Privacy Policy

Policy version: 10 February 2026

Introduction

This Privacy Policy is provided by SupportManager Ltd, a company registered in England and Wales under company number: 16491760 with registered office 151 Corporation Road, Weymouth, Dorset, United Kingdom, DT4 0LQ ("we", "our" or "us") for use of our products and services including our website and SupportManager platform (Platform).

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR).

We are the controller of personal data obtained via the Platform that we process for our own purposes in connection with operating and securing the Platform (for example, creating and managing user accounts, administering subscriptions, communicating service updates, providing support, and monitoring the security and performance of the Platform). As a controller, we are the organisation legally responsible for deciding how and for what purposes it is used.

Where a user uploads, inputs or generates content within the Platform that contains personal data, we will generally process that personal data on behalf of the relevant user. In that context, the user is the controller, and we act as a processor. Such processing is governed by our Terms and Conditions (including any data processing terms).

What this policy applies to

This privacy policy relates to your use of the Platform only.

The Platform may link to or rely on other apps, websites, APIs or services owned and operated by us or by certain trusted third parties to enable us to provide you with Platform. These other apps, websites, APIs or services may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other apps, websites or services, please consult their privacy policies as appropriate. For more information see the section "Who we share your personal data with" below.

Personal data we collect about you

The personal data we collect about you depends on the particular activities carried out through the Platform.

The Platform may involve personal data processed in two main contexts:

(a) Personal data processed where we act as controller (eg. Account administration, billing, support, security and service improvement); and

(b) Personal data processed within user workspaces where we act as processor (eg. Content and records uploaded/created by the user in the Platform).

We remain a data controller only for our own processing activities described in this policy. Each user is solely responsible for ensuring that their processing of any personal data complies with applicable data protection laws, including establishing their own lawful basis for processing and providing appropriate privacy information where required. We are not responsible for user's compliance with data protection laws in their capacity as independent controllers.

We will collect and use the following personal data about you:

Identity and account data you input into the Platform

Your email address, first and last name, mobile telephone number, postal address, billing address and other contact details you provide to create and manage an account
Your account login credentials, including email address (used as username) and password, and any security or authentication information you provide (for example, multi factor authentication details where supported)
Platform payments are processed through third-party payment service providers (currently Stripe, though we reserve the right to use alternative or additional payment processors). Payment information is transferred through secure encrypted connections directly to our payment partner's systems and is handled in accordance with their own privacy policies. We do not store your full payment card details on our systems. We retain only the last four digits of your card number, payment references, transaction details (including amounts, currencies and timestamps), payment history, and billing information as a data controller to manage your account, prevent fraud, and comply with our legal obligations including tax and accounting requirements. We retain this payment-related information for 7 years from the date of the transaction or as otherwise required by applicable law.

Data collected when you use specific functions in the Platform

Data you store online with us using the Platform including your usage history or preferences (while such data may not always be personal data as defined at law in all cases, we will assume it is and treat it in accordance with this policy as if it were)

Data processed on behalf of users: Information you provide as a data controller when using the Platform including:

Personal identification data: names, contact details, dates of birth, National Insurance numbers, addresses, emergency contacts
Financial Data such as bank account details (holder name, sort code, account number), payroll information, tax codes, payslips, P45/P60 documents, pay rates and enhancements
Compliance information such as DBS certificate numbers and results, Right to Work documents and UKVI share codes, driving licence numbers and check codes
Operational data for employers such as employment records, holiday requests and entitlements, shift patterns and schedules, shift swap requests, timesheets, vehicle usage records, noticeboard communications

Data collected when you permit the collection of location data

If enabled by you, we may collect approximate location data when you use certain features on the Platform (for example, to log a car journey). This feature is optional and controlled by your device or browser settings. We do not track your ongoing precise location or collect location data in the background. If you have concerns about location tracking, you can disable location services for the Platform in your device settings at any time.

Other data the Platform collects automatically when you use it

Your activities on, and use of, the Platform which reveal your preferences, interests or manner of use of the Platform and the times of use (for example, pages viewed, searches performed, items clicked, time spent on pages, and interaction with messages or notifications)
Other information such as device type, IMEI numbers, MAC address of networks, other unique device identification, device operating system, mobile network information, app version number, storage usage, data usage, time zone settings etc

Data collected concerning the vehicle driven

The make and/or model of the car you drive, timestamps of journeys and driver records (while such data may not always be personal data as defined at law in all cases we will assume it is and treat it in accordance with this policy as if it were)

How your personal data is collected

We collect your personal data in the following ways:

Directly from you

This is information you provide to us while using the Platform, including any data you provide when you register with and use the Platform, enter account details or preferences into the Platform, use the Platform for your own commercial purposes, or when communicating with us directly.

Information from third parties

Occasionally, we receive your personal data from third parties and other sources, including referral partners (i.e., when you register or sign-up via or through one of our partners), public registries, Platform business accounts (e.g., your employer or team that uses the Platform and invited you to use it).

We may combine this information with other information we already hold about you, to help us enhance and personalise the Platform or make recommendations for you.

How and why we use your personal data

Our lawful bases

Under data protection laws, we can only use your personal data if we have a valid reason (lawful basis) for doing so. Not every legal basis is applicable in every situation.

The table below explains the lawful bases that we may rely on for each of our processing activities:

Processing activity	Lawful basis
Providing you with access to the Platform	Necessary for the performance of our contract
Supporting and maintaining the Platform	Necessary for the performance of our contract
Managing subscriptions and billing	Necessary for the performance of our contract
Communicating with you about service updates	Necessary for the performance of our contract
Providing technical support	Necessary for the performance of our contract
Analysing Platform usage for improvements	Legitimate interests
Ensuring security of the Platform	Legitimate interests
Complying with legal obligations	Legal obligation
Fraud prevention	Legitimate interests

Legitimate interests

In some cases, we rely on our legitimate interests as a basis for processing your personal data. In these cases, we have identified a genuine business need or benefit and have balanced this against your rights and interests as the data subject. We do not use legitimate interests as a basis for processing where the impact on you outweighs our interests.

Our legitimate interests include:

Improving and developing the Platform
Ensuring the security and integrity of the Platform
Understanding how users interact with the Platform
Marketing our services (where appropriate)
Preventing fraud and misuse

Consent

Where we rely on consent as the legal basis for processing, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

Cookies

Information about our use of cookies is provided in our Cookies Policy.

Marketing

We may send you marketing communications if you have given your consent or where we have another lawful basis to do so.

You can opt out of receiving marketing communications at any time by:

Using the unsubscribe link in any marketing email
Contacting us at hola@support-manager.co.uk

Who we share your personal data with

We may share your personal data with the following categories of recipients:

Service providers

We share your personal data with third-party service providers who process data on our behalf, including:

Cloud hosting providers: We use Amazon Web Services (AWS) to host our Platform and store your data securely
Payment processors: Stripe processes payments on our behalf
Email service providers: MailerSend delivers transactional emails
SMS providers: Twilio sends SMS notifications
Monitoring services: Laravel Nightwatch helps us monitor Platform performance

Professional advisers

We may share your personal data with our professional advisers, including lawyers, accountants, and auditors, where necessary for professional advice or legal proceedings.

Legal requirements

We may disclose your personal data where required by law, regulation, or legal process.

Business transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction.

International transfers

Your personal data may be transferred to, and processed in, countries outside the United Kingdom. When we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data, such as:

Transferring to countries that have been determined to provide an adequate level of protection
Using standard contractual clauses approved by the UK authorities
Relying on binding corporate rules where applicable

How long your personal data will be kept

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

To determine the appropriate retention period, we consider:

The amount, nature, and sensitivity of the personal data
The potential risk of harm from unauthorised use or disclosure
The purposes for which we process the data
Whether we can achieve those purposes through other means
Applicable legal requirements

In general:

Account data is retained for as long as your account is active and for 7 years after closure for legal and tax compliance
Payment records are retained for 7 years for tax and accounting purposes
Usage logs are retained for up to 2 years for security and Platform improvement purposes

Your rights

Under data protection law, you have the following rights:

Right to access: You have the right to request a copy of the personal data we hold about you
Right to rectification: You have the right to request that we correct any inaccurate personal data
Right to erasure: You have the right to request that we delete your personal data in certain circumstances
Right to restrict processing: You have the right to request that we restrict processing of your personal data in certain circumstances
Right to data portability: You have the right to receive your personal data in a structured, commonly used format
Right to object: You have the right to object to processing based on legitimate interests
Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing

To exercise any of these rights, please contact us at hola@support-manager.co.uk.

Keeping your personal data secure

We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

Encryption of data in transit and at rest
Access controls and authentication mechanisms
Regular security assessments
Staff training on data protection

How to complain

If you have any concerns about our use of your personal data, you can contact us at hola@support-manager.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113 Website: www.ico.org.uk

Changes to this privacy policy

This policy was last updated on 10 February 2026.

We may update this privacy policy from time to time. Any changes will be posted on this page, and where appropriate, notified to you by email. We recommend that you review this policy periodically to stay informed about how we protect your personal data.

Contact details

If you have any questions about this privacy policy or our data practices, please contact us:

SupportManager Ltd 151 Corporation Road Weymouth Dorset DT4 0LQ United Kingdom

Email: hola@support-manager.co.uk