Apollo Staff Privacy Policy

APOLLO CLEANING SERVICES LIMITED - STAFF PRIVACY POLICY

Version 2.4

Issue Date: July 2026

Review Date: July 2027

Apollo Cleaning Services Ltd is committed to processing your personal data securely, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice explains what personal data we hold about you, why we hold it, and what your rights are. It applies to all employees and contractors. It is not part of your employment contract.

Data controller

Apollo Cleaning Services Ltd (company number 01197218, registered at Office 9, 110-112 George Lane, London, E18 1AD) is the data controller for personal data held about you. Our Data Protection Lead is the CEO, who can be contacted at admin@apollocleaning.com.

Personal data we hold about you

We may collect, store, and use the following categories of personal data about you:

Personal contact details: name, address, personal telephone number, and personal email address
Work details: job title, work location, working hours, and contract type
Date of birth, gender, and nationality
Next of kin and emergency contact information
National insurance number and bank account details
Payroll records, tax status information, salary, pension, and benefits information
Right to work documentation, including copies of identity documents and nationality
Background check and DBS check information (where applicable)
Employment records: start date, contract terms and variations, training records, professional qualifications, and working time records
Performance information: appraisals, feedback, and KPI information
Disciplinary, conduct, and grievance records
Sickness absence and leave records
Conflict of interest declarations
Records of your use of Apollo Cleaning Services Ltd's IT systems, including login activity and email use
Photographs and videos taken in connection with your employment
Leaver interview information and references provided about you
Timekeeping, attendance, and scheduling records (including hours worked, recorded via our HR system)
Location data - for cleaning operatives only: a clock-in and clock-out event is recorded when you enter or leave a defined geographic zone around your work site. This records only the time and fact of arrival and departure. Your location is not tracked continuously during your shift.

Special category data

We may also process special category personal data about you in the following limited circumstances:

Health data - to manage sickness absence, assess fitness to work, make reasonable adjustments, and comply with health and safety obligations
Race or ethnic origin - for equal opportunities monitoring purposes (voluntary)
Biometric data - where required for right-to-work checks or site access requirements

We do not need your consent to process special category data where it is necessary to carry out our legal obligations as an employer. Where we do need consent, we will ask you separately and explain the purpose clearly. You are not required to consent as a condition of employment.

How we collect your data

We collect personal data directly from you throughout your employment, including at recruitment, onboarding, and during the course of your employment. We may also receive data from third parties such as: Health Assured (occupational health referrals); NEST or your pension provider; our approved background screening provider (background and DBS checks); the Metropolitan Police (where you are placed at a Met Police site); and other employees or managers.

For cleaning operatives, attendance and location data is collected automatically through our HR system when you clock in and out using the geofence feature on your mobile device.

How we use artificial intelligence (AI) tools

We use an approved AI environment (the Claude Team environment, provided by Anthropic, PBC, and including Claude Team, Claude Cowork, and Claude in Microsoft Office) to help us carry out some of the activities described in this notice more efficiently. This includes assisting with standard operational tasks such as scheduling, working hours, site assignments, and pay calculations. Transcripts and summaries of certain meetings are produced only when required in accordance with our Employee Handbook, with advance notice and the right to object.

Using these tools does not create a new reason for processing your data. We only use them to support the purposes already set out in this notice, and the lawful basis for each purpose remains as shown in the table below. We do not use AI tools to make solely automated decisions about you that have legal or similarly significant effects.

Our HR system, Connecteam, also includes some built-in AI features. These are not used to make automated decisions about you, and no personal data is used to train AI models.

Your personal data is not used to train AI models. Our use of these tools is governed by the Company's AI Usage Policy, and the way meeting transcription is handled - including your right to be told in advance and to object - is explained in the relevant sections of the Employee Handbook.

Why we process your data and the lawful basis

We process your personal data for the following purposes (and their lawful basis):

Recruitment and onboarding decisions (Contract / Legal obligation)
Checking right to work in the UK, including nationality (Legal obligation)
Paying you and deducting tax and National Insurance (Contract / Legal obligation (PAYE))
Administering pension auto-enrolment (Legal obligation)
Managing your employment contract and variations (Contract)
Performance management and appraisals (Legitimate interests)
Managing sickness absence and fitness to work (Legal obligation / Legitimate interests)
Making reasonable adjustments (Legal obligation under the Equality Act 2010)
Disciplinary, grievance, and investigation processes (Legitimate interests / Legal obligation)
Health and safety obligations (Legal obligation)
Monitoring IT systems use (Legitimate interests)
Defending legal claims (Legitimate interests)
HMRC and regulatory compliance (Legal obligation)
Background and DBS checks (Contract / Legal obligation - where required)
Equal opportunities monitoring (Legitimate interests - public interest)
Recording timekeeping, attendance, and hours for payroll (Contract / Legal obligation)
Scheduling and workforce management (Contract / Legitimate interests)
Recording clock-in and clock-out via geofence (operative staff only) to verify site attendance and manage payroll accurately (Legitimate interests)

Who we share your data with

We share your personal data with third parties where required by law or necessary to administer your employment. Third parties include:

HMRC - for PAYE and tax reporting
NEST or your pension provider - for pension administration
Peninsula Group - HR documentation and advice
Connecteam (Mobilesson Ltd) - our HR system, used for timekeeping, scheduling, document management, communications, and (for operative staff) geofence clock-in and clock-out
Cleanlink - workforce and contract management system
Anthropic, PBC (Claude Team) - our approved AI environment, used to assist with standard operational employee data processing as described above; your data is not used to train AI models
Our approved background screening provider - background and DBS checks (if required by role or client contract)
Metropolitan Police - if you are placed at a Met Police site (their own security checks)
Barnes Roffe - our auditors and tax advisers
Our IT support provider - outsourced IT support
Health Assured - occupational health referrals
PIB Insurance - if you are added to our company insurance policy
Companies House - if you are registered as a director

All third-party providers are required to handle your data securely and in accordance with data protection law. They may only process your data for the specific purpose for which it is shared.

How and where we store your data

Your personal data is stored in the following systems: Microsoft Office 365 (email and SharePoint), Connecteam, Cleanlink, and Peninsula - HR documentation and advice, including information related to individual employment matters.

Primary data storage for all systems is within the United Kingdom or the European Economic Area (EEA). Connecteam's core infrastructure is hosted on Microsoft Azure (Netherlands and Ireland) and Amazon Web Services (Germany). Some ancillary functions within Connecteam - such as SMS login verification - may involve processing by sub-processors located outside the EEA. Where any such transfer occurs, appropriate safeguards are in place, including the UK Addendum to the EU Standard Contractual Clauses, in accordance with UK GDPR requirements.

Where we use the Claude Team environment (Anthropic, PBC), some processing takes place in the United States. Where data is transferred outside the UK, appropriate safeguards are in place, including the EU Standard Contractual Clauses together with the UK Addendum, in accordance with UK GDPR requirements. Your personal data is not used to train AI models.

Paper records containing personal data are stored in locked filing cabinets at our offices and disposed of by cross-shredding when no longer required.

How long we keep your data

Category of Data (and Retention Period):

Personnel files, training records, and disciplinary records (7 years after employment ceases)
Payroll and salary records (7 years from end of the tax year)
Right to work documentation (7 years from employment ceasing)
Unsuccessful job applicant records (12 months after notification of outcome)
Sickness and absence records (7 years after employment ceases)
Accident records (3 years from date of last entry)
Timekeeping, attendance, and scheduling records (6 years from end of the relevant payroll period)
Geofence clock-in and clock-out records (7 years from end of employment)

Your rights

Under UK data protection law, you have the following rights in relation to the personal data we hold about you:

Right to be informed - this notice fulfils this right by explaining how we use your data
Right of access - you can request a copy of the personal data we hold about you (a subject access request). Contact the Data Protection Lead to make a request
Right to rectification - you can ask us to correct inaccurate or incomplete data
Right to erasure - you can ask us to delete your personal data in certain circumstances
Right to restrict processing - you can ask us to pause processing your data in certain circumstances
Right to data portability - you can ask us to transfer your data to another organisation in certain circumstances
Right to object - you can object to processing based on legitimate interests. This includes the right to object to geofence monitoring. We will consider your objection and respond within one month, though we may be unable to agree to it where the processing is necessary to manage your employment and verify attendance for payroll purposes

To exercise any of these rights, please contact the Data Protection Lead at admin@apollocleaning.com. We will respond within one month.

How to complain

If you have any concerns about how Apollo Cleaning Services Ltd handles your personal data, please contact our Data Protection Lead at admin@apollocleaning.com. You also have the right to make a complaint to the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time, for example if legislation changes or we change how we process your data. We will inform you of any material changes. The version date above indicates when this notice was last reviewed.

Staff Privacy Notice v2.4 July 2026

Owner: CEO Approved By: Board