Privacy Policy

Crewo is provided by Workivio Ltd (company number 17225310, registered office 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom), registered with the UK Information Commissioner's Office (ICO) under reference {ICO_REF}. This policy explains how we handle personal data. For privacy questions, contact privacy@crewo.co.uk.

How we handle data depends on whose data it is:

• We are the "controller" for: the account and contact details of the business customers who sign up, our website visitors, and people we send marketing to. This policy covers how we use that data.
• We are the "processor" for: the personal data a business customer enters about their staff (such as names, contact details, dates of birth, National Insurance numbers, hours, pay and holiday). For that data, the business customer is the controller and decides how it's used; we only process it on their instructions, under our Terms and Data Processing Agreement.

If you're a member of staff whose details are in Crewo and you want to access, correct or delete them, please contact your employer first, they control your data.

Account and business data (we are controller)

• Your name, work email, phone, business name and address, and role.
• Login credentials (passwords are stored securely and we can't see them).
• Billing details, handled by Stripe; we receive confirmation of payments and your plan, but we do not store your full card number.
• Messages you send us (e.g. support requests).

Staff data entered by customers (we are processor)

• Names, contact details, dates of birth, National Insurance numbers, employment type, hourly rates, contracted hours, shifts worked, holiday and time-off records. We process this only to provide the Service to the customer.
• National Insurance number and date of birth are sensitive personal data; we apply appropriate safeguards.

Usage and device data (we are controller)

• How you use Crewo, your device and browser type, and analytics events, collected via cookies and PostHog to help us improve the Service. See Cookies below.

• To provide the Service (run your account, build rotas, calculate estimates, send rota and payroll emails), performance of our contract with you; and, for staff data, processing on the customer's instructions.
• To take payment and prevent fraud, contract and legitimate interests.
• To support you and respond to requests, contract and legitimate interests.
• To improve and secure the Service (analytics, troubleshooting, security), legitimate interests.
• To send marketing (e.g. product updates, tips), consent, which you can withdraw at any time.
• To meet legal obligations (e.g. tax and accounting records), legal obligation.

We don't sell your data. We share it with trusted providers who help us run Crewo, each under contract and only as needed:

• Supabase. Database, authentication, file storage and serverless functions
• Stripe. Payment processing and subscription billing
• Resend. Account and notification emails
• PostHog. Privacy-focused product analytics, loaded only after cookie consent
• {AI_PROVIDER}. Powers the AI labour-cost advisor; rota and cost data sent for analysis is not used to train their models

Your data is stored in the United Kingdom (AWS eu-west-2, London) on infrastructure provided by Supabase.

We may also share data if required by law, or as part of a business sale or reorganisation.

Some of our providers process data outside the UK/EEA (for example in the United States). Where they do, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or Standard Contractual Clauses. Where a provider processes data outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations, as applicable.

• Account data: for as long as your account is active, and for a reasonable period after closure in case you return or for our records.
• Staff data we process for customers: kept while the customer's account is active; on closure or on the customer's instruction, it is deleted or returned, subject to backups being overwritten in the ordinary course.
• Financial and tax records: kept for as long as the law requires (generally six years in the UK).
• Backups: We keep account data for 90 days after an account is closed, so it can be reactivated if you change your mind, and then delete or anonymise it. Employers can export their rota and wage records at any time before closing an account. Encrypted backups are retained for up to 35 days on a rolling basis.

We use technical and organisational measures including encryption in transit, access controls that keep each business's data separate, restricted staff access, and secure, reputable infrastructure providers. No system is perfectly secure, but we take protecting your data seriously and review our measures.

Subject to UK data-protection law, you have the right to access your data, correct it, delete it, restrict or object to its use, port it, and withdraw consent for marketing. To exercise these rights, contact privacy@crewo.co.uk. (If you're a member of staff, contact your employer, who controls your data.) We'll respond within the time the law allows.

We use essential cookies to run the Service (for example to keep you logged in) and analytics cookies (via PostHog) to understand and improve how Crewo is used. You can control non-essential cookies through our cookie banner and your browser settings. For the full list of cookies we use and how to change your choice at any time, see our Cookie Notice.

If you've opted in, we may email you product news and tips. Every marketing email has an unsubscribe link, and you can opt out anytime by emailing us. Opting out of marketing won't stop essential service emails (like rota or billing notices).

Crewo is a business tool not directed at children. We don't knowingly collect data directly from children. Where a customer's staff member is under 18, the customer (as controller) is responsible for having a lawful basis to provide that person's data to us.

We may update this policy. We'll post the new version here with a revised date and, where the change is significant, tell you directly.

If you have a concern about how we handle your data, please contact us first at privacy@crewo.co.uk so we can help. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We produce anonymised, aggregated statistics about shift work in the UK, for example average pay by role and region, from data pooled across many businesses. These statistics never identify any person or business. Organisations can opt out in Settings at any time.

Workivio Ltd
privacy@crewo.co.uk
Address: 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom