Privacy notice

Last updated: 17 October 2026

This notice explains how My Nine to Five ("we", "us") collects, uses, stores and protects personal information when you visit our website, contact us, or use our software. It is written in plain English, but it is a legal document: it satisfies the UK GDPR and the Data Protection Act 2018 transparency requirements.

My Nine to Five is operated by Ancor Cabezas Hayes, a sole trader trading as My Nine to Five. Contact: [email protected], 18 Hazelgrove Gardens, Haywards Heath, RH16 3JL. We are registered with the Information Commissioner's Office (ICO registration number [insert number]).

1. Who is responsible for your data

Under UK data protection law, every set of personal information has a controller (who decides why and how it's used) and may have a processor (who handles it on the controller's behalf).

In short: if you are a volunteer or member of staff, the organisation you belong to is responsible for your records — please contact it first with questions or requests about your data. If you contacted us or are our customer, we are responsible.

2. Information we collect

From website visitors and enquiries

If you contact us through the form or by email, we collect your name, email address, your organisation's name, and whatever you tell us. We use it to reply and to discuss whether the service suits you.

Through the software (as your processor)

Depending on the features your organisation switches on, its authorised users may enter: names and contact details; roles, teams and availability; rota bookings and waiting lists; attendance and check-in times; timesheets, pay rates and expense or mileage claims; onboarding documents, references, DBS check status and dates, and training records; and messages and reports. Your organisation decides what to enter — it should only record what it needs, with an appropriate lawful basis.

Technical information

To run and protect the service we process technical records such as sign-in events and error logs.

3. Where your data is stored

Employee and volunteer records entered into the software are stored only on Cloudflare (Cloudflare Pages, Workers, D1 databases and R2 file storage) — Google services are not used for this data. Our own business records (enquiries, customer accounts, contracts and related documents) are held in Google Workspace, with transactional email delivered by Resend. Each customer organisation gets its own private database and file storage — data is never mixed between organisations. All customer data is hosted in the UK/EU. Where any information is transferred outside the UK, we rely on the applicable transfer safeguards such as the UK Addendum to the EU Standard Contractual Clauses or the UK–US Data Bridge.

4. How long we keep it

Enquiries are kept while the conversation is live and for up to 12 months afterwards. Customer account and billing records are kept for the life of the account plus six years (the usual limit for bringing contractual claims). Your organisation's records in the software are kept for as long as it subscribes. If an organisation leaves: it can export everything itself at any time, and we will export a full copy for it on request. We then delete its database and files within 30 days of the contract ending. Backups may retain a deleted organisation's data for up to 60 days after that before they are overwritten, after which recovery is not possible.

5. Security

Each organisation's data sits in its own separate database, accessible only through its own app with permission-based access controls. Sign-in is by emailed one-time code or link — no shared passwords. We use encrypted connections throughout, and administrative access to customer data is limited to what is needed to provide support. No online service can promise perfect security, and we will notify affected customers without undue delay if a personal data breach affects their records.

6. DBS and safeguarding records

The software records DBS check status and renewal dates — not the certificate contents. Criminal-record information has extra legal protection; your organisation must have a lawful basis before recording it, and we recommend recording only the check status, level and date.

7. Sharing

We never sell personal information and never share one organisation's data with another. We share it only with the infrastructure providers above, or where legally required. We do not use your organisation's data to train anything. The website does not use analytics or advertising cookies, so there is no cookie banner; if we add non-essential cookies in future we will ask for your consent first.

8. Your rights

Depending on the circumstances, you can ask to access, correct, delete or restrict the use of your personal information, object to certain processing, or get a copy of it. If your data is held by an organisation using our software, ask that organisation — it is the controller and can export or update your records in the app. For data we control, email [email protected]. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

9. Data processing agreement

Customer organisations can request a written data processing agreement covering instructions, confidentiality, security, sub-processors, breach notification, assistance with individuals' rights, and deletion or return of data at the end of the contract. Email [email protected].

10. Changes and contact

We may update this notice; the current version is always published here with its date. Questions? Email [email protected].

[Before publishing: replace the ICO registration number. Don't publish anything you can't stand behind.]