managero Privacy Policy

1. Who we are

managero is provided by Managero Software Limited, a private limited company registered in England and Wales (company number 17500331), trading as managero.

Registered office: Ileden Farm House, Ileden Lane, Canterbury, CT4 6HP, United Kingdom
Contact for anything in this policy: hello@managero.co.uk
The service: https://app.managero.co.uk (the app) and https://managero.co.uk (the website)

This policy says what personal information managero holds, why, who it goes to, where it is kept, how long for, and what you can do about it. It covers business owners and their staff, people who use the website, and people we contact.

2. Who is responsible for what

If your business has a managero account, your business is the controller of the records it keeps about its staff, its customers and what happens at its sites. Managero Software Limited is its processor: we hold the records and act on your instructions. Our promises to you as processor are in the Data Processing Terms.

If your employer invited you to managero, your employer is the controller, so ask them about your information. If you write to us, we reply, tell you which business holds your information and pass your request to them. We can't change or delete an employer's records on your say-so alone.

Managero Software Limited is the controller for its own records: the account holder's name, email and billing, the emails we send, questions and walk-through requests sent to us, visits to the website, and the businesses we contact (sections 3.1, 3.7 to 3.11, and 3.13 to 3.17).

3. What we hold, and why

3.1 The account holder

What	Where it comes from	Why we can use it
Name and email address	Sign-up	To run your account (contract, Article 6(1)(b) of the UK GDPR)
Sign-in details. Firebase Authentication handles your password, and we never see it	Sign-up	Contract, Article 6(1)(b)
Business name, site names and site addresses	Setting up your account	Contract, Article 6(1)(b)
The emails we send you: staff invitations, alerts when a check fails or is missed, the daily and weekly summaries, setup and trial emails, password resets, payment emails and the copy of your records when you cancel	Automatic	Contract, Article 6(1)(b)
Billing: Stripe's customer and subscription ids, your plan, amounts, dates and whether a payment failed	You and Stripe	Contract, Article 6(1)(b), and tax law, Article 6(1)(c)
A welcome or partner code you entered, and the campaign or letter it came from	Sign-up or Billing	Legitimate interests, Article 6(1)(f): knowing which letter or partner brought you, and giving you the offer
Security records: IP address, browser details and error logs	Automatic	Legitimate interests, Article 6(1)(f): keeping the service secure and working

You need to give us your name and email to have an account. The law doesn't require it, but we can't open or run an account without it.

3.2 Your staff (your business is the controller)

This reaches us from you, or from the member of staff when they accept their invitation. The last column is the reason a UK hospitality business would normally rely on. Choosing the reason is your business's job, not ours.

What	Where in the app	The reason a business normally relies on
Name	Accepting the invitation, then on every record the person makes	The employment contract, Article 6(1)(b)
Email address	The invitation and signing in	Contract, Article 6(1)(b)
Phone number	Accepting the invitation	Contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f): reaching staff about shifts
Date of birth	Typed in by the member of staff	Legal obligation, Article 6(1)(c): age limits the hours a young worker may work, and identity checks
Home address	Not collected	Not held
Emergency contact (name, relationship, phone)	Accepting the invitation	Vital interests, Article 6(1)(d), in an emergency, and legitimate interests, Article 6(1)(f), for keeping it. It's about someone else, so staff should tell the person they name
Signatures	Signing a form, a policy or a training record, and countersigning an incident. Kept as an image	Legal obligation, Article 6(1)(c): a record has to show who made it; and legitimate interests, Article 6(1)(f)
IP address, browser details, account email and time	Saved with every signature, shown on screen and printed in downloads	Legitimate interests, Article 6(1)(f): it's what makes a signed record stand up
Photos	Checks, fixes, deliveries, incidents, uploaded paper sheets and photo answers in forms. People often appear in them	Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f)
Right-to-work checks	The right-to-work form: full name, date of birth, document reference and a photo of the document	Legal obligation, Article 6(1)(c): immigration law
Training records	Training screens: the quiz, the answers, the mark and the score; for training videos, how far the person watched, when they finished, their quiz answers and their signature	Legal obligation, Article 6(1)(c): food handlers must be trained; and legitimate interests, Article 6(1)(f)
Certificates about a named person	The document store	Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f)
Rotas: who worked when, in what role, and who asked for or agreed a swap	Rota screens	Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c): working time records
Who did what, and when, on every temperature, check, delivery, note and correction	Automatic	Legal obligation, Article 6(1)(c): a food safety record has to show who made it
Kitchen phone PIN: a shared phone where each person records under their own name. The PIN is stored only as a scrambled (hashed) value, never as the PIN itself	Setting up the kitchen phone	Legitimate interests, Article 6(1)(f)
Notes managers type about records	Notes and corrections	Legitimate interests, Article 6(1)(f). What's typed in a note box is the business's responsibility

Not held: location or GPS, National Insurance numbers, bank details, pay or salary. The only health information is in the fitness to work records (section 3.5), incident records (section 3.3), food complaints (section 3.4) and, if staff write about it, managero HR & Safety (section 3.12).

3.3 Incidents and injuries: health information

An incident report can hold: the injured person's name; whether they're staff, a customer, a contractor or a delivery driver; their organisation and contact details; what happened; a description of the injury; what treatment was given and by whom; witnesses and their contact details; photos of the scene; whether a RIDDOR reminder was shown; a countersignature with its signature record; and any later corrections.

A description of an injury and its treatment is health information, which the UK GDPR calls special category data (Article 9(1)). A business needs one of the conditions in Article 9(2) as well as a reason from Article 6. The ones normally used:

The injured person works for the business: Article 9(2)(b) (employment law), with Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018. The duties are reporting certain injuries under RIDDOR 2013 and keeping an accident book under the Social Security (Claims and Payments) Regulations 1979. A business relying on this needs an Appropriate Policy Document (Schedule 1, Part 4). That's the business's document, not ours.
The injured person doesn't work there (a customer, a driver, a contractor): Article 9(2)(f), records kept because a legal claim may follow, with legitimate interests, Article 6(1)(f).
In an emergency, Article 9(2)(c), vital interests, may apply when the person can't consent, for example when their emergency contact is used. Not for keeping the record afterwards.

Consent isn't relied on: staff can't freely refuse their employer, and a record that vanishes when consent is withdrawn isn't a record. The business chooses these conditions, not us.

Who can read it: the account owner and people given the permission to. Incident records are kept out of ordinary staff views and out of the summary emails, and a download that includes them carries a warning. The countersigning link shows the injured person only what they need to sign.

3.4 Customer complaints about food

Any member of staff can write down a customer's complaint about food: the kind of complaint (illness after eating, something found in food, an allergic reaction, undercooked food or something else), when and how it came in, the meal and dish, a short description, photos if any, and, only if the customer wants a reply, their name, phone number and email. Managers then record what they checked and did, the reply, and whether the local authority was told. Why: to deal with the complaint and show how complaints are handled; normally legitimate interests, Article 6(1)(f). For illness or an allergic reaction, the description is health information, and the condition normally used is Article 9(2)(f), legal claims. The business chooses. Who can read it: the account owner and managers with the Report incidents permission. The person who wrote it down can't read it back. Downloads and share links list complaints without the customer's name, contact details or photos. How long: kept with the food safety records (section 6).

3.5 Fitness to work: sickness, exclusion and the questionnaire

Food handlers must report diarrhoea, vomiting and some infections, and a business must keep anyone who might contaminate food away from it. managero records: a member of staff saying they're unwell, by picking a category (diarrhoea and/or vomiting, another infection, a skin infection or wound, or another illness), never a description; a manager's decision to exclude them or let them work with checks, and their return, with the checks made and who cleared them; and a fitness to work questionnaire (four yes or no answers, the date, the person's signature and the manager's signed review), filled in before a first shift, when a manager asks, or on return after illness. There's no free-text box for medical detail. If any answer is yes, the managers at that site get an email naming the person and the site and asking them to speak to them before their shift, with no answers in it.

This is health information. Why: the food hygiene duty to keep someone who may contaminate food away from it (Regulation (EC) No 852/2004 as kept in UK law, Annex II, Chapter VIII). Normally legal obligation, Article 6(1)(c), with Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018, which needs an Appropriate Policy Document. The business chooses. Who can read it: the person it's about, the account owner and managers with the Manage fitness to work permission at that site. Everyone else sees only how many people are excluded, with no names. Questionnaire answers are never in a download, a CSV or a share link. How long: can't be edited or deleted once signed; kept with the food safety records (section 6).

3.6 On your device

Photos waiting to upload, kept in your browser until they reach us, so recording works in a walk-in with no signal.
Signing in and the site you picked, kept in your browser so you stay signed in.
Google Analytics, only if you say yes. The app and managero.co.uk each show a small bar asking whether we may use Google Analytics to see how managero is used. Until you press Accept, Google Analytics is not loaded and sets no cookie. If you press Accept, it counts how the pages are used and sets cookies in your browser (`_ga` and one named `_ga_` and an id) for that site only. If you press No thanks, it is not loaded at all. Your choice is kept in your browser's local storage (`mg_analytics_consent`), on each site separately, so that we don't ask again. To change it, use Cookie settings in the website's footer, at the foot of the app's screens or on its legal pages; No thanks after Accept deletes those cookies. Lawful basis: your consent, Article 6(1)(a).
The app's font comes from Google Fonts, so your browser asks Google's servers for it and Google sees your IP address.
A concern's follow-up code, only if the person raising a concern ticks the box to keep it on that device (section 3.12).
On the website: the partner-link cookie in section 3.10, and the referring site and campaign tags kept in your browser's session storage until you close the tab, so a question or walk-through request can say where you came from.

3.7 Visits to managero.co.uk

When a page on managero.co.uk loads, your browser tells us: the page, the domain of the site that linked to it (such as google.com, never the full link), any campaign tags in the address, and whether the screen is phone, tablet or desktop sized. Opening or sending a form and clicking Sign up or Sign in are counted the same way. Each count adds one to a daily total, and only the daily totals are kept, with no IP address or identifier. If you came from the QR code on one of our letters, the address carries a code for the business the letter went to, and the daily totals count visits for that code. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Why: legitimate interests, Article 6(1)(f), in knowing which pages are read and how people find the site.

3.8 managero news by email

If you tick "Send me occasional managero news and tips. Unsubscribe any time." on the website or when you create your account, we send you occasional emails with news and tips. Only people who ticked the box get them, and the box always starts unticked. We keep your email address, when and where you ticked it, and the words next to the box. Every email has a one-click Unsubscribe link, and an account owner can also turn it off in Settings. When you unsubscribe we keep your address on a list so we don't email you again. It doesn't stop the emails your account needs, such as invitations, alerts, password resets and billing. We don't track whether you open the emails or click a link. Why: your consent, Article 6(1)(a), as the Privacy and Electronic Communications Regulations require.

3.9 The mailing list on the app's sign-up page

Before sign-up opened, the sign-up page at https://app.managero.co.uk/signup offered a mailing list. If you joined it, we keep your email address, your name if you gave one, when you joined, and the sentence that was shown above the button: "We will email you once, when managero opens. Nothing else. Unsubscribe any time." We use your address for one email, to tell you managero has opened, and for nothing else. Joining it wasn't a yes to managero news (section 3.8), unless the sentence above the button also offered news and tips. Every email has a one-click Unsubscribe link. The email isn't tracked. Why: your consent, Article 6(1)(a).

3.10 Partner links

If you reach managero.co.uk through a partner's link (an address ending `?ref=` and their name), we keep that partner's name in a cookie called `mg_ref` and in your browser's local storage for 60 days, so that if you sign up we know which partner introduced you and can apply their offer at checkout. Nothing else is stored, it is not shared with the partner or anybody else, and it is not used to track you. If you sign up, the partner's name is kept with your account. Lawful basis: legitimate interests, Article 6(1)(f).

3.11 Campaign links

If you reach managero.co.uk or the managero app through a link carrying campaign tags (the `utm_` parts of an address, used in our adverts and emails) and then sign up, we keep the campaign's name, source and medium with your account so that we know which advert or email worked; they are not shared with anybody. Lawful basis: legitimate interests, Article 6(1)(f).

3.12 managero HR & Safety: concerns, the harassment log, policies and training

managero HR & Safety helps a business keep a record of the steps it takes on harassment and health and safety. Your business is the controller of all of it.

Policies and risk assessments. The harassment policy, health and safety policy, risk assessments and fire records the business drafts and adopts, each version kept, and who has read and signed each policy, with the signature record in section 3.2.
Training videos. For each person: which video and version, how far they watched, when they finished, their quiz answers and score, and their signature.
Concerns (only if the business switches concern reporting on). A concern holds the site, what the person wrote, when and where it happened as they describe it, the date it was raised (a day, not a time), the people they chose to send it to, the messages back and forth, and whether it's open or closed.
A concern with a name: the person's name and account are stored with it.
A concern without a name: no name and no account id are stored with the concern or its messages. The person gets a follow-up code to read replies, and we store that code only as a scrambled (hashed) value. Google's request logs, which we use only to keep the service secure (section 4.1), record the IP address and browser of every request, including one that raises a concern. They aren't stored with the concern.
The email about a concern: the people it's sent to get an email that says only "A new concern has been raised" and a link, with no name, site or words from the concern.
Who can read a concern: only the people the person chose to send it to, while they still work at the business. The owner can't read a concern they weren't sent, and our own admin screens can't open one.
The harassment log. A private record a business keeps of what happened, when, at which site, whether a customer or other outsider was involved, the people involved as the writer describes them, what was done about it, and whether it's open or closed. Every change is kept with who made it, and actions are added, never edited. Who can read an entry: only the people named as its readers, and only while they still have the Keep the harassment log permission at that site (an owner named as a reader always can). Our own admin screens can't open the log.

Sensitive information. Concerns and log entries may describe allegations of crimes (Article 10 of the UK GDPR) and special category information such as someone's sex life, health, race or religion (Article 9). The business chooses the reasons it relies on, as for incidents (section 3.3): normally Article 6(1)(c) or (f), with Article 9(2)(b) or (f), and for allegations of crimes a condition in Schedule 1 of the Data Protection Act 2018, with an Appropriate Policy Document.

How long.

A closed concern is deleted automatically after the period the business picks: 6, 12, 24, 36 or 72 months after it was closed (24 unless the business changes it). An open concern isn't deleted. The people it was sent to can also delete a closed concern sooner.
A closed harassment log entry is flagged to its readers for review after the period the business picks: 1, 2, 3 or 6 years after it was closed (6 unless changed). Nothing is deleted automatically, because an entry may be needed for a claim. Its readers can delete a closed entry.
Policy signatures and training records can't be edited once signed and are kept with the food safety records (section 6).

3.13 Questions and walk-through requests

If you send a question through the website, we keep your name, email address, your question, the page you sent it from, the site that referred you and any campaign tags, and whether you ticked the box for managero news. If you ask for a 15-minute walk-through, we keep your name, your business, your email address, your phone number, the two times or days you gave, and your note if you wrote one. We ask for the phone number so that we can call you for the walk-through. Each is emailed to us (questions to hello@managero.co.uk, walk-through requests to toby@managero.co.uk) so we can reply. To stop the forms being abused, a hidden box catches automated posts, and a scrambled (hashed) form of your IP address is used to limit how many messages one connection can send in ten minutes. Why: legitimate interests, Article 6(1)(f), in answering you. How long: there's no automatic deletion of these yet. Write to hello@managero.co.uk and we delete yours.

3.14 If we wrote to you or emailed you first

We contact food businesses that might find managero useful, by letter and by email. Our lists come from these sources:

Food hygiene ratings published by the Food Standards Agency, on its ratings website and as open data: the business name, address, type of business, local authority, rating and its three scores, inspection date and map position. Older copies of councils' published ratings, kept by the Internet Archive (web.archive.org), tell us whether a business is new.
Companies House, from its public register and the data it publishes: whether the business is an active limited company or LLP, its company number, registered office, business activity codes and date of incorporation; its officers, their roles, their dates of appointment and the other companies they have been officers of; and its persons with significant control. Matching a person with significant control to an officer uses the month and year of birth the register shows. A letter or email may greet a director or a person with significant control by name. Some letters go to new food companies found on the register, at their registered office.
The business's own website, for a published business email address, and sometimes for the first name of the owner where the website gives it. We don't guess email addresses. We check only that an address's domain can receive email.
OpenStreetMap and web searches (Brave Search and DuckDuckGo), to find a business's website.
Trade press and local news, such as the Morning Advertiser and Big Hospitality, for the names of the people who run larger groups and for new openings.
postcodes.io, a free postcode lookup, for the area an address is in.

We email only limited companies and LLPs, at a published business address. A sole trader or partnership gets a letter, not an email. We keep the business name, address, email address where there is one, the name we greeted you by, the details above, when we contacted you, how, and any reply. Why: legitimate interests, Article 6(1)(f), in telling food businesses about a product that may help them. To stop: reply "stop" to any email, or write to hello@managero.co.uk, and we won't contact you again. We keep your address on a list so that we don't. You can also object at any time (section 7).

3.15 Welcome letters and codes

A letter may carry a welcome code and a QR code. If you sign up with the code, it's kept with your account, linked to the letter it came from. The QR code's address tells us which business the letter went to when the page is opened (section 3.7). Why: legitimate interests, Article 6(1)(f), in knowing which letters work.

3.16 If you sell managero for us

If you're one of our sales agents, we keep your name, contact details, your signed agreement and its signature record, the businesses you contacted and signed up, and your commission. Why: our contract with you, Article 6(1)(b), and tax law, Article 6(1)(c). Your sales login shows you only the businesses you signed up (business name, the owner's first name and email, sign-up date, trial and setup progress, and whether they subscribed) and the shared list of businesses already contacted, so nobody is contacted twice.

3.17 Welcome letter codes

Some new food businesses get a welcome letter from us in the post, with a QR code and a short code printed on it. When the welcome page for that code is opened, we record that the code was opened, when it was first and last opened, and how many times. We do not record anything about the device or the person who opened it. If the business then signs up with the code, the code is kept with its account. This tells us which letters reached someone. Lawful basis: legitimate interests, Article 6(1)(f).

4. Who we share it with

We don't sell personal information. We don't send any business's records to any authority. A business's records leave its account only when someone in the business downloads them, emails them, switches on a share link (which they can switch off), or publishes its allergen page.

4.1 Google (Firebase and Google Cloud): where everything is kept

Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Firebase Hosting. Everything in section 3 is stored on Google's infrastructure, and there's no other database. Firebase Authentication also sends the email that checks your email address. Google's request logs record the IP address and browser of each request to the service; we use them only to keep it secure and working.

4.2 Google (Gemini, via the Google AI Studio API): reading what you upload

When someone in your business uses one of the features below, the file, or the text taken from it, is sent to Google's Gemini API at generativelanguage.googleapis.com to be read.

Feature	What is sent to Google
Form import: a paper form made into a form in the app	A photo, PDF or Word document of the form
Menu import	A photo, PDF or Word document of the menu
Recipe import	A photo, PDF or Word document of your recipes. A spreadsheet (CSV or Excel) is read on your device and is not sent
Staff list import	A photo, PDF or Word document of a staff list or rota, with the names, email addresses and any other details on it. A typed list or a CSV is read on your device and is not sent
Paper records: typing up the records you kept on paper before managero	A photo or PDF of the sheets, with the names, initials and signatures on them
Temperature sheet transcribed from Camera Upload	The photo of the sheet
Invoice import, in ingredient pricing	A photo of a supplier invoice or delivery note, or a scanned PDF with no text in it. A PDF that has text in it is read without Gemini and is not sent
Risk assessment import	A photo, PDF or Word document of the risk assessment
Bulk upload: the sorting step	Any file whose name and type do not show what it is, for example "scan0142.pdf". That file can be anything in the folder, including a staff document. A file whose name points to health, an injury or someone's identity is not sent for sorting. Once sorted, a file may be sent again by the matching import above

What you upload is sent as it is, including any names, signatures, handwriting or other personal information on it. A photo or PDF is sent whole. For a Word document, only the text is sent.
It happens only when someone uses one of these features, never in the background.
What comes back is a draft for someone in your business to check. Nothing is saved from it until they confirm it. The import is told never to produce allergen information.
The uploaded file stays in your own area of storage. An invoice isn't kept unless the person ticks "Keep this invoice".
We use Google's paid service for these features.

A sheet filed under Camera Upload is kept as a photo and isn't read or sent to any model, unless you choose to transcribe a temperature sheet (above), where every value read is shown beside the photo for a person to confirm. If you'd rather a document with personal information on it didn't go to Google, file it under Camera Upload.

4.3 Domeneshop: email

Domeneshop, in Norway, sends managero's emails and hosts our mailboxes (hello@, toby@, support@ and no-reply@managero.co.uk). It receives each recipient's address and the content of the email. That includes invitations (which name the business, who invited you, your sites and any forms waiting), alerts and summaries, setup and trial emails, password resets, payment emails, the copy of your records on cancelling, managero news, the concern email in section 3.12, the fitness to work email in section 3.5, the questions and walk-through requests in section 3.13, and the emails in section 3.14. When an email can't be delivered, the bounce comes back to no-reply@managero.co.uk, and we keep the address and the reason so we stop sending to it.

4.4 Stripe: payments

Subscriptions are paid through Stripe Payments UK Ltd. Stripe receives your name, email address and card details, and holds the card: we never see or store a card number. You type it on Stripe's own page. From Stripe we get only what tells us whether your account is paid: a customer id, a subscription id, the status, the amount, the renewal date and whether a payment failed. Stripe is a controller in its own right for fraud prevention and its own legal duties, and our processor for the rest. Its privacy policy is at https://stripe.com/gb/privacy. No staff record, food safety record or incident report goes to Stripe.

4.5 Google Analytics and Google Fonts

See section 3.6. Google Analytics runs only after you press Accept; it then receives your IP address, browser details and how the app or website is used. Google Fonts receives your IP address when the app loads its font. Neither receives any record you make in managero.

4.6 Letters

When we post letters, the postcode of each address is sent to postcodes.io, a free postcode lookup, to place it on our own map. Our letters are printed and posted by Stannp (stannp.com), a printing and posting service. For each letter it receives the business name and address, the name of the person it is addressed to where there is one, the greeting line, and the letter's welcome code and its web address.

4.7 Who at Managero Software Limited can see what

Access to the live system is limited to named people at the company, bound by confidentiality. Our own admin screens show account details (names, email addresses, businesses, sites, staff lists and billing), never the contents of a business's records. Sales agents see only what section 3.16 describes. Our admin screens can't open a concern or the harassment log.

The shop at shop.managero.co.uk isn't covered by this policy. Orders there go through the shop's own checkout.

5. Where it's kept, and transfers out of the UK

Your records are kept in the United Kingdom, in Google Cloud's London region (europe-west2): the database, and the uploaded files such as signatures, photos and documents. Both are kept in that one region only.

Some things are handled outside the UK:

Google's Gemini API (section 4.2), only when someone uses one of those features.
Stripe (section 4.4), for payments. It gets billing details, never a record.
Domeneshop (section 4.3), in Norway, for email.
Firebase Authentication, Firebase Hosting, Google Analytics and Google Fonts, which Google runs worldwide.

Norway is in the European Economic Area, which UK law treats as giving adequate protection. For the others, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which Google and Stripe include in their terms.

6. How long we keep it

What	How long
Food safety and other records a business keeps: temperatures, checks, deliveries, signed forms, training, incidents, complaints, fitness to work, policy signatures	At least five years. Nothing deletes them automatically. Signed records can't be edited, and removing an item archives it
Concerns	Deleted automatically after the period the business picks (section 3.12)
The harassment log	Flagged for review after the period the business picks, and deleted only by its readers (section 3.12)
The account holder's name, email and billing	While you have an account, then as long as tax law needs, and for as long as your free read-only access lasts (section 8 of the Terms of Service)
Questions and walk-through requests	Until you ask us to delete them (section 3.13)
Businesses we contacted first	While we may contact you, then only what we need to keep you on our "don't contact" list
Unsubscribe, "stop" and bounce lists	Kept, so we don't contact you again
Website visit counts	Daily totals only, with nothing about you
Google's request logs	30 days, unless Google Cloud's default changes

Can you have it deleted? You have the right to have your personal information deleted (Article 17 of the UK GDPR), but it isn't absolute. How it works here:

Food safety and compliance records are kept, not deleted on request. A business must keep them by law (food hygiene record keeping, RIDDOR, the accident book, working time). Article 17(3)(b) says the right to deletion doesn't apply where keeping something is needed to meet a legal duty. So a former member of staff can't have the fridge temperatures they recorded deleted.
Your name stays on the records you made. The name, the time and the signature record are the record.
Personal details that aren't part of a record can be deleted. Once someone has left, their date of birth, phone number and emergency contact aren't needed. On the business's written instruction we delete them and leave the records alone. So the answer to "can you delete me" is: most of you, yes; the records you made, no.
Right-to-work document photos are deleted, on the business's instruction, after the period the law says to keep them.
Photos where someone appears in the background are part of the evidence and are kept under point 1. A photo that caught something it shouldn't is deleted on the business's instruction.
Your own account details are kept as the table says.

Apart from concerns, nothing in a business's account is deleted automatically, and the app has no delete button for records. Deletion under points 3 to 5 is done by us on the business's written instruction: write to hello@managero.co.uk. Where a former member of staff asks for their name to be taken off records the business must keep, we explain the position above, pass the request to the business, and tell the person they can complain to the Information Commissioner's Office.

7. Your rights

You can ask to see your information, have it corrected, have it deleted (section 6), limit how it's used, take a copy to use elsewhere, and object to how it's used, including to being contacted (section 3.14). Where we rely on your consent, you can withdraw it at any time. managero makes no automated decisions about people that have legal or similarly significant effects.

If you work for a business that uses managero: ask your employer, who controls the records. If you write to hello@managero.co.uk, we reply, tell you which business holds your information, and pass your request to them.
Anyone else: write to hello@managero.co.uk. We answer within one month.

Complaints. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You don't have to come to us first.

8. Security

Each business's information is kept apart by security rules that Google's servers enforce, not the app in your browser.
Signatures, evidence photos, uploaded documents and imports can't be changed or deleted once stored.
Signed forms and quiz attempts can't be edited after signing. Corrections are added as new entries, so a change can be seen.
Incident records, fitness to work records, concerns and the harassment log can be read only by the people sections 3.3, 3.5 and 3.12 describe.
Firebase Authentication handles passwords. We never see them.
The key for Google's Gemini service is kept on our servers, never in your browser.
Access to the live system is limited to named people at the company, bound by confidentiality.

Breaches. If a breach affects information we hold for your business, we tell you without undue delay, so that you can meet your own 72-hour duty to the ICO. The detail is in clause 11 of the Data Processing Terms.

9. ICO registration and the data protection fee

Managero Software Limited is registered with the Information Commissioner's Office and pays the data protection fee. ICO registration number: ZC274948. You can check it on the ICO's register of fee payers: https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/

10. Changes

If we change this policy in a way that matters, we email account holders and update the version below. The current version is always at https://managero.co.uk/privacy.

Version: 6. Last updated: 2026-10-22.

Earlier versions: version 1, 2026-10-05; version 2, 2026-10-13; version 3, 2026-10-22; version 4, 2026-10-22; version 5, 2026-10-22.