Privacy notice

Fairpool is run by Callum Pollard as a sole trader (Callum Pollard trading as Fairpool). Fairpool is not a company. Business address: [Geographic address of the business to be confirmed]. Address for service: [Address for service to be confirmed]. We are registered with the Information Commissioner's Office under registration [ICO registration number to be confirmed]. Contact us about anything in this notice at privacy@fairpool.example.

People who use Fairpool. We are the controller for the accounts of the people who sign up and sign in to manage venues (owners, admins and other members), and for complaints and support requests sent to us.

Venue workers. Each venue's employer is the controller for the tip records it keeps about its workers in Fairpool. We are its processor and only use that data on its instructions, under our Data Processing Agreement. If you work at a venue that uses Fairpool, your employer's own privacy notice also applies, and requests about your data are best sent to them first.

As controller, we hold:

• Account details: name, email address, a hash of your password (never the password itself), your role, your two-factor settings, and the version and date of the terms your organisation accepted, including the confirmation that you signed up for a business.
• Sign-ups not yet confirmed: the name, email address, password hash, organisation and venue name entered on the sign-up form, until the email address is confirmed.
• Sign-in security: sign-in sessions, browsers that have signed in to your account before, two-factor sign-in steps, and failed sign-in and other rate-limit records, which hold a keyed fingerprint of the email address or IP address rather than the address itself. Sign-ins, failed sign-ins and blocked attempts to reach another organisation's data are also written to your organisation's change log with the IP address and browser (user agent) used, which the owner sees on the Records page and the account export shows. IP addresses and browser details in the change log are removed after 12 months; the entries themselves are kept for 3 years.
• Change log: who changed what and when, with record IDs and amounts but not worker names.
• Billing: your organisation's Stripe customer and subscription references, plan and payment status. Card details go straight to Stripe and never reach us.
• Service emails: the emails we send and a short record of which reminder went to whom on which day. We send: sign-up and email confirmation emails (and a notice if someone tries to sign up with an email that already has an account), password reset links and notices when a password is reset or changed, two-factor notices, a daily reminder of pay-by dates, unallocated tips, corrections and top-ups and record requests awaiting a reply (you can turn this off with Email me reminders on the Account page), notices when your agreement with us ends, and acknowledgements of complaints. Emails never contain worker names.
• Complaints and support requests: your name, email address and what you tell us, and, if we pass a complaint to a venue, when we did and to whom.
• Our hosting provider's request logs: the IP address of each visitor and the address of each page requested.

As processor for venues, we hold: workers' names, roles, role weights, employment type and, for agency workers, the agency's name; hours worked; tips, allocations and each worker's share; corrections and top-ups; workers' requests for their records and notes about them; the venue's tipping policy, its past versions and summaries of consultation with workers, which may name people; and, if the venue gives a worker a private link, a log of when it was opened with the IP address used.

Our lawful bases under Article 6 of the UK GDPR are:

• Contract (Article 6(1)(b)), only where you are personally our customer, for example a sole trader running a venue: to provide the service and bill for it.
• Legitimate interests (Article 6(1)(f)) for everyone else who has an account, such as staff of a company that is our customer: our interest, and our customer's, in providing the service they signed up for. We also rely on legitimate interests to keep accounts and the service secure, prevent fraud, keep the change log, send reminders, and keep billing records and the record of which terms your organisation accepted. We have recorded a legitimate interests assessment for each of these; ask us if you would like a summary.
• Legal obligation (Article 6(1)(c)): to handle data protection complaints, as section 164A of the Data Protection Act 2018 requires, and to keep records the law requires.

You need to give us your name, email address and a password to have an account; without them we cannot provide the service. You do not have to give us anything else. Workers' data comes from their employer, which needs it to meet its duties under the Employment (Allocation of Tips) Act 2023.

Fairpool does not ask for special category data (such as health, ethnic origin, religion, trade union membership or sexual orientation) or criminal offence data, and does not need it. Our Data Processing Agreement tells venues not to enter it in notes, policies or consultation summaries.

If someone includes it in a complaint to us, we use it only to deal with the complaint, under Article 9(2)(g) of the UK GDPR and paragraph 6 of Schedule 1 to the Data Protection Act 2018 (our statutory duty to handle complaints), or Article 9(2)(f) where it is needed for a legal claim.

The same applies to emails you send us about a complaint or a request about your data. We do not pass sensitive details on to a venue unless you agree in writing and the venue needs them to act.

If you include sensitive details in a support email, we use them only to answer you, and delete them as soon as we see they are not needed. If the email is really a complaint, or about a legal claim, we treat it as one, as above.

We do not sell data, use it for advertising, or profile anyone. Fairpool calculates tip shares from the hours and role weights the venue enters and the policy the venue chooses. A person at the venue decides when to run each allocation and marks it as paid; Fairpool makes no decision about anyone on its own.

Workers do not have Fairpool accounts. A venue can give a worker a private link to their own tip records. Each link works for 180 days and stops early if the venue marks the worker as no longer working there, removes them or archives the venue. When a link is opened we log it, at most once an hour, with the IP address used, which we keep for 12 months, so the venue can spot a link that has been shared.

Fairpool is for businesses and not for children: account holders must be 18 or over. Venues may employ workers aged 16 or 17, so we have assessed the service with them in mind, as Article 25 of the UK GDPR (as amended by the Data (Use and Access) Act 2025) requires. Their private link shows only their own records, expires, and carries no tracking, and our emails never name workers.

We set only the cookies below, and only when you sign in. Each is strictly necessary for the service you have asked for, so under paragraph 4 of Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003 we do not need your consent and do not show a cookie banner. There are no analytics, advertising or third-party cookies. If you pay through Stripe Checkout, Stripe sets its own cookies on its pages under its own policy.

• Allocations and the tips in them: until 3 years after the latest of the end of the allocation period, its pay-by date and the date it was paid, and never before every tip in it is 3 years old, as the Tips Act requires.
• Tips never allocated: 3 years from the day the customer paid them, the period the Tips Act requires.
• Corrections and top-ups: 3 years after they are paid (or due, or recorded). Unpaid ones are kept until paid.
• Hours worked: 3 years and 2 months, and longer if they fall in an allocation we still keep.
• Workers' requests for their records: 3 years after the venue replies, or after the request if not.
• Workers: a worker the venue removes is anonymised while their records are kept, and deleted once no records remain. A former worker is deleted once no records about them remain and nothing about them has changed for 3 years.
• Tipping policies: the current version is always kept. A replaced version is kept for 3 years after it was replaced, and longer while we keep an allocation that began before then.
• Archived venues: deleted once nothing in them is still kept.
• The change log, including sign-in entries and private link views: 3 years (IP addresses and browser details in it: 12 months).
• Complaints: 3 years after we resolve them, or after we receive them if never resolved.
• Sign-in sessions: they end after 30 minutes without activity and at most 12 hours after sign-in. Two-factor sign-in steps: 5 minutes. Password reset links: 30 minutes. Email confirmation links and sign-ups not yet confirmed: 24 hours. Browsers that have signed in before: 90 days. Each is deleted once it expires.
• Failed sign-in and rate-limit records: 1 day. Records of which reminders were sent: 14 days.
• Account and organisation data: until you delete your organisation, which removes everything immediately, or until we delete it 90 days after your agreement with us ends, together with your customer record at Stripe (see the Terms). After that we keep only a note that the organisation was deleted, when and why, with no personal data. Stripe keeps its own payment records as its privacy notice explains.
• Backups: deleted data stays in our hosting provider's point-in-time recovery for up to 7 days. Once our planned independent nightly backups start, it will also stay in them for up to 30 days.

When a venue removes a worker who has tip records, we replace their name with an anonymous label rather than deleting the amounts, because the venue must keep those records for 3 years. We also remove their name from tip notes, policies, consultation summaries and request and correction notes.

We use a small number of providers under contract. Using a US company is a transfer outside the UK even when its servers are in Europe, so each transfer has the safeguard shown:

• Render web service (Render Services, Inc.): Frankfurt, Germany (EU region). The servers are in Frankfurt, but Render Services, Inc. is a US company, so using it is a transfer to the US. It is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge, under the Data Protection (Adequacy) (United States of America) Regulations 2023). If that stops applying, its DPA (section 6.4) falls back to the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Render managed PostgreSQL (Render Services, Inc.): Frankfurt, Germany (EU region). The servers are in Frankfurt, but Render Services, Inc. is a US company, so using it is a transfer to the US. It is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge, under the Data Protection (Adequacy) (United States of America) Regulations 2023). If that stops applying, its DPA (section 6.4) falls back to the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Resend (Plus Five Five, Inc. (trading as Resend)): United States: Resend stores email content and logs in the US whichever region sends them. Resend's DPA (section 6.4) makes transfers from the UK under the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, and Resend is also certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge, under the Data Protection (Adequacy) (United States of America) Regulations 2023).
• Stripe (Stripe Payments Europe, Limited, with Stripe Payments UK, Ltd. for UK payment services): Ireland, the United Kingdom and the United States. Ireland is covered by UK adequacy regulations. Stripe's DPA sends personal data on to Stripe, LLC in the US, which is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge, under the Data Protection (Adequacy) (United States of America) Regulations 2023); Stripe's Data Transfers Addendum adds the UK International Data Transfer Addendum where needed.
• Independent database backups (Cloudflare R2) (Cloudflare, Inc.): European Union: an R2 bucket in Cloudflare's EU jurisdiction, stored only in EU data centres. Cloudflare, Inc. is a US company, so using it is a transfer to the US even though the data stays in the EU. It is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge, under the Data Protection (Adequacy) (United States of America) Regulations 2023). If that stops applying, its DPA (section 6.2) falls back to the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Logs and uptime monitoring ([Log, metrics and uptime provider to be confirmed]): [UK or EEA region to be confirmed]. [To be confirmed when the provider is chosen]
• Email mailboxes ([Mailbox provider for our support and privacy addresses to be confirmed]): [to be confirmed]. [To be confirmed when the provider is chosen]

Stripe is also an independent controller for some payment data. See the full list of providers for what each one processes. We do not sell data or share it with anyone else unless the law requires it.

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to how we use it where we rely on legitimate interests (you can turn reminder emails off yourself on the Account page), and ask for it in a portable format. Owners can download their organisation's data and delete their organisation from the Account page. To change the email address on your account, email us and we will check it is you and change it.

Workers can ask their venue, which can export or remove their record in Fairpool, or contact us and we will pass the request to the venue. We reply within one month, or tell you within that month if we need up to two more months because the request is complex.

If you are unhappy with how your personal data has been handled, raise a complaint with us. We acknowledge complaints within 30 days and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO usually expects you to complain to us first.