Privacy notice
Version 1 — effective 2026-05-15.
This notice explains what personal data we collect when you sign up as a member of staff, how we use it, who can see it, how long we keep it, and the rights you have over it. It applies to the 8MGMT platform.
What data we collect
When you apply and work through the platform we collect:
- Name — full legal name.
- Date of birth / age — used to confirm you are 18+ for the Remote Sales programme.
- Gender — self-reported, optional where the law allows.
- Home address — including postcode, used for HMRC records and right-to-work checks.
- Phone number — used for shift confirmations and time-critical communications.
- Email address — primary contact channel and login identifier.
- Social media handles — optional, used to verify the profile you present to clients.
- National Insurance number — required by HMRC for tax reporting (encrypted at rest).
- Tax code — required by HMRC (encrypted at rest).
- Bank account details (collected once you pass the application stage) — used only to pay you for completed shifts.
- Right-to-work documents (collected once you pass the application stage) — passport / share-code per UK law.
- CV / résumé — used during the recruitment review and deleted six months after rejection.
- Profile photo — used so clients can recognise you on shift.
- Preferred work locations — used to match you to nearby events.
Once you start working we will additionally process geolocation samples at check-in and may capture a check-in photo to confirm attendance.
Why we collect it
- Matching you to work — preferred locations, availability, reliability scores.
- Paying you — bank details, NI number, tax code, address.
- HMRC tax reporting — NI number, tax code, name, address.
- Verifying attendance — geolocation samples and a check-in photo.
- Communicating with you — email and phone for shift confirmations, reminders, and application updates.
We do not sell your data and we do not use it for advertising.
Who sees it
- Admins at 8MGMT can see your full profile, including the HMRC fields, for as long as the data is retained.
- Clients (event organisers) see a minimised view: profile photo, name, reliability summary, and any portfolio fields you publish.
- HMRC, where the law requires us to report.
How long we keep it
| Data | Retention |
|---|---|
| Privacy fields (name, address, phone, socials, age, gender, CV, profile photo, preferred locations) | Until you ask us to erase them, OR six months after a rejected application, whichever comes first. |
| HMRC fields (NI number, tax code, name + address attached to a tax record) | Three years after your last paid shift with us, then deleted automatically. We are required by HMRC to keep these. |
| CVs of rejected applicants | Six months from rejection, then deleted automatically. |
| Audit log (records of who did what with your data) | Three years, then deleted automatically. |
Your right to erasure
You can ask us to delete your privacy fields at any time. The fastest way is:
- Sign in to the platform.
- Open your dashboard.
- Choose "Delete my data".
- We will email you a confirmation link. The link is valid for one hour.
- Click the link and confirm. Your privacy fields are deleted immediately.
Your HMRC fields (NI number, tax code, the name and address attached to a tax record) will be kept for three years after your last paid shift with us, then deleted automatically. This is a legal requirement we cannot waive.
If you cannot sign in, email us at the address in the Contact section below and we will action the request manually within thirty days.
Your other rights
Under UK GDPR you also have the right to:
- Access the personal data we hold about you.
- Portability — receive a copy in a structured, common format.
- Rectification — ask us to correct anything that is wrong.
- Restriction / objection — limit how we use your data while a dispute is resolved.
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, email us at the address in the Contact section.
Legal basis
We process your personal data on three legal bases:
- Contract — we need it to engage you for the work you have agreed to do (matching, payment, communication).
- Legitimate interest — reliability scoring and attendance verification are necessary for the safe and fair operation of the platform; we weigh this against your interests before each new use of the data.
- Legal obligation — HMRC requires us to keep tax records for three years.
Contact
Questions about your data, or to action any of the rights listed above, please email data-protection@8mgmt.app.
Our Data Protection Officer can also be reached at data-protection@8mgmt.app.