Time by NISS: Privacy Notice (DRAFT)
Status: working draft `draft-2026-10`. Not legal advice. A solicitor and data-protection adviser must review this before launch (spec §13, §18.2). Items in [brackets] need facts from NISS.
1. Who we are and our role
Time by NISS is provided by New Idea Software Service Limited ("NISS"), [company number, registered address]. Contact: [privacy email].
- For staff data that a venue puts into the Service (rotas, availability, leave, pay rates), the venue is the controller and NISS is its processor. The venue decides how that data is used. Our Data Processing Agreement governs it. Please contact your employer about this data first.
- For account and billing data (your sign-in, the business’s subscription), NISS is the controller.
2. What we collect
| Data | From | Why | Lawful basis (NISS as controller) |
|---|---|---|---|
| Name, email, sign-in details | You, via our authentication provider | To run your account | Contract |
| Venue and business details | The owner | To provide the Service and bill for it | Contract |
| Billing records | Our payment processor | Payments, VAT and accounting | Legal obligation; contract |
| Technical logs (request IDs, IP address, browser) | Your device | Security, fraud prevention, fixing faults | Legitimate interests |
As a processor for venues, we hold staff names, emails, roles, shifts, availability, leave and, if the venue enters it, hourly pay and absence categories (no free text). We don’t ask for dates of birth, addresses, National Insurance numbers, bank details or medical information. Please don’t enter them.
3. How long we keep data
- While a venue is subscribed: for as long as the venue uses the Service.
- After a trial or subscription ends: 30 days read-only, then 60 days in which only the owner can access the venue. After that we delete the venue’s data, except the billing and audit records we must keep.
- Absence records (category and dates only): deleted after 12 months.
- Owner-requested deletion: happens 7 days after the request.
- Exports: kept for 7 days.
- Billing records: kept for [6 years] to meet tax rules.
[Retention periods to be confirmed by legal review; spec §13.]
4. Who we share data with
We use these subprocessors (see the Subprocessors page): hosting [provider, region], authentication (Clerk), email (Resend) and payments (Stripe). Some process data outside the UK under UK adequacy regulations or the International Data Transfer Addendum. [Transfer assessment to be completed.] We don’t sell personal data, and we don’t use it for advertising.
5. Cookies
We use only cookies that are strictly necessary to sign you in and keep your session secure, set by our authentication provider. We use no analytics or advertising cookies, so we don’t ask for cookie consent. If that changes, we’ll ask first.
6. Your rights
You can ask to see, correct, delete or restrict your data, object to its use, or ask for a portable copy. For staff data held for a venue, your employer is the controller, so we’ll pass your request to them and help them answer it. You can complain to the Information Commissioner’s Office (ico.org.uk).
7. Security
- Data is encrypted in transit and at rest.
- Each venue’s data is isolated in our database.
- Pay data is visible only to people the venue authorises.
- Access is logged.
- We’ll tell affected customers about a personal data breach without undue delay.
8. Changes
We’ll post updates here and tell account holders about significant changes.