or for up to 3 years of inactivity, whichever is sooner.

When data is no longer required, it is securely deleted or anonymised. We will also delete your data promptly if you exercise your right to erasure, where that right applies (see Section 9).

Your Rights Under UK Data Protection Law

Under the UK GDPR and the Data Protection Act 2018, you have the following rights. These rights are not absolute and some may not apply in every circumstance.

• Right to access: You can request a copy of the personal data we hold about you (a "Subject Access Request"). We will respond within one month.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You can ask us to delete your personal data where it is no longer necessary, where you withdraw consent, or where you object to processing. This right does not apply where we have a legal obligation to retain the data.
• Right to restrict processing: You can ask us to pause processing your data in certain circumstances, for example while you contest its accuracy.
• Right to data portability: Where processing is based on consent or a contract and carried out by automated means, you have the right to receive your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests, including for direct marketing purposes. If you object to direct marketing, we will stop immediately.
• Rights related to automated decision-making: Where we use automated processing that produces legal or similarly significant effects for you, you have the right to request human review of that decision.
• Right to withdraw consent: Where we process your data on the basis of consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@hospo.ltd. We may need to verify your identity before processing your request. There is no fee for making a request, unless it is manifestly unfounded or excessive.

Right to Complain to the ICO

If you are unhappy with how we handle your personal data, we encourage you to contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These include access controls, encrypted storage, and data minimisation practices.

No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

Children

Our Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. To use our Service as a Freelancer, you must be of legal working age and legally permitted to work in a licensed hospitality environment, including in venues that serve alcohol.

If we become aware that we have collected personal data from a person under 18 without appropriate parental consent, we will delete that data promptly. If you believe we may have collected data from a child, please contact us at privacy@hospo.ltd.

Links to Third-Party Sites

Our website may contain links to third-party websites. These sites have their own privacy policies, which we encourage you to review. We are not responsible for the content, privacy practices, or security of any external sites.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the Service. Where changes are material, we will notify you by email or by a prominent notice on our website before the changes take effect. We will also update the "Last updated" date at the top of this document.

Continued use of the Service after changes have been posted constitutes acceptance of those changes, to the extent permitted by applicable law.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

We aim to respond to all data-related enquiries within 30 days.

Third-Party Data Processors

The following processors handle personal data on our behalf. All are bound by data processing agreements and may only process data in accordance with our instructions.