Earlier version. This is version 5 of the managero Privacy Policy, last updated 2026-10-22. It is kept so that it can still be read, and it is not the current version. The current version is at https://managero.co.uk/privacy.
managero Privacy Policy
1. Who we are
managero is provided by Managero Software Limited, a private limited company registered in England and Wales (company number 17500331), trading as managero.
- Registered office: Ileden Farm House, Ileden Lane, Canterbury, CT4 6HP, United Kingdom
- Contact for anything in this policy: hello@managero.co.uk
- The service: https://app.managero.co.uk (the app) and https://managero.co.uk (the website)
This policy says what personal information managero holds, why, who it goes to, where it is kept, how long for, and what you can do about it. It covers business owners and their staff, people who use the website, and people we contact.
2. Who is responsible for what
If your business has a managero account, your business is the controller of the records it keeps about its staff, its customers and what happens at its sites. Managero Software Limited is its processor: we hold the records and act on your instructions. Our promises to you as processor are in the Data Processing Terms.
If your employer invited you to managero, your employer is the controller, so ask them about your information. If you write to us, we reply, tell you which business holds your information and pass your request to them. We can't change or delete an employer's records on your say-so alone.
Managero Software Limited is the controller for its own records: the account holder's name, email and billing, the emails we send, questions and walk-through requests sent to us, visits to the website, and the businesses we contact (sections 3.1, 3.7 to 3.11, and 3.13 to 3.17).
3. What we hold, and why
3.1 The account holder
| What | Where it comes from | Why we can use it |
|---|---|---|
| Name and email address | Sign-up | To run your account (contract, Article 6(1)(b) of the UK GDPR) |
| Sign-in details. Firebase Authentication handles your password, and we never see it | Sign-up | Contract, Article 6(1)(b) |
| Business name, site names and site addresses | Setting up your account | Contract, Article 6(1)(b) |
| The emails we send you: staff invitations, alerts when a check fails or is missed, the daily and weekly summaries, setup and trial emails, password resets, payment emails and the copy of your records when you cancel | Automatic | Contract, Article 6(1)(b) |
| Billing: Stripe's customer and subscription ids, your plan, amounts, dates and whether a payment failed | You and Stripe | Contract, Article 6(1)(b), and tax law, Article 6(1)(c) |
| A welcome or partner code you entered, and the campaign or letter it came from | Sign-up or Billing | Legitimate interests, Article 6(1)(f): knowing which letter or partner brought you, and giving you the offer |
| Security records: IP address, browser details and error logs | Automatic | Legitimate interests, Article 6(1)(f): keeping the service secure and working |
You need to give us your name and email to have an account. The law doesn't require it, but we can't open or run an account without it.
3.2 Your staff (your business is the controller)
This reaches us from you, or from the member of staff when they accept their invitation. The last column is the reason a UK hospitality business would normally rely on. Choosing the reason is your business's job, not ours.
| What | Where in the app | The reason a business normally relies on |
|---|---|---|
| Name | Accepting the invitation, then on every record the person makes | The employment contract, Article 6(1)(b) |
| Email address | The invitation and signing in | Contract, Article 6(1)(b) |
| Phone number | Accepting the invitation | Contract, Article 6(1)(b), and legitimate interests, Article 6(1)(f): reaching staff about shifts |
| Date of birth | Typed in by the member of staff | Legal obligation, Article 6(1)(c): age limits the hours a young worker may work, and identity checks |
| Home address | Not collected | Not held |
| Emergency contact (name, relationship, phone) | Accepting the invitation | Vital interests, Article 6(1)(d), in an emergency, and legitimate interests, Article 6(1)(f), for keeping it. It's about someone else, so staff should tell the person they name |
| Signatures | Signing a form, a policy or a training record, and countersigning an incident. Kept as an image | Legal obligation, Article 6(1)(c): a record has to show who made it; and legitimate interests, Article 6(1)(f) |
| IP address, browser details, account email and time | Saved with every signature, shown on screen and printed in downloads | Legitimate interests, Article 6(1)(f): it's what makes a signed record stand up |
| Photos | Checks, fixes, deliveries, incidents, uploaded paper sheets and photo answers in forms. People often appear in them | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f) |
| Right-to-work checks | The right-to-work form: full name, date of birth, document reference and a photo of the document | Legal obligation, Article 6(1)(c): immigration law |
| Training records | Training screens: the quiz, the answers, the mark and the score; for training videos, how far the person watched, when they finished, their quiz answers and their signature | Legal obligation, Article 6(1)(c): food handlers must be trained; and legitimate interests, Article 6(1)(f) |
| Certificates about a named person | The document store | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f) |
| Rotas: who worked when, in what role, and who asked for or agreed a swap | Rota screens | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c): working time records |
| Who did what, and when, on every temperature, check, delivery, note and correction | Automatic | Legal obligation, Article 6(1)(c): a food safety record has to show who made it |
| Kitchen phone PIN: a shared phone where each person records under their own name. The PIN is stored only as a scrambled (hashed) value, never as the PIN itself | Setting up the kitchen phone | Legitimate interests, Article 6(1)(f) |
| Notes managers type about records | Notes and corrections | Legitimate interests, Article 6(1)(f). What's typed in a note box is the business's responsibility |
Not held: location or GPS, National Insurance numbers, bank details, pay or salary. The only health information is in the fitness to work records (section 3.5), incident records (section 3.3), food complaints (section 3.4) and, if staff write about it, managero HR & Safety (section 3.12).
3.3 Incidents and injuries: health information
An incident report can hold: the injured person's name; whether they're staff, a customer, a contractor or a delivery driver; their organisation and contact details; what happened; a description of the injury; what treatment was given and by whom; witnesses and their contact details; photos of the scene; whether a RIDDOR reminder was shown; a countersignature with its signature record; and any later corrections.
A description of an injury and its treatment is health information, which the UK GDPR calls special category data (Article 9(1)). A business needs one of the conditions in Article 9(2) as well as a reason from Article 6. The ones normally used:
- The injured person works for the business: Article 9(2)(b) (employment law), with Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018. The duties are reporting certain injuries under RIDDOR 2013 and keeping an accident book under the Social Security (Claims and Payments) Regulations 1979. A business relying on this needs an Appropriate Policy Document (Schedule 1, Part 4). That's the business's document, not ours.
- The injured person doesn't work there (a customer, a driver, a contractor): Article 9(2)(f), records kept because a legal claim may follow, with legitimate interests, Article 6(1)(f).
- In an emergency, Article 9(2)(c), vital interests, may apply when the person can't consent, for example when their emergency contact is used. Not for keeping the record afterwards.
Consent isn't relied on: staff can't freely refuse their employer, and a record that vanishes when consent is withdrawn isn't a record. The business chooses these conditions, not us.
Who can read it: the account owner and people given the permission to. Incident records are kept out of ordinary staff views and out of the summary emails, and a download that includes them carries a warning. The countersigning link shows the injured person only what they need to sign.
3.4 Customer complaints about food
Any member of staff can write down a customer's complaint about food: the kind of complaint (illness after eating, something found in food, an allergic reaction, undercooked food or something else), when and how it came in, the meal and dish, a short description, photos if any, and, only if the customer wants a reply, their name, phone number and email. Managers then record what they checked and did, the reply, and whether the local authority was told. Why: to deal with the complaint and show how complaints are handled; normally legitimate interests, Article 6(1)(f). For illness or an allergic reaction, the description is health information, and the condition normally used is Article 9(2)(f), legal claims. The business chooses. Who can read it: the account owner and managers with the Report incidents permission. The person who wrote it down can't read it back. Downloads and share links list complaints without the customer's name, contact details or photos. How long: kept with the food safety records (section 6).
3.5 Fitness to work: sickness, exclusion and the questionnaire
Food handlers must report diarrhoea, vomiting and some infections, and a business must keep anyone who might contaminate food away from it. managero records: a member of staff saying they're unwell, by picking a category (diarrhoea and/or vomiting, another infection, a skin infection or wound, or another illness), never a description; a manager's decision to exclude them or let them work with checks, and their return, with the checks made and who cleared them; and a fitness to work questionnaire (four yes or no answers, the date, the person's signature and the manager's signed review), filled in before a first shift, when a manager asks, or on return after illness. There's no free-text box for medical detail. If any answer is yes, the managers at that site get an email naming the person and the site and asking them to speak to them before their shift, with no answers in it.
This is health information. Why: the food hygiene duty to keep someone who may contaminate food away from it (Regulation (EC) No 852/2004 as kept in UK law, Annex II, Chapter VIII). Normally legal obligation, Article 6(1)(c), with Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018, which needs an Appropriate Policy Document. The business chooses. Who can read it: the person it's about, the account owner and managers with the Manage fitness to work permission at that site. Everyone else sees only how many people are excluded, with no names. Questionnaire answers are never in a download, a CSV or a share link. How long: can't be edited or deleted once signed; kept with the food safety records (section 6).
3.6 On your device
- Photos waiting to upload, kept in your browser until they reach us, so recording works in a walk-in with no signal.
- Signing in and the site you picked, kept in your browser so you stay signed in.
- Google Analytics for Firebase, in the app (not on the website). It counts how the app is used and sets cookies in your browser to do it.
- The app's font comes from Google Fonts, so your browser asks Google's servers for it and Google sees your IP address.
- A concern's follow-up code, only if the person raising a concern ticks the box to keep it on that device (section 3.12).
- On the website: the partner-link cookie in section 3.10, and the referring site and campaign tags kept in your browser's session storage until you close the tab, so a question or walk-through request can say where you came from.
3.7 Visits to managero.co.uk
When a page on managero.co.uk loads, your browser tells us: the page, the domain of the site that linked to it (such as google.com, never the full link), any campaign tags in the address, and whether the screen is phone, tablet or desktop sized. Opening or sending a form and clicking Sign up or Sign in are counted the same way. Each count adds one to a daily total, and only the daily totals are kept, with no IP address or identifier. If you came from the QR code on one of our letters, the address carries a code for the business the letter went to, and the daily totals count visits for that code. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Why: legitimate interests, Article 6(1)(f), in knowing which pages are read and how people find the site.
3.8 managero news by email
If you tick "Send me occasional managero news and tips. Unsubscribe any time." on the website or when you create your account, we send you occasional emails with news and tips. Only people who ticked the box get them, and the box always starts unticked. We keep your email address, when and where you ticked it, and the words next to the box. Every email has a one-click Unsubscribe link, and an account owner can also turn it off in Settings. When you unsubscribe we keep your address on a list so we don't email you again. It doesn't stop the emails your account needs, such as invitations, alerts, password resets and billing. We don't track whether you open the emails or click a link. Why: your consent, Article 6(1)(a), as the Privacy and Electronic Communications Regulations require.
3.9 The mailing list on the app's sign-up page
Before sign-up opened, the sign-up page at https://app.managero.co.uk/signup offered a mailing list. If you joined it, we keep your email address, your name if you gave one, when you joined, and the sentence that was shown above the button: "We will email you once, when managero opens. Nothing else. Unsubscribe any time." We use your address for one email, to tell you managero has opened, and for nothing else. Joining it wasn't a yes to managero news (section 3.8), unless the sentence above the button also offered news and tips. Every email has a one-click Unsubscribe link. The email isn't tracked. Why: your consent, Article 6(1)(a).
3.10 Partner links
If you reach managero.co.uk through a partner's link (an address ending `?ref=` and their name), we keep that partner's name in a cookie called `mg_ref` and in your browser's local storage for 60 days, so that if you sign up we know which partner introduced you and can apply their offer at checkout. Nothing else is stored, it is not shared with the partner or anybody else, and it is not used to track you. If you sign up, the partner's name is kept with your account. Lawful basis: legitimate interests, Article 6(1)(f).
3.11 Campaign links
If you reach managero.co.uk or the managero app through a link carrying campaign tags (the `utm_` parts of an address, used in our adverts and emails) and then sign up, we keep the campaign's name, source and medium with your account so that we know which advert or email worked; they are not shared with anybody. Lawful basis: legitimate interests, Article 6(1)(f).
3.12 managero HR & Safety: concerns, the harassment log, policies and training
managero HR & Safety helps a business keep a record of the steps it takes on harassment and health and safety. Your business is the controller of all of it.
- Policies and risk assessments. The harassment policy, health and safety policy, risk assessments and fire records the business drafts and adopts, each version kept, and who has read and signed each policy, with the signature record in section 3.2.
- Training videos. For each person: which video and version, how far they watched, when they finished, their quiz answers and score, and their signature.
- Concerns (only if the business switches concern reporting on). A concern holds the site, what the person wrote, when and where it happened as they describe it, the date it was raised (a day, not a time), the people they chose to send it to, the messages back and forth, and whether it's open or closed.
- A concern with a name: the person's name and account are stored with it.
- A concern without a name: no name and no account id are stored with the concern or its messages. The person gets a follow-up code to read replies, and we store that code only as a scrambled (hashed) value. Google's request logs, which we use only to keep the service secure (section 4.1), record the IP address and browser of every request, including one that raises a concern. They aren't stored with the concern.
- The email about a concern: the people it's sent to get an email that says only "A new concern has been raised" and a link, with no name, site or words from the concern.
- Who can read a concern: only the people the person chose to send it to, while they still work at the business. The owner can't read a concern they weren't sent, and our own admin screens can't open one.
- The harassment log. A private record a business keeps of what happened, when, at which site, whether a customer or other outsider was involved, the people involved as the writer describes them, what was done about it, and whether it's open or closed. Every change is kept with who made it, and actions are added, never edited. Who can read an entry: only the people named as its readers, and only while they still have the Keep the harassment log permission at that site (an owner named as a reader always can). Our own admin screens can't open the log.
Sensitive information. Concerns and log entries may describe allegations of crimes (Article 10 of the UK GDPR) and special category information such as someone's sex life, health, race or religion (Article 9). The business chooses the reasons it relies on, as for incidents (section 3.3): normally Article 6(1)(c) or (f), with Article 9(2)(b) or (f), and for allegations of crimes a condition in Schedule 1 of the Data Protection Act 2018, with an Appropriate Policy Document.
How long.
- A closed concern is deleted automatically after the period the business picks: 6, 12, 24, 36 or 72 months after it was closed (24 unless the business changes it). An open concern isn't deleted. The people it was sent to can also delete a closed concern sooner.
- A closed harassment log entry is flagged to its readers for review after the period the business picks: 1, 2, 3 or 6 years after it was closed (6 unless changed). Nothing is deleted automatically, because an entry may be needed for a claim. Its readers can delete a closed entry.
- Policy signatures and training records can't be edited once signed and are kept with the food safety records (section 6).
3.13 Questions and walk-through requests
If you send a question through the website, we keep your name, email address, your question, the page you sent it from, the site that referred you and any campaign tags, and whether you ticked the box for managero news. If you ask for a 15-minute walk-through, we keep your name, your business, your email address, the two times or days you gave, and your note if you wrote one. Each is emailed to us (questions to hello@managero.co.uk, walk-through requests to toby@managero.co.uk) so we can reply. To stop the forms being abused, a hidden box catches automated posts, and a scrambled (hashed) form of your IP address is used to limit how many messages one connection can send in ten minutes. Why: legitimate interests, Article 6(1)(f), in answering you. How long: there's no automatic deletion of these yet. Write to hello@managero.co.uk and we delete yours.
3.14 If we wrote to you or emailed you first
We contact food businesses that might find managero useful, by letter and by email. The details come from public sources:
- Food hygiene ratings published by the Food Standards Agency on its ratings website: the business name, address, type of business, rating and inspection date.
- The Companies House register: whether the business is an active limited company or LLP, its registered office, and, for some emails, the first name of a person with significant control of the company, used in the greeting.
- The business's own website, for a published business email address. We don't guess addresses.
We email only limited companies and LLPs, at a published business address. A sole trader or partnership gets a letter, not an email. We keep the business name, address, email address where there is one, the details above, when we contacted you, how, and any reply. Why: legitimate interests, Article 6(1)(f), in telling food businesses about a product that may help them. To stop: reply "stop" to any email, or write to hello@managero.co.uk, and we won't contact you again. We keep your address on a list so that we don't. You can also object at any time (section 7).
3.15 Welcome letters and codes
A letter may carry a welcome code and a QR code. If you sign up with the code, it's kept with your account, linked to the letter it came from. The QR code's address tells us which business the letter went to when the page is opened (section 3.7). Why: legitimate interests, Article 6(1)(f), in knowing which letters work.
3.16 If you sell managero for us
If you're one of our sales agents, we keep your name, contact details, your signed agreement and its signature record, the businesses you contacted and signed up, and your commission. Why: our contract with you, Article 6(1)(b), and tax law, Article 6(1)(c). Your sales login shows you only the businesses you signed up (business name, the owner's first name and email, sign-up date, trial and setup progress, and whether they subscribed) and the shared list of businesses already contacted, so nobody is contacted twice.
3.17 Welcome letter codes
Some new food businesses get a welcome letter from us in the post, with a QR code and a short code printed on it. When the welcome page for that code is opened, we record that the code was opened, when it was first and last opened, and how many times. We do not record anything about the device or the person who opened it. If the business then signs up with the code, the code is kept with its account. This tells us which letters reached someone. Lawful basis: legitimate interests, Article 6(1)(f).
4. Who we share it with
We don't sell personal information. We don't send any business's records to any authority. A business's records leave its account only when someone in the business downloads them, emails them, switches on a share link (which they can switch off), or publishes its allergen page.
4.1 Google (Firebase and Google Cloud): where everything is kept
Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Firebase Hosting. Everything in section 3 is stored on Google's infrastructure, and there's no other database. Firebase Authentication also sends the email that checks your email address. Google's request logs record the IP address and browser of each request to the service; we use them only to keep it secure and working.
4.2 Google (Gemini, via the Google AI Studio API): reading what you upload
When someone in your business uses one of the features below, the file, or the text taken from it, is sent to Google's Gemini API at generativelanguage.googleapis.com to be read.
| Feature | What is sent to Google |
|---|---|
| Form import: a paper form made into a form in the app | A photo, PDF or Word document of the form |
| Menu import | A photo, PDF or Word document of the menu |
| Recipe import | A photo, PDF or Word document of your recipes. A spreadsheet (CSV or Excel) is read on your device and is not sent |
| Staff list import | A photo, PDF or Word document of a staff list or rota, with the names, email addresses and any other details on it. A typed list or a CSV is read on your device and is not sent |
| Paper records: typing up the records you kept on paper before managero | A photo or PDF of the sheets, with the names, initials and signatures on them |
| Temperature sheet transcribed from Camera Upload | The photo of the sheet |
| Invoice import, in ingredient pricing | A photo of a supplier invoice or delivery note, or a scanned PDF with no text in it. A PDF that has text in it is read without Gemini and is not sent |
| Risk assessment import | A photo, PDF or Word document of the risk assessment |
| Bulk upload: the sorting step | Any file whose name and type do not show what it is, for example "scan0142.pdf". That file can be anything in the folder, including a staff document. A file whose name points to health, an injury or someone's identity is not sent for sorting. Once sorted, a file may be sent again by the matching import above |
- What you upload is sent as it is, including any names, signatures, handwriting or other personal information on it. A photo or PDF is sent whole. For a Word document, only the text is sent.
- It happens only when someone uses one of these features, never in the background.
- What comes back is a draft for someone in your business to check. Nothing is saved from it until they confirm it. The import is told never to produce allergen information.
- The uploaded file stays in your own area of storage. An invoice isn't kept unless the person ticks "Keep this invoice".
- We use Google's paid service for these features.
A sheet filed under Camera Upload is kept as a photo and isn't read or sent to any model, unless you choose to transcribe a temperature sheet (above), where every value read is shown beside the photo for a person to confirm. If you'd rather a document with personal information on it didn't go to Google, file it under Camera Upload.
4.3 Domeneshop: email
Domeneshop, in Norway, sends managero's emails and hosts our mailboxes (hello@, toby@, support@ and no-reply@managero.co.uk). It receives each recipient's address and the content of the email. That includes invitations (which name the business, who invited you, your sites and any forms waiting), alerts and summaries, setup and trial emails, password resets, payment emails, the copy of your records on cancelling, managero news, the concern email in section 3.12, the fitness to work email in section 3.5, the questions and walk-through requests in section 3.13, and the emails in section 3.14. When an email can't be delivered, the bounce comes back to no-reply@managero.co.uk, and we keep the address and the reason so we stop sending to it.
4.4 Stripe: payments
Subscriptions are paid through Stripe Payments UK Ltd. Stripe receives your name, email address and card details, and holds the card: we never see or store a card number. You type it on Stripe's own page. From Stripe we get only what tells us whether your account is paid: a customer id, a subscription id, the status, the amount, the renewal date and whether a payment failed. Stripe is a controller in its own right for fraud prevention and its own legal duties, and our processor for the rest. Its privacy policy is at https://stripe.com/gb/privacy. No staff record, food safety record or incident report goes to Stripe.
4.5 Google Analytics and Google Fonts (the app only)
See section 3.6. Google receives your IP address, browser details and how the app is used. It receives no record you make in managero.
4.6 Letters
When we post letters, the postcode of each address is sent to postcodes.io, a free postcode lookup, to place it on our own map. If a printing and posting service sends a letter for us, it receives the name and address on the letter.
4.7 Who at Managero Software Limited can see what
Access to the live system is limited to named people at the company, bound by confidentiality. Our own admin screens show account details (names, email addresses, businesses, sites, staff lists and billing), never the contents of a business's records. Sales agents see only what section 3.16 describes. Our admin screens can't open a concern or the harassment log.
The shop at shop.managero.co.uk isn't covered by this policy. Orders there go through the shop's own checkout.
5. Where it's kept, and transfers out of the UK
Your records are kept in the United Kingdom, in Google Cloud's London region (europe-west2): the database, and the uploaded files such as signatures, photos and documents. Both are kept in that one region only.
Some things are handled outside the UK:
- Google's Gemini API (section 4.2), only when someone uses one of those features.
- Stripe (section 4.4), for payments. It gets billing details, never a record.
- Domeneshop (section 4.3), in Norway, for email.
- Firebase Authentication, Firebase Hosting, Google Analytics and Google Fonts, which Google runs worldwide.
Norway is in the European Economic Area, which UK law treats as giving adequate protection. For the others, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which Google and Stripe include in their terms.
6. How long we keep it
| What | How long |
|---|---|
| Food safety and other records a business keeps: temperatures, checks, deliveries, signed forms, training, incidents, complaints, fitness to work, policy signatures | At least five years. Nothing deletes them automatically. Signed records can't be edited, and removing an item archives it |
| Concerns | Deleted automatically after the period the business picks (section 3.12) |
| The harassment log | Flagged for review after the period the business picks, and deleted only by its readers (section 3.12) |
| The account holder's name, email and billing | While you have an account, then as long as tax law needs, and for as long as your free read-only access lasts (section 8 of the Terms of Service) |
| Questions and walk-through requests | Until you ask us to delete them (section 3.13) |
| Businesses we contacted first | While we may contact you, then only what we need to keep you on our "don't contact" list |
| Unsubscribe, "stop" and bounce lists | Kept, so we don't contact you again |
| Website visit counts | Daily totals only, with nothing about you |
| Google's request logs | 30 days, unless Google Cloud's default changes |
Can you have it deleted? You have the right to have your personal information deleted (Article 17 of the UK GDPR), but it isn't absolute. How it works here:
- Food safety and compliance records are kept, not deleted on request. A business must keep them by law (food hygiene record keeping, RIDDOR, the accident book, working time). Article 17(3)(b) says the right to deletion doesn't apply where keeping something is needed to meet a legal duty. So a former member of staff can't have the fridge temperatures they recorded deleted.
- Your name stays on the records you made. The name, the time and the signature record are the record.
- Personal details that aren't part of a record can be deleted. Once someone has left, their date of birth, phone number and emergency contact aren't needed. On the business's written instruction we delete them and leave the records alone. So the answer to "can you delete me" is: most of you, yes; the records you made, no.
- Right-to-work document photos are deleted, on the business's instruction, after the period the law says to keep them.
- Photos where someone appears in the background are part of the evidence and are kept under point 1. A photo that caught something it shouldn't is deleted on the business's instruction.
- Your own account details are kept as the table says.
Apart from concerns, nothing in a business's account is deleted automatically, and the app has no delete button for records. Deletion under points 3 to 5 is done by us on the business's written instruction: write to hello@managero.co.uk. Where a former member of staff asks for their name to be taken off records the business must keep, we explain the position above, pass the request to the business, and tell the person they can complain to the Information Commissioner's Office.
7. Your rights
You can ask to see your information, have it corrected, have it deleted (section 6), limit how it's used, take a copy to use elsewhere, and object to how it's used, including to being contacted (section 3.14). Where we rely on your consent, you can withdraw it at any time. managero makes no automated decisions about people that have legal or similarly significant effects.
- If you work for a business that uses managero: ask your employer, who controls the records. If you write to hello@managero.co.uk, we reply, tell you which business holds your information, and pass your request to them.
- Anyone else: write to hello@managero.co.uk. We answer within one month.
Complaints. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You don't have to come to us first.
8. Security
- Each business's information is kept apart by security rules that Google's servers enforce, not the app in your browser.
- Signatures, evidence photos, uploaded documents and imports can't be changed or deleted once stored.
- Signed forms and quiz attempts can't be edited after signing. Corrections are added as new entries, so a change can be seen.
- Incident records, fitness to work records, concerns and the harassment log can be read only by the people sections 3.3, 3.5 and 3.12 describe.
- Firebase Authentication handles passwords. We never see them.
- The key for Google's Gemini service is kept on our servers, never in your browser.
- Access to the live system is limited to named people at the company, bound by confidentiality.
Breaches. If a breach affects information we hold for your business, we tell you without undue delay, so that you can meet your own 72-hour duty to the ICO. The detail is in clause 11 of the Data Processing Terms.
9. ICO registration and the data protection fee
Managero Software Limited is registered with the Information Commissioner's Office and pays the data protection fee. ICO registration number: ZC274948. You can check it on the ICO's register of fee payers: https://ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/
10. Changes
If we change this policy in a way that matters, we email account holders and update the version below. The current version is always at https://managero.co.uk/privacy.
Version: 5. Last updated: 2026-10-22.
Earlier versions: version 1, 2026-10-05; version 2, 2026-10-13; version 3, 2026-10-22; version 4, 2026-10-22.