Privacy Policy

1. Who we are

CrewFlow (the "Platform"), operated by the Platform provider named in your order form. For account data (your login, your organisation's billing details) CrewFlow is the data controller. For workforce data your organisation uploads, CrewFlow is a data processor acting on your instructions.

2. What we collect

Depending on your role, the Platform holds:

• Account data: name, work email, job title, phone, organisation membership and role.
• Workforce data: worker identity documents, A1 certificates, qualifications, assignments, timesheets, expenses and travel arrangements uploaded by your organisation.
• Usage data: audit log entries recording who changed what and when, plus technical logs needed to run and secure the service.
• Billing data: company details, VAT number and subscription records. Card details are handled by our payment provider and never reach CrewFlow servers.

3. Legal bases

Account and billing data are processed to perform our contract with you. Audit and security logging is processed under our legitimate interest in operating a secure, accountable platform. Workforce data is processed on your organisation's instructions, under the legal basis your organisation has established with its workers.

4. AI processing

Documents submitted for extraction (timesheets, receipts, passports, A1s, qualifications) are sent to our model provider for the sole purpose of returning structured data. Payloads are not used to train third-party models and are deleted according to your organisation's AI retention setting.

Organisations may opt out of AI processing entirely in Settings, in which case all extraction is performed manually.

5. Sharing and location

Data is hosted in the European Union. We share data only with sub-processors listed in the Data Processing Agreement: our cloud database and storage provider, our AI model provider, our email provider and our payment provider.

6. Retention

Retention periods are configurable by each organisation in Settings, defaulting to seven years for audit records and six years for documents, in line with common European employment and tax requirements.

7. Your rights

Individuals have the right to access, rectify, erase, restrict and port their personal data, and to object to processing. Workers should contact their employing organisation first; CrewFlow provides both self-service export and erasure tooling to organisation administrators and will assist where a request is escalated to us.

8. Contact

Privacy questions and data subject requests can be sent to the privacy contact address published on your order form. We respond within one calendar month.