Worker Privacy Notice

1. Who Is Responsible for Your Data

Your employer or the company that engages you is the data controller. They decide what is collected about you and why, and they are the first point of contact for any question or request about your data. Saral is the software they use to do it. Saral is operated by Deshwal & Co. (the trading name of Vikas Deshwal, England), who acts as your employer’s data processor: we process your data only to provide the service, on your employer’s instructions, and never for our own purposes. If you contact us directly at accounts@getsaral.co.uk, we will refer your request to your employer and help them answer it.

2. What Data Is Collected

Depending on which features your employer uses, your record in Saral can hold:

• Identity: full name, date of birth, nationality, home address, phone number, email address, emergency contact
• Right to work: passport, biometric residence permit or visa, Home Office share code and the result of the check
• Tax references: National Insurance number, Unique Taxpayer Reference (UTR), CIS verification status
• Bank account details for paying you (account name, sort code, account number). The account number is shown masked on screen, and every time an office user reveals the full number it is recorded
• Proof of address, accreditation and training documents (CSCS card, CITB certificate and similar), and if you contract through your own limited company, its details
• Your profile photo, if you agree to provide one (see section 3)
• Attendance: when you checked in and out, which site, how the check-in was made, and the paid time worked out from it; your timesheets and, for CIS subcontractors, the invoices raised from them
• Location: the single point where your phone was when you checked in by GPS, and site arrivals and departures where your employer has set up geofenced sites (see section 3)
• Health information you declare on the starter form (injuries or medical conditions relevant to site safety), sickness forms, and any HR case your employer records
• Leave, training, kit issued to you, and contract documents you sign, with your electronic signature, IP address and the time of signing

Where your employer uploads a certificate or identity document, Saral may read it with an AI service (Anthropic) to fill in the record; a person at your employer confirms what was read. Saral does not process payroll and does not file any return — payslips, P60s and HMRC returns come from your employer’s payroll and accounting software, not from Saral.

3. App Permissions, Photos and Face Check-in

The Saral portal and mobile app can ask for the following device permissions. Each is used only for the purpose described:

4. Why Your Data Is Processed (Lawful Basis)

5. Who Can See Your Data, and Where It Is Stored

Your employer’s office users — the people your employer has given HR, attendance, payroll-preparation or site-management roles — see your record according to their role; site managers see the check-in photos only through the exceptions queue. You see your own record in the portal. Saral’s operators cannot sign in as you or your employer and have no way to browse records inside the application; they access data only to support your employer or keep the service running, and platform administration actions require two-step verification and are logged. Your data is stored in the EU (Supabase on AWS, Ireland); the application runs on servers in Dublin. Documents you upload (passport, proof of address and similar), photos and signatures are kept in private storage, opened only through links that expire within an hour; bank account numbers are masked on screen with every full reveal recorded; and every change to your record is written to a tamper-evident audit trail.

6. How Long Your Data Is Kept

7. Who Your Data Is Shared With

Your data is never sold or used for marketing. It is shared only as your employer instructs, with:

• HMRC — your name, UTR, NI or company number and address, to verify your CIS status when you are engaged as a subcontractor
• The Home Office (UK Visas and Immigration) — your share code and date of birth, to check your right to work
• Xero — your employer’s accounting system, which receives you as a supplier contact and your approved CIS invoices and payments
• Your employer’s accountant or payroll provider — for payment and payroll, in their own systems
• Site clients — limited to name, trade and accreditation status for site access, where your employer shares it
• DVLA — if you drive for your employer and give your consent, your licence number, name and date of birth for a licence check

Saral also uses service providers to run the platform — the database and file storage, email and text messages, push notifications, AI reading of documents, face comparison and error monitoring. Each is bound by a data processing agreement, and the full current list, with what each can see and where it processes, is public at /subprocessors; the controls that protect your data are described on /trust. Where a provider is outside the UK, transfers rest on adequacy regulations or the UK Addendum to the standard contractual clauses.

8. Your Rights

Under UK GDPR you have the right to:

• Access — a copy of the personal data held about you
• Correction — have inaccurate or incomplete data corrected; you can update many of your own details in the portal
• Erasure — deletion of your data where no legal obligation requires it to be kept (CIS and right-to-work records must be kept for their statutory periods; the audit trail is kept for 7 years as evidence)
• Restriction — restriction of processing while a dispute is resolved
• Portability — your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — remove your photo and withdraw from face check-in at any time from your profile, with a card as the alternative

To exercise any of these rights, ask your employer — they are the controller and have the tools to act in Saral. If you write to Saral at accounts@getsaral.co.uk, we will pass your request to your employer and assist them so that you receive a response within one month, as the law requires.

9. Complaints

If you believe your data has not been handled correctly, raise it with your employer first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to This Notice

This notice may be updated from time to time, and the latest version is always at this page. Where a change is significant — for example a new use of your photo — you are told in the portal, and a change to what you agreed to is asked for again before it applies.