Carbonite Workforce App Privacy Notice
How the Carbonite companies use personal information through the workforce application
Version: 1.0
Effective date: 28 August 2026
Document owner: The Carbonite Group Ltd
This Privacy Notice applies to applicants, employees, workers, contractors, self-employed operatives, managers, administrators and other authorised individuals whose personal information is processed through the Carbonite workforce application (the App).
It is separate from the general website privacy notice. It explains how personal information is used through the App and connected workforce processes. It does not form part of an employment or engagement contract and does not ask you to consent to processing that is required for lawful workforce purposes.
1. Who is responsible for your information
The primary controller for workforce information is normally the Carbonite company that employs, engages, recruits, supplies work to or otherwise manages the relevant relationship with you. This is called your Relevant Carbonite Company.
| Company | Company number | Typical responsibility |
|---|---|---|
| The Carbonite Group Ltd | 15096241 | Individuals employed or engaged directly by the Group; central App security and authorised group administration |
| Carbonite Protect Ltd | 14045345 | Protect applicants, employees, workers and operatives |
| Carbonite Traffic Solutions Ltd | 12559606 | Traffic applicants, employees, workers and operatives |
| Carbonite Clean Ltd | 07852559 | Clean applicants, employees, workers and operatives |
All four companies are registered in England and Wales. Their registered office is 1 Parkshot, Richmond, Surrey, England, TW9 2RD.
The Carbonite Group Ltd operates and administers the App and provides authorised central IT, compliance and administrative support. When it handles information solely on a subsidiary's instructions, it acts as that company's processor. It acts as a controller for its own workforce, App security and audit information, and any central purpose that it determines and explains in this Notice.
Where more than one Carbonite company jointly determines a particular purpose, they will share responsibility for that processing and will cooperate in responding to data-protection requests. You may contact any relevant Carbonite company using the contact details in this Notice.
2. Information we collect
The information processed depends on your role and relationship with Carbonite. It may include:
- identity and contact details, including name, date of birth, address, telephone number, email address, photograph and emergency contact details;
- recruitment and engagement information, including applications, work history, references, interview records, contracts, availability and employment or contractor status;
- identity, screening and compliance information, including right-to-work evidence, passport or identity-document details, SIA licence details, DBS or vetting information where lawful, qualifications, certifications and screening records;
- shift, rota and attendance information, including availability, assigned or accepted shifts, check-in and check-out times, site information and location captured through location-enabled attendance functions;
- payment and financial information, including bank details, National Insurance number, UTR where relevant, tax information, hours, timesheets, expenses, invoices, deductions, payslips and payment history;
- training and performance information, including courses, assessments, renewals, supervision, feedback, attendance, capability, conduct and performance records;
- health, safety, welfare and incident information, including health information you provide, reasonable-adjustment information, accident or incident reports, safeguarding matters and emergency-contact information;
- communications and submitted content, including messages, forms, acknowledgements, photographs, documents, reports, signatures and other media; and
- technical and security information, including account identifiers, permissions, device and browser information, IP addresses, login events, audit logs, security events, error records and support communications.
When you provide information about an emergency contact, referee or another person, you should tell them that Carbonite may use their information for the relevant purpose and direct them to this Notice where appropriate.
3. Where the information comes from
Information may be obtained:
- directly from you through the App, application forms, interviews, communications and submitted documents;
- from managers, colleagues, clients, site representatives and other people involved in scheduling, supervising or verifying work;
- from referees, former employers, screening providers, training providers, payroll providers, government bodies and regulators where lawful;
- from public sources where checks are necessary, proportionate and lawful; and
- automatically from the App, device or connected systems when you sign in, use functions, check in or out, submit information or encounter an error.
4. Why we use the information and our lawful bases
Accounts, onboarding and engagement
We create accounts, verify identity, recruit and onboard people, administer contracts and provide access appropriate to a role. We rely on steps requested before entering a contract, performance of a contract, legal obligations and legitimate interests in managing a secure and effective workforce.
Shifts, attendance and service delivery
We plan and allocate resources, record availability, offer or confirm shifts, verify attendance, respond to service issues and meet commitments to clients. We rely on performance of employment or engagement arrangements, legal obligations and legitimate interests in delivering services, protecting clients and maintaining accurate operational records.
Pay, tax and financial administration
We calculate or verify hours, administer payroll or contractor payments, provide payment records, process expenses and deductions, and meet tax, pension, accounting and reporting duties. We rely on contract and legal obligations.
Licensing, screening and compliance
We confirm right to work, licences, qualifications, training, screening and suitability where relevant to a role or client requirement. We rely on legal obligations, contract and legitimate interests in lawful recruitment, regulatory compliance, safety and service quality. Criminal-offence information is processed only where a separate legal condition permits it.
Training, management and performance
We administer training, supervision, capability, attendance, conduct, performance, complaints and recognition. We rely on contract, legal obligations and legitimate interests in managing people fairly, safely and effectively. Significant decisions should include appropriate human review and relevant context.
Health, safety, welfare and incidents
We protect health and safety, provide adjustments, respond to welfare concerns and emergencies, investigate incidents and manage insurance or legal claims. We rely on legal obligations, legitimate interests and, in a genuine emergency, vital interests. Where health or other special-category information is involved, an additional condition is also used as explained below.
Security, fraud prevention and legal matters
We authenticate users, assign permissions, monitor security, investigate suspected misuse, maintain audit records, protect confidential information, exercise or defend legal rights and comply with regulators or lawful requests. We rely on legal obligations and legitimate interests in protecting people, information, systems, clients and the Carbonite companies.
Consent
We do not rely on consent for processing that is necessary for employment, engagement, payment, security, legal compliance or ordinary workforce administration. We will rely on consent only for a genuinely optional purpose where you have a real choice and can withdraw without disadvantage.
5. Special-category and criminal-offence information
Health information and certain other sensitive information receive additional protection. Depending on the purpose, the relevant Carbonite company may rely on employment, social-security and social-protection law; occupational health obligations; the establishment, exercise or defence of legal claims; substantial public-interest conditions; or vital interests. An Appropriate Policy Document will be maintained where the Data Protection Act 2018 requires one.
DBS, criminal-allegation, conviction and related information is processed only where authorised by law and necessary for an eligible role, safeguarding, preventing or detecting unlawful acts, regulatory compliance or legal claims. Access is restricted to people who need the information for an authorised purpose.
6. Location information and workforce monitoring
The App may capture device location when you initiate a location-enabled attendance function, such as check-in or check-out. It is used to verify attendance, administer shifts, investigate discrepancies and support safety or incident management.
Ordinary check-in and check-out use is not intended to collect continuous background location. If a role or App function requires materially different monitoring, Carbonite will provide specific information about its nature, purpose and extent before introducing it.
Location and attendance information may be inaccurate because of signal, device settings or technical failure. Carbonite should consider relevant context and allow a person to explain a discrepancy before making a significant adverse decision.
7. Automated decision-making
The App may calculate, organise, display or flag information to help authorised people administer work. Carbonite does not use the App to make solely automated decisions that produce legal or similarly significant effects without appropriate human involvement. If this changes, affected individuals will receive the additional information required by law.
8. Who we share information with
Information is shared only where reasonably necessary and with appropriate controls. Recipients may include:
- authorised staff within the Relevant Carbonite Company and The Carbonite Group Ltd;
- another Carbonite company where it provides authorised central services or has a genuine operational, legal or compliance need;
- clients, venues and site representatives where necessary to arrange, verify or safely deliver services;
- cloud-hosting, software-development, IT-support, communications, identity, screening, training, payroll, accounting, pension, banking and payment providers acting under appropriate arrangements;
- professional advisers, auditors, insurers and prospective purchasers or successors where appropriate; and
- HMRC, the Home Office, the SIA, police, courts, tribunals, regulators, emergency services and other public bodies where required or permitted by law.
Carbonite does not sell workforce personal information.
9. International transfers
Some service providers or support personnel may store or access information outside the United Kingdom. Before permitting a restricted transfer, the relevant controller will use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard as applicable. Additional information about relevant safeguards can be requested using the contact details below.
10. How long we keep information
We keep information only for as long as it is reasonably needed for the purpose, legal obligations and the establishment or defence of claims. The following periods are the normal starting points. A record may be retained longer where a dispute, investigation, safeguarding matter, audit, insurance requirement or legal hold applies, and less-relevant or duplicate information may be deleted earlier.
| Record category | Normal retention approach |
|---|---|
| Unsuccessful recruitment records | Normally 6 months after the process ends, unless a longer period is justified or agreed for future opportunities |
| Core personnel and engagement records | Normally the engagement period and up to 6 years afterwards |
| Payroll, timesheets, invoices and payment records | Normally 6 years after the relevant financial year or payment, subject to legal requirements |
| Right-to-work evidence | Duration of employment or engagement and 2 years afterwards |
| Location and routine attendance records | Normally up to 12 months, unless incorporated into a pay, incident, complaint or legal record requiring longer retention |
| App security and audit logs | Normally up to 12 months, or longer where required for an investigation or security purpose |
| Training, licence and compliance records | For the engagement and the period required by law, regulatory guidance, client obligations or legal claims |
| Health, welfare, accident and incident records | According to the nature of the matter, applicable law, insurance requirements and relevant limitation periods |
11. Security
Carbonite uses appropriate technical and organisational measures designed to protect information. These include role-based access, named accounts, authentication controls, restricted administrative access, logging, database access controls, secure development measures, validation and security monitoring. Access is limited according to role and legitimate need.
No system can be guaranteed completely secure. Users must follow the App Terms, information-security requirements and the Bring Your Own Device Policy, and report suspected incidents promptly.
12. Whether you must provide information
Some information is required to enter or administer an employment or engagement relationship, confirm legal eligibility, allocate suitable work, protect health and safety, provide payment or meet regulatory duties. If required information is not provided, Carbonite may be unable to onboard you, offer particular work, make a payment correctly or provide access to a function. Carbonite will explain the consequence where it is not already clear and will consider reasonable alternatives where appropriate.
13. Your data-protection rights
Depending on the circumstances, you may have rights to:
- receive information about how your personal information is used;
- request access to your personal information;
- have inaccurate information corrected and incomplete information completed;
- request deletion or restriction in certain circumstances;
- object to processing based on legitimate interests or public task;
- receive or transfer information where the right to data portability applies;
- withdraw consent where consent is genuinely relied upon; and
- challenge qualifying solely automated decisions.
These rights are not absolute and lawful exemptions may apply. Carbonite may need to verify your identity and will normally respond within one month. There is normally no charge, although a reasonable fee may be permitted for a manifestly unfounded, excessive or repeated request.
14. Questions, requests and complaints
You can contact the Relevant Carbonite Company or The Carbonite Group Ltd about this Notice or exercise a data-protection right using:
The Carbonite Group Ltd, registered in England and Wales under company number 15096241.
Registered office: 1 Parkshot, Richmond, Surrey, England, TW9 2RD
Telephone: 0203 576 7204
Email: admin@thecarbonitegroup.com
If you are not satisfied with Carbonite's response, you may complain to the Information Commissioner's Office at www.ico.org.uk or by telephone on 0303 123 1113. You may also seek a judicial remedy.
15. Changes to this Notice
We may update this Notice when the App, processing activities, group structure, suppliers or law changes. We will display the current version and effective date and will actively notify affected users of material changes where appropriate.
