Staff App Privacy Notice

This notice explains how the Beenest staff app handles personal data. The parent app has its own notice (Parent App Privacy Notice). How we handle data on our website and as a company is described in our Privacy Policy.

1. Who provides the app and who is responsible

The app is provided by Triple Peak Software Systems, [legal form, e.g. LLC], [registered address] ("Beenest", "we"). Email: hello@beenest.co.

Your employer is the controller. Your nursery or childcare setting (or the organisation that runs it) is your employer, chose Beenest and is the controller under the UK GDPR for staff and operational data: it decides what data is used, for what purpose, how long it is kept and when it is deleted. Everything you send through the app, and everything the app shows you, belongs to your setting. Your employer can give you its contact details and, if it has one, those of its data protection officer.

Beenest is the processor. Beenest provides the app and processes the data only on your employer's behalf and on its instructions (Article 28 UK GDPR; see our Data Processing Agreement with settings). We do not use the data for our own purposes, for advertising or to train AI models.

Questions about your rights go to your setting (see section 11).

2. What data the app collects

The app is for the setting's staff. You sign in with the setting ID, your personal QR code (the same one you use at the terminal) and a personal password. The camera is used only to scan that code. The app does not create a public user account. Your sign-in stays on the device for up to 30 days.

Through the app you can send or receive:

• your own working hours and overtime balance; if your setting has turned on clocking in and out in the app (on by default): remote or off-site check-in with a work category (without location) and time corrections (as a request to the manager, not in the team chat)
• absence and sick notices (reason and optional note; a sick notice is health data, a special category of personal data), also the reason when you leave early and in the weekly question about minus hours
• internal team chat messages (content, time, sender's name or initials), pinboard, polls, calls, @mentions and messages to parents
• inbox: messages from the manager to you personally, answers to your working-time requests and your upcoming staff appointments (section 3)
• a wallet staff badge (name, badge ID, group, setting name and address), only if you add it

If your setting uses staff planning (off by default), the app shows the day plan and the team week: names, shifts, breaks and current attendance of your colleagues. You see absence reasons in the app only for yourself; colleagues appear as "absent" without a reason, as they do on the tablet. Your reasons are visible to the manager in the admin area, to the operator in its area, and appear in the setting's reports, exports and printouts. What the app shows about children depends on your setting's privacy mode (section 4). In "Personal phones" mode (the default) it shows no children's records and no child codes, only counts. It shows child codes in no mode. Free text from colleagues or the manager, and the topic parents give for a meeting, can contain information about children in either mode.

Other features

Depending on your setting's choices, the app also shows:

• the setting's calendar and your own staff appointments; for a parent meeting the description can contain the parents' concern
• rooms to book (the name of the person who booked is visible)
• hazard topics with notes, warning triangles and thumbs-up (the author's name is visible)
• handbooks to read

Managers can record and delete hazard notes.

What your setting sets

Your setting decides in its settings which features you see in the app; you cannot change this yourself. Defaults:

• staff app, team chat, clocking in and out (remote check-in, time correction), messages to parents: on; the setting can turn each one off
• day plan and team week: only with staff planning (off by default)
• privacy mode: "Personal phones"; the setting can choose "Work devices" (section 4)
• AI data guard in the team chat: off; only the setting can turn it on (section 4)
• team chat retention: 1 day; 1 to 7 days can be chosen
• automatic notices: required break off, "daily working time reached" on, "scheduled but not here" on; the setting can switch each rule. The "not checked out" notice is always on (section 3)
• AI helper: off; only the setting can turn it on (section 7)
• push notifications: only if you allow them on your device

Your setting can tell you what it has set.

Data minimisation. The app collects no location data, does not access photos, contacts or microphone, and contains no analytics or tracking tools. Content is not stored on the device; it is loaded each time you open it.

Not in this app: check-in and check-out of children (only at the terminal at the setting). No child codes, no parent password. The parent app is separate.

3. Internal team chat

The team chat is one shared chat for all staff at your setting; the manager reads and writes along on a computer. There are no one-to-one chats between staff. Your setting can turn the team chat off in the app (on by default). Messages can be tagged with @Staff, @Pinboard, a group or a person's name. The chat can also be reached on personal devices. It is not meant for special category data or other sensitive information: no health information, no social care or safeguarding information and no personnel file content. Whether and how children may be named in the chat depends on the privacy mode (section 4).

Inbox. The manager can send you a message from a computer that only you read in the app. It appears in your inbox, together with answers to your working-time requests and your upcoming staff appointments. You cannot reply in the inbox, and no email is sent. Messages from the manager stay stored until the setting deletes them; there is no automatic deletion. If the setting has turned on the AI data guard, it checks the message before it is sent (section 4).

Free text in the app. For a sick notice, the notice itself is enough; you do not need to, and should not, give a diagnosis. Hazard notes are seen by the whole team; describe the hazard, not the behaviour of individual colleagues. Messages to parents reach all parents of the setting or of the chosen group and can appear as push notifications on lock screens; do not name individual children in them.

Retention. Your setting sets how long chat messages are kept: 1 to 7 days, 1 day by default. After that they are deleted automatically at midnight (in your setting's time zone). Pinboard posts, including team polls, are excluded from this deletion and stay until they are removed or the setting's contract with Beenest ends.

Polls. Your vote is stored with your name so that each person has one vote; only the totals are shown.

Calls. Colleagues and the manager can "call" you through the chat when you are checked in. You get a push notification with the caller's name and reason and can answer "Coming" or "Can't"; the call and the answer appear in the chat.

Automatic notices. Your setting can let the system post working-time notices in the chat under the sender "Automatic notice". Posted notices name the person concerned and are visible to staff in the chat. The rules and their defaults:

• Required break (a notice about a required break): off, can be turned on; push only to you
• Daily working time reached (the time recorded for you today reaches your contract time for the day): on, can be turned off; push only to you
• Scheduled but not here (a scheduled shift has been running for an hour without a check-in; only with staff planning): on, can be turned off; push to the group's staff
• Not checked out (you are still checked in from an earlier day): always on and cannot be turned off, because attendance must be fully recorded; push only to you, no earlier than opening time

The notices state facts from the recorded times; they are not an assessment. "Scheduled but not here" only says that a check-in is missing, not why. Like all chat messages, they are deleted after the set retention period. Your setting can tell you which notices are on.

4. Privacy mode: personal phones or work devices

Your setting chooses one of two modes in its settings. The mode applies to the whole setting and so to every device where the app is signed in. The features differ only a little. The main difference is what belongs in free text and how the AI data guard is used.

Personal phones (default)

• For settings where staff also use the app on their own phones.
• The app shows no children's data, only counts. Features that need children's names are locked, for example "Create appointment".
• Free text (team chat, pinboard, calls, notes): no names and no recognisable descriptions of children, no health information.
• AI data guard in the team chat: we strongly recommend it.

Work devices

• By choosing this mode, the setting declares that the app runs on the setting's devices. If the app is signed in on your personal phone in this mode, talk to your setting.
• The app may show names of children in your own group where a feature needs them. As of this version, no feature shows names yet; the first one planned is the parent meeting request. The app does not store these names on the device and does not pass them to AI features.
• Free text: in the team chat you may name children where the daily routine requires it, for example who is being collected early. Health information, social care or safeguarding information, and information about child protection or parental responsibility do not belong in the chat here either.
• AI data guard in the team chat: recommended, especially against health information in quickly typed messages.

AI data guard in the team chat

The data guard is off by default. Only the setting can turn it on, and it works the same in both modes. It runs only if the setting's AI features are set to the level "All" [OPEN: confirm the English label of this AI level in the UK app] and AI credits are available; without credits the team chat is not checked. Before a message is sent, AI on the EU endpoint (Google Cloud Vertex AI) checks the text for sensitive information, such as health data. In the team chat it does not compare the text with children's names. If it finds something, the message is not sent and you see a notice; you can change the text or send it anyway. If the check is not possible, the message goes out unchecked. The data guard does not store texts; only the fact that a check happened is counted, without text and without the person. The check is not complete. It does not check other free text in the app, including calls and messages to parents.

5. Push notifications

Push notifications are opt-in. You grant the permission yourself in your phone's operating system and can withdraw it at any time in your phone's settings; the app has no separate switch for it. If you decline, no device token is created or sent.

If you allow push, the operating system (iOS) or the Firebase SDK (Android) creates a device token. It is stored in Cloudflare KV (EU) and linked to your staff ID so that personal notices reach only you. It is deleted when you sign out or leave the setting. The setting's data stays in the database in Frankfurt.

Tokens at the push services

• Apple Push Notification service (APNs): Apple keeps the device token in its routing infrastructure to deliver messages to iOS devices.
• Google Firebase Cloud Messaging (FCM): Google creates and manages the FCM registration token to deliver messages to Android devices.
• Expo (650 Industries, Inc., United States): Expo stores the device token, as described in its own privacy notice, to pass messages on to APNs or FCM.

This token storage is part of the platform infrastructure provided by Apple and Google; no EU-only push infrastructure exists, and there is no push delivery on iOS or Android without it. The push services only pass message content through for delivery and do not store it permanently. Transfers to Google (FCM) and Expo in the United States are protected by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise by the UK Addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement. [OPEN: confirm the UK mechanism per provider (DPA Section 10, paragraph 4).] For APNs, Apple offers no data processing agreement and no APNs-specific standard contractual clauses; the Apple Developer Program License Agreement, Attachment 1, applies, and Apple Inc. is certified under the EU-US Data Privacy Framework [OPEN: Apple Inc.'s UK Extension participation].

What notifications contain

You receive notifications only if you allow them on your device, and only for features your setting has turned on:

• Capacity light: when it turns yellow (the setting is close to its limit) or red (the setting is full), with fixed texts [OPEN: English push texts in the UK build]. No notification for green, on closure days or outside opening hours.
• Team chat (on by default): title is the author's name, text is the start of the message. The tag decides who gets it: @Staff and @Pinboard the whole team, a group that group's staff, @Name that person; without a tag, no notification.
• Calls (part of the team chat): "[Name] is calling you" with the chosen reason, only to the person called and only if they are checked in. On iPhones a call is a time-sensitive notification and can break through a Focus mode.
• Automatic notices (each rule switchable by the setting, see section 3): the notification names the person concerned and goes to them; for "scheduled but not here" it goes to the staff of the group concerned.
• Appointment reminders: for staff appointments you take part in, from 07:00 on the day and in the 30 minutes before the start, with only type, time and group.
• Inbox: "New message in your inbox" with a prompt to open the staff app, only to you; it names neither sender nor content.
• Working time: confirmation to you when you check in, check out or switch in the app, for example "Checked out at 16:30"; without names.
• End of care hours: from 1 November 2026 [OPEN: same start date for the UK app?], once a day shortly after closing time, to everyone still checked in to childcare (not to housekeeping staff): your time now counts as time not with children, but you still have to check out. Fixed text without names.

As intended, notification content is about organisation and working time, not sensitive information about children. Team chat messages are checked before sending only by the AI data guard, if the setting has turned it on (section 4); other free text is not technically filtered. Time corrections, sick notices and the chat history go over the encrypted connection to the application, not through push. Notifications can appear on your lock screen and stay in your phone's notification centre until you delete them. You can turn off previews in your phone's settings.

6. Where data is stored and lawful basis

Information sent through the app is stored in databases in Germany (Supabase, Frankfurt) and is protected under the UK GDPR and the EU General Data Protection Regulation. Transfers from the United Kingdom to the EU are covered by the UK's adequacy regulations for the EEA. Requests from the staff app go encrypted directly to the Beenest application (Vercel, Frankfurt), not through Cloudflare.

Exception: for push notifications, device tokens go to the services named in section 7. Cloudflare KV (EU) can hold push tokens and device IDs with your staff ID.

Email. The staff app itself sends no email. If you email us, your message is stored in our mailbox at Zoho Corporation B.V. in the Netherlands. Emails the software sends for other features go through Brevo (Sendinblue SAS), hosted in France and Germany with storage in Belgium.

Lawful basis. Your employer decides the lawful basis. As a rule, the processing relies on your employment contract (Article 6(1)(b) UK GDPR) and, for working-time and attendance records, on your employer's legal obligations (Article 6(1)(c) UK GDPR). For sick notices and other health data, your employer needs a condition under Article 9(2)(b) UK GDPR (employment) together with the employment condition in Schedule 1 to the Data Protection Act 2018. Push notifications are sent only if you grant the permission on your device. Your employer can tell you which basis it relies on. [OPEN: which UK record-keeping duties to name for staff time and attendance; the DE notice cites the Arbeitszeitgesetz and SGB VIII.]

Voluntary use. Under our agreement with settings, using the app is voluntary. Your working time at the setting is recorded at the terminal, and absences and requests are possible without the app; not using the app must not lead to any disadvantage for you.

7. Third-party services

The app, and push and wallet if you use them, rely on these services:

• Apple Push Notification service (APNs): delivery on iOS, only with push turned on
• Google Firebase Cloud Messaging (FCM): delivery on Android, only with push turned on
• Expo (650 Industries, Inc.): relay between the app and APNs or FCM, only with push turned on
• Cloudflare, Inc.: sends push notifications and stores push tokens in Cloudflare KV with EU data residency (Frankfurt, Cloudflare Regional Services); push title and text are only passed through for delivery. Cloudflare has no access to the Supabase database. Cloudflare, Inc. is based in the United States; possible access by the US parent company is covered by the safeguards in section 5.
• Vercel (Frankfurt): runs the application; the app sends its requests there directly, encrypted
• Supabase (Frankfurt): database
• Apple Wallet or Google Wallet: only if you add the staff badge. On iPhone our Cloudflare service creates the pass and keeps it for at most 5 minutes for a single download; on Android the pass data goes to Google. If your setting replaces your badge, the saved pass is no longer valid; delete it from your wallet.
• Google Cloud Vertex AI: for the AI helper if your setting has turned it on (EU multi-region), for the AI data guard (section 4), and for the preview image of a hazard topic. For the preview image, AI on the EU endpoint describes the topic's title and description without people; only that description goes to image generation on Google's global endpoint outside the EU. Your setting's operator can turn this off.

Time records, absences and chat go encrypted directly to the application in Frankfurt, not through Cloudflare. The full list of sub-processors that process the setting's data is in our Data Processing Agreement.

No analytics, tracking or advertising tools are used in the app.

AI helper (optional). The app includes an AI helper that answers questions about the setting's daily work. It is off until the setting turns it on in its settings, and the operator can also block it. For practitioners the helper always works with codes instead of names. For managers it uses names only if the setting has chosen the level "All"; then the AI sees staff names. Processing runs on Google Cloud Vertex AI on the EU endpoint; the data is not used for training. What you type into the helper goes to the AI. Do not enter health information there.

8. Storage on your device

On your device the app stores only your session sign-in (in the operating system's protected storage: Keychain or Keystore) and a random device ID for push. Working hours, rotas, chat and other content are not stored by the app; they are loaded each time and kept only in memory. Outside the app, content can remain on the device: push notifications in the notification centre, an added wallet badge, text you copy, and screenshots. The sign-in can be included in a device backup; the server rejects a sign-in from an outdated backup. It is valid for at most 30 days from login and does not renew itself. "Sign out" or "Reset app" in the settings ends the session on this device.

No screenshots, no sharing. Screenshots, screen recordings and photographing the app's content are not permitted, nor is passing content on to others or into other apps such as messengers or social networks. This applies especially to messages, rotas, attendance and information about other people.

Keep your QR code safe. Your QR code is your staff badge at the terminal and your ID when you sign in to the app. Together with your own password it opens your access. Keep your badge and password safe and never give your password to anyone. If your badge is lost or in the wrong hands, tell your setting straight away; it will issue a new code.

9. Time records, devices and personal phones

Staff attendance and time records

Attendance of staff and children at the entrance is recorded at the check-in terminal at the setting. The setting uses these records for its regulatory duties and supervision and to keep its staff-to-child ratios. The staff app adds remote check-in and shows you your recorded times and your overtime balance. Time records you send become your employer's records; the setting keeps and deletes them according to its policies and the record-keeping rules that apply to it. Your employer decides whether and how it uses the app for this.

Chat and push

The team chat and push notifications are extra features. Push only after you opt in in the operating system. The chat is not required for attendance records at the entrance.

Work devices or personal phones

Who decides. Whether you use the app on a work device of your setting or on your personal phone is decided by your employer; ask about the policy that applies. We recommend using the app only on the setting's work devices. Use on a personal phone is voluntary (section 6). What the app shows on which devices, and what belongs in free text, is set by your setting's privacy mode (section 4).

On your personal phone. The app uses only the camera (to scan your QR badge) and, if you agree, notifications. It does not access photos, contacts, location or microphone and contains no analytics or tracking tools. From your phone, only the push device ID, the device type (iOS or Android) and the time of last use are stored. We cannot manage your phone or wipe it remotely. Please:

• protect your phone with a screen lock and do not let anyone else use the signed-in app,
• turn off notification previews on the lock screen if others can see your phone,
• mute notifications in your phone's settings during your free time if you do not want to be reachable. The app itself creates no duty to read messages outside working hours; your employer's policies apply,
• sign out before you give away, sell or send your phone for repair.

On a work device. Your employer's rules also apply. A work device can be managed by your employer (for example through device management software). What your employer can see that way depends on those rules, not on this app.

On a shared device. The sign-in is personal and lasts up to 30 days; the app does not sign you out by itself. Sign out after each use (Settings, Sign out) and do not share your password.

Loss or theft. Report the loss to your setting straight away. It replaces your QR badge. This ends all your sign-ins (after 15 minutes at the latest), deletes your own password and removes your devices from push notifications. You then set up the app again with the new badge.

Leaving the setting. When your setting archives your record, all sign-ins end (after 15 minutes at the latest), your own password is deleted and your devices no longer receive push notifications. Please then delete the app and any saved wallet badge.

10. Monitoring at work

Some features can show how and when staff work, in particular recorded working times and the hours balance, the day plan with current attendance, automatic notices that are turned on, calls with answers, polls with a vote linked to the person, and an AI helper that uses names for managers. Your employer may also use time reports, staff scheduling with AI, daily analyses and the attendance patterns the AI features can describe. These AI features do not assess performance or behaviour: no judgements, no rankings, no comparisons between people and no assumptions about reasons or health.

Under the ICO's guidance on monitoring workers, an employer that monitors staff must identify a lawful basis, tell staff about the monitoring (covert monitoring only in very exceptional cases) and carry out a data protection impact assessment where the monitoring is likely to be high risk; the guidance also recommends that employers seek the views of staff or their representatives. Telling you about monitoring is your employer's duty, not Beenest's. This notice describes what the app can do; it does not replace your employer's own information. Ask your employer which features it uses and how.

11. Your rights

You have these rights under the UK GDPR. Because your employer is the controller, send requests to your setting, not to the app store. If you send a request to us, we pass it to your setting and help the setting respond.

• Access (Article 15): you can ask which data about you is held.
• Rectification (Article 16): your setting can correct inaccurate information.
• Erasure (Article 17): you can delete data stored on your device by resetting or uninstalling the app. Time and attendance records you send become your employer's records; while your employer must keep them, it may keep them instead of erasing them. Chat messages are deleted after the retention period your setting sets; pinboard posts as described in section 3.
• Restriction, portability and objection (Articles 18, 20 and 21): these apply as the UK GDPR provides. Where attendance records are required by law, there is no right to object to that record as such.

Complaints. You have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator (ico.org.uk). We would appreciate the chance to help first: please contact your setting or us.

Children. Children are not users of Beenest; parents and staff use the apps. The app is designed for adults and is not intended to be used by children; we therefore do not treat it as an online service likely to be accessed by children within the meaning of the ICO's Children's code (Age appropriate design code). [OPEN: confirm this assessment.]

12. Support via WhatsApp

[OPEN: is WhatsApp support available in the UK? If not, remove this section.] We offer optional support via WhatsApp, a service of Meta Platforms, Inc., based in the United States. If you use this channel:

• Do not share personal data: do not send names of children or staff, health information, photos or documents with personal content.
• Storage outside the UK and the EU: messages may be processed on Meta's servers outside the UK and the EU, in particular in the United States, under Meta's own terms and privacy policy.

[OPEN: lawful basis; the DE notice relies on consent by actively using the channel.] For anything involving personal data, please email hello@beenest.co.

13. Changes

We may update this notice when needed. The current version is always available in the app and at beenest.co/uk/staff-app-privacy.

14. Contact

Questions about privacy: hello@beenest.co or [privacy contact email]. Questions about your own data are best sent to your setting.