Privacy Policy
1. Who we are
Zero Hours is a UK hospitality staffing marketplace that connects workers with last-minute shifts posted by venues and employers ("the Platform"). This website (app.zerohours.live) and its marketing pages are operated by Zero Hours, a company registered in England & Wales under company number to be confirmed, with its registered office at 30 Churchill Place, London, E14 5RE.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Zero Hours is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number to be confirmed.
Questions about this policy or your data can be sent to privacy@zerohours.live.
2. The personal data we collect
What we collect depends on how you use Zero Hours. We split it into two stages.
a) When you sign up on our marketing pages (available now)
Our "Find Work" and "Hire Staff" interest forms collect only what you enter:
- Workers: your name, email address, phone number, preferred role, and town/postcode.
- Employers: your name, work email, business name, location, the roles you typically need, and any message you add.
These submissions are processed by our form provider (Web3Forms) and delivered to our team inbox so we can contact you about early access. They are not used for any other purpose.
b) When you use the full Zero Hours platform (as it launches)
Once the app is live, we collect additional data needed to run a staffing marketplace and meet our legal duties:
| Category | Examples |
|---|---|
| Identity & account | Name, date of birth, profile photo, login credentials |
| Contact | Email, phone, address/area |
| Right to work & ID verification | Identity documents and verification results (processed via our ID provider), which may include biometric data — see section 4 |
| Tax & reporting | National Insurance number and income earned through the Platform (required for DAC7 reporting to HMRC) |
| Employer verification | Company registration details (checked against Companies House) |
| Shift & location | Shifts applied for, accepted, worked; check-in/check-out location data (geofencing) to confirm attendance |
| Payment | Payout details and transaction history. Card details are handled directly by our payment processor (Stripe) and are not stored by us |
| Reliability & conduct | Reliability score, ratings, cancellations, no-shows |
| Communications | Messages sent through the Platform, support enquiries |
| Technical | Device, IP address, and usage data (see our Cookie Policy) |
3. How and why we use your data (lawful bases)
Under UK GDPR we must have a lawful basis for each use of your data:
| What we do | Lawful basis |
|---|---|
| Respond to marketing sign-ups and contact you about early access | Consent (you submitted the form); legitimate interests in developing our service |
| Match workers to shifts, run bookings, process payments and payouts | Performance of a contract |
| Verify identity, right to work, and report income under DAC7 | Legal obligation |
| Prevent fraud, abuse, and off-platform circumvention; maintain reliability scores | Legitimate interests in keeping the marketplace safe and fair |
| Send marketing about Zero Hours | Consent (you can withdraw at any time) |
| Process biometric identity-verification data | Explicit consent / substantial public interest (see section 4) |
4. Special-category and biometric data
To confirm identity and right to work, our identity-verification provider may process biometric data (for example, a facial scan matched to your ID document). Biometric data used to identify you is "special-category" data under UK GDPR and receives extra protection.
Where we rely on this, we do so on the basis of your explicit consent and/or a substantial-public-interest basis for confirming eligibility to work. You can decline, but we may then be unable to verify you and provide the Platform. We keep verification data only as long as needed and delete or anonymise it in line with section 7.
5. Who we share your data with
We do not sell your personal data. We share it only with parties who help us run the Platform or where the law requires it:
- Web3Forms — delivery of marketing form submissions.
- Stripe — payment processing and payouts.
- Our identity-verification provider — right-to-work and ID checks.
- HMRC — income reporting under the DAC7 digital-platform rules.
- Companies House — employer/business verification.
- Other workers and employers — the limited profile and shift information needed to arrange and complete a booking.
- Hosting, analytics, and notification providers — to operate and improve the service.
- Authorities, advisers, or acquirers — where required by law or in connection with a sale of the business.
6. International transfers
We aim to keep personal data in the UK or European Economic Area. Where a provider processes data outside the UK/EEA, we ensure an appropriate safeguard is in place (such as UK adequacy regulations or the International Data Transfer Agreement / Addendum) so your data stays protected.
7. How long we keep your data
We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it.
- Marketing sign-ups: kept until you ask us to remove them or they are no longer needed to contact you.
- Account & profile data: kept while your account is active and for a reasonable period afterwards.
- Tax & transaction records (DAC7): retained for the legally required period.
- Verification/biometric data: kept only as long as needed to complete and evidence the check.
8. Your rights
Under UK GDPR you have the right to: access your data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent at any time. These rights are subject to legal limits — for example, we may need to retain certain records for tax reporting (section 7).
To exercise any right, contact privacy@zerohours.live. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or 0303 123 1113.
9. How we protect your data
We use appropriate technical and organisational measures — including encryption in transit, access controls, and payment handling by PCI-compliant providers — to protect personal data against loss, misuse, or unauthorised access. No system is perfectly secure, but we work to keep your data safe.
10. Children
Zero Hours is not intended for anyone under the minimum working age and requires the right to work in the UK. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will remove it.
11. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are used only with your consent.
12. Changes and contact
We may update this policy from time to time. The "last updated" date at the top shows the current version, and material changes will be highlighted on the site.
Data controller: Zero Hours, 30 Churchill Place, London, E14 5RE. Privacy contact: privacy@zerohours.live.