Team member Privacy Policy
Last updated: 2nd September 2026
​
This privacy notice describes how we collect and use personal information about you while you are registered with, and working on assignments through, Arc Hospitality Recruitment Solutions Ltd, including all subsidiaries and group companies, in accordance with the UK General Data Protection Regulation (UK GDPR).
This notice applies to Team Members: individuals engaged by Arc on a temporary, casual, or assignment basis and placed into hospitality roles with client venues. It sits alongside, and should be read together with, our Applicant Privacy Notice (which covers your recruitment and onboarding) and our Staff Welfare & Safeguarding Policy.
This notice does not form part of any contract or engagement with Arc. We may update this notice from time to time.
For the purpose of data protection legislation, including the UK Data Protection Act 2018, the UK GDPR, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable legislation, the controller is:
Arc Hospitality Recruitment Solutions Ltd
61a Bold Street, Liverpool, L1 4EZ
Our Data Protection Officer can be contacted at dpo@theprivacyworx.com
The Kind of Information We Hold About You
While you are a Team Member, we may collect, store, and use the following categories of personal information:
• Contact details: name, address, telephone number, email address
• Date of birth and gender
• National Insurance number, bank account details, payroll and tax status information
• Salary, shift, and pension information
• Next of kin and emergency contact details
• Right to work documentation
• References obtained during onboarding
• Availability, shift bookings, and scheduling records (processed through our scheduling platform, Ubeya)
• Photographs, where used for identification or onboarding purposes
• Details of any onsite incidents, complaints, or welfare concerns reported
• Details of any referral you make through our referral scheme, and business contact details of anyone you refer
• Your marketing communication preferences (including whether you have consented to SMS marketing)
​
We may also collect, store, and use the following special categories of more sensitive personal information:
• Health and medical information, including sickness and fitness-to-work records
• Information about unspent criminal convictions, in line with our safeguarding obligations to clients and the public
• Equality and diversity information (age, gender identity, sexual orientation, ethnicity, religion or belief, education, disability, and mental health), collected through anonymous surveys
How Your Personal Information Is Collected
We collect most of this information directly from you, during onboarding and throughout your engagement with us. We may also collect information from third parties, including:
• Referees you provide during onboarding
• Right to work and background check providers
• Client venues, where they report an incident, concern, or feedback about a shift
• Our scheduling, payroll, and pension providers (Ubeya, Code Pay, Royal London)
How We Will Use Information About You
We rely on different lawful bases depending on the purpose of processing:
Performance of a contract
• Registering you as a Team Member and administering your engagement
• Allocating and confirming shifts through Ubeya
• Paying you, including calculating salary, tax, and pension contributions
• Providing benefits such as early wage access through Wagestream
• Managing performance, feedback, and any disciplinary or grievance matters
Compliance with legal obligations
• Checking you are legally entitled to work in the UK
• Deducting tax and National Insurance contributions
• Complying with health and safety obligations
• Maintaining records required under employment and immigration law
Legitimate interests
• Maintaining the security of our systems and premises
• Handling and defending legal claims, including using anonymised workforce data as evidence where relevant, for example in response to discrimination claims
• Improving our services to you and to client venues
Consent
• Sending you marketing communications by SMS (see the SMS Communications section below)
• Collecting equality and diversity information through anonymous surveys
• Using photographs for onboarding or identification purposes, where applicable
If you fail to provide certain information when requested, we may not be able to perform our contract with you, such as paying you or allocating shifts, or we may be prevented from complying with our legal obligations.
​
How We Use Particularly Sensitive Personal Information
We need further justification for collecting and using special categories of personal information. We may process this information:
• Where we need to carry out our legal obligations in relation to employment and safeguarding law
• Where it is needed for equal opportunities monitoring, carried out anonymously
• Where it is necessary for establishing, exercising, or defending legal claims
• With your explicit consent, where we ask for it separately
Equality and diversity information is collected through an anonymous survey (currently Typeform, distributed via Ubeya). Because this data is collected anonymously, it is used only in aggregate, statistical form: for internal workforce reporting, as anonymised evidence where needed to respond to discrimination claims, and to support any future government reporting requirements on ethnicity, disability, or gender pay gaps, should these be introduced. If at any point we collect this information in a way that is not anonymous, we will tell you and explain the basis on which we do so.
We may use information about unspent criminal convictions in line with our Staff Welfare & Safeguarding Policy, including for onsite searches and disclosure requirements, as explained in that policy.
SMS Communications
We may send you marketing communications by SMS (text message), including information about referral rewards, promotions, and similar offers. We will only do this where you have given us specific, informed consent to be contacted by SMS, separate from any consent you have given for email marketing.
Before you receive marketing SMS from us, we will ask you to confirm you would like to opt in, along with a short notice explaining what you are agreeing to. You can withdraw this consent at any time by replying STOP to any text message we send you, or by contacting us using the details at the end of this notice. Withdrawing your consent will not affect operational messages we send you relating to your engagement, such as shift confirmations, which are sent on the basis of our contract with you.
Our Referral Scheme
If we invite you to refer a business that could benefit from our staffing services, in exchange for a reward:
• You should only submit contact details for a business contact you have permission to introduce to us, such as a work phone number and work email address
• We will use the details you provide to allow our Commercial Team to make contact with that business on our behalf
• Where we are contacting an individual rather than a business contact, we will only do so in line with applicable marketing rules, including obtaining their consent where required
Data Sharing
We may share your personal information with third-party service providers who help us administer your engagement, including:
• Ubeya, for scheduling and shift management
• Code Pay, for payroll processing
• Royal London, for pension administration
• Wagestream, for early wage access
• Mailchimp, for email and SMS marketing communications
All our third-party service providers are required to take appropriate security measures to protect your personal information, and are only permitted to process it for the purposes we specify and in accordance with our instructions.
International Transfers of Your Personal Data
Some of our service providers are based outside the UK. Ubeya's scheduling platform involves processing in Israel, and Mailchimp (provided by Intuit Inc.) is based in the United States. Where your personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or equivalent standard contractual clauses, to protect your information to UK standards.
Data Retention
We only retain personal information for as long as necessary for the purpose it was collected. As a general guide:
• Contact details, payroll, and engagement records: 7 years after your engagement with us ends
• Pension records: until you reach age 75
• DBS and criminal conviction disclosures: 1 year
• Accident and incident reports: 50 years
• Equality and diversity survey data: 6 months, after which only anonymised statistical data is retained
These periods may vary depending on individual circumstances, and further detail is available on request from our Data Protection Officer.
Your Rights
Under certain circumstances, by law you have the right to:
• Request access to your personal information (a “data subject access request”)
• Request correction of the personal information we hold about you
• Request erasure of your personal information, where there is no good reason for us continuing to process it
• Object to processing where we are relying on a legitimate interest, or where we are processing your data for direct marketing purposes
• Request the restriction of processing of your personal information
• Request the transfer of your personal information to another party
To exercise any of these rights, please contact our Data Protection Officer using the details below.
Managing Your Marketing Preferences
You can opt out of marketing communications at any time:
• Email: use the unsubscribe link included in any marketing email
• SMS: reply STOP to any text message
Opting out of one channel does not automatically opt you out of others. You can manage each channel separately, or contact us to update all your preferences at once.
Right to Withdraw Consent
Where we rely on your consent for a specific type of processing, such as SMS marketing or equality and diversity monitoring, you have the right to withdraw that consent at any time. Once we receive notification that you have withdrawn consent, we will stop processing your information for that purpose, unless we have another lawful basis for doing so.
Responsibility for Compliance
Our Data Protection Officer is responsible for overseeing our compliance with this notice. If you have any questions about this notice, or how we handle your personal information, please contact them. You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
Our Data Protection Officer may be contacted at dpo@theprivacyworx.com
If you have a welfare, safeguarding, or complaints concern rather than a data protection query, please refer to our separate escalation and complaints procedure.
Changes to this Notice
We may update this notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any substantial updates.