Resources

Get Help

Hospitality staff at work

GDPR Fair Processing Notice

Flok Jobs Ltd

Effective Date: 1 February 2026

Introduction

This Fair Processing Notice explains how Flok Jobs Ltd ("Flok Jobs", "we", "us", "our") collects, uses, stores, and protects your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

This notice applies to:

Purpose of this Notice:

This notice fulfills our legal obligation to inform you about how we process your personal data and to ensure you understand your rights under UK data protection law.

1. Who We Are

Data Controller: Flok Jobs Ltd

Flok Jobs Ltd operates as a recruitment and staffing platform connecting employers with hospitality workers across the United Kingdom.

Contact Details:

Address: 128 City Road, London, United Kingdom, EC1V 2NX

Email: support@flokjobs.com

Website: www.flokjobs.com

Data Protection Officer Contact: support@flokjobs.com

Company Registration Number: [Insert if applicable]

ICO Registration Number: [Insert when registered]

As the data controller, we determine how and why your personal data is processed. We are responsible for ensuring that our processing complies with data protection law.

2. Personal Data We Collect

We collect only the personal data necessary to provide our services, comply with legal obligations, and operate our platform effectively.

From Workers:

Identity & Contact Information:

Emergency Contacts:

Right to Work Documentation:

Professional Information:

Financial Information:

Profile & Preferences:

Compliance & Performance Records:

Shift Activity Data:

Communication Data:

From Employers:

Business & Contact Information:

Business Verification:

Financial Information:

Booking & Engagement Records:

Job Information:

Communication Data:

Automatically Collected Data:

Device & Technical Information:

Usage Data:

Cookies & Tracking Technologies:

For detailed information about specific cookies, their purposes, retention periods, and how to manage your preferences, please see our Cookie Policy.

3. Purposes of Processing

We process your personal data for the following specific purposes:

Core Service Provision

Platform Access & Management:

Matching & Booking:

Identity & Eligibility Verification:

Payment Processing:

Communication Facilitation:

Compliance & Quality Management

Legal & Regulatory Compliance:

Quality Assurance & Conduct Monitoring:

Dispute Resolution:

Business Operations & Improvement

Service Improvement & Analytics:

Security & Fraud Prevention:

Marketing & Communications:

Personalisation:

4. Lawful Basis for Processing

We process your personal data only when we have a lawful basis to do so under UK GDPR. The specific lawful basis depends on the purpose of processing:

Contract (Article 6(1)(b))

We process your data to perform our contract with you and deliver the services you've requested:

What this means: This processing is necessary for us to provide the service you signed up for. Without this processing, we cannot deliver our core platform functionality.

Legal Obligation (Article 6(1)(c))

We process your data to comply with legal obligations imposed by UK and EU law:

What this means: These are legal requirements we must follow. We have no discretion - the law requires us to process this data.

Legitimate Interests (Article 6(1)(f))

We process your data for our legitimate business interests, provided these interests do not override your rights and freedoms:

Our Legitimate Interests Include:

Balancing Test: We have carefully assessed that these interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests - see Section 8 for details.

Consent (Article 6(1)(a))

We rely on your explicit consent for:

Your Consent Rights:

5. Data Sharing & Recipients

We share your personal data only when necessary to deliver our services, comply with legal obligations, or with your consent.

Who We Share With & Why:

Workers & Employers (Platform Matching):

If you are a Worker:

If you are an Employer:

Payment Service Providers:

We share: Name, bank account details, payment amounts, transaction dates, and payment status

Government & Regulatory Authorities:

HMRC (Her Majesty's Revenue and Customs):

We share: Name, National Insurance number, UTR, earnings, tax deductions, employment dates

Home Office:

We share: Name, passport details, visa information, work authorization status, right-to-work check results

Employment Tribunal Service: (if disputes arise)

We share: Employment records, contracts, correspondence, dispute details

Technology & Infrastructure Providers:

Analytics & Monitoring:

Business Support Services:

Accounting & Financial Services:

Legal & Compliance:

Legal Advisors: For legal advice, contract review, and dispute resolution Compliance Consultants: For regulatory compliance, audits, and policy development Insurance Providers: For professional indemnity and liability insurance

Law Enforcement & Courts: When legally required, we may disclose data to:

Data Sharing Safeguards

All third-party recipients are subject to:

✓ Data Processing Agreements (DPAs) compliant with UK GDPR Article 28

✓ Strict confidentiality obligations and security requirements

✓ Purpose limitation - they can only use data for specified purposes

✓ Regular security audits and compliance assessments

✓ Incident notification requirements for data breaches

✓ Data minimization - we share only necessary data

We do not:

6. International Data Transfers

We primarily store and process data within the United Kingdom and European Economic Area (EEA) using UK and Ireland-based data centers.

When International Transfers Occur:

Some service providers may transfer your data outside the UK/EEA. When this happens, we ensure your data is protected by appropriate safeguards:

Transfers to the United States:

Google Analytics:

Stripe (Payment Processing):

AWS (Some Services):

Other Potential Transfers:

Safeguards We Implement:

Standard Contractual Clauses (SCCs):

UK-approved model clauses that legally bind recipients to protect your data to UK GDPR standards

Adequacy Decisions:

Transfers to countries recognized by the UK ICO as providing adequate data protection (e.g., EEA countries, Switzerland)

Supplementary Security Measures:

Explicit Consent (where applicable):

For certain optional transfers, we may seek your explicit consent

Your Right to Information:

For specific details about where your data is transferred and the safeguards in place, contact us at support@flokjobs.com.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this notice, or as required by law.

Retention Periods by Data Category:

Active Account Data:

Worker Employment Records:

Employer Booking Records:

Payment & Financial Records:

Right-to-Work Verification Records:

Dispute & Complaint Records:

Communication & Message Data:

Marketing Consent & Communications:

Analytics & Cookies:

Security & Fraud Prevention Logs:

What Happens After Retention Periods:

Secure Deletion:

Anonymization:

Extended Retention (Exceptions): Data may be retained longer than standard periods if:

Account Closure & Data Deletion:

When you close your account:

8. Your Data Rights

You have the following rights under UK GDPR and the Data Protection Act 2018. We are committed to facilitating the exercise of these rights.

1. Right to Be Informed

What it means: You have the right to clear, transparent information about how we process your personal data.

How we fulfill this: This Fair Processing Notice, our Privacy Policy, and other transparency documents

Your action: Review this notice and contact us with any questions

2. Right of Access (Subject Access Request - SAR)

What it means: You can request a copy of your personal data and information about how we process it.

What you'll receive:

How to request:

Response time: 30 calendar days (may be extended by 60 days for complex requests with notice)

Cost: Free (except for manifestly unfounded or excessive requests)

3. Right to Rectification

What it means: You can request correction of inaccurate, incomplete, or outdated data.

Examples:

How to request:

Response time: 30 calendar days (we'll correct data within this period or explain why we cannot)

What happens next: We will notify third parties (e.g., employers who received inaccurate data) where appropriate

4. Right to Erasure ('Right to be Forgotten')

What it means: You can request deletion of your personal data in certain circumstances.

When this applies:

When we cannot delete your data:

How to request:

Response time: 30 calendar days

What we'll do:

5. Right to Restrict Processing

What it means: You can request that we limit how we use your data while we consider another request or resolve a dispute.

When this applies:

Effect of restriction:

How to request: Email support@flokjobs.com with "Restriction Request" and the reason

Response time: 30 calendar days

6. Right to Data Portability

What it means: You can obtain your personal data in a machine-readable format and request we transfer it to another service provider.

What you'll receive:

What's included:

Not included:

How to request:

Response time: 30 calendar days

Cost: Free

7. Right to Object

What it means: You can object to certain types of processing.

Processing you can object to:

a) Direct Marketing:

b) Processing for Legitimate Interests:

c) Profiling and Automated Decision-Making:

How to object:

Response time:

8. Right to Withdraw Consent

What it means: Where processing is based on consent, you can withdraw it at any time.

What this affects:

How to withdraw:

Effect:

9. Rights Relating to Automated Decision-Making

What it means: You have rights regarding automated decisions that significantly affect you, including the right to human review.

See Section 9 for full details on automated decision-making and your rights.

How to Exercise Your Rights:

Contact Us:

What to Include:

Our Response Process:

  1. Acknowledgment: Within 5 working days
  2. ID Verification: We may request identification to protect your data
  3. Assessment: We'll assess your request and verify our obligations
  4. Response: Within 30 calendar days (or 90 days for complex requests with notification)
  5. Appeal: If you're unhappy with our response, you can complain to the ICO (see Section 10)

No Fee (Usually):

9. Automated Decision-Making & Profiling

We use automated systems, including algorithms and artificial intelligence, to process data and make decisions that may affect you.

What Automated Decision-Making We Use:

1. Worker-Shift Matching Algorithm

Purpose: Match workers with suitable shifts based on compatibility factors

How it works:

Data used:

Impact on you:

2. Fraud Detection & Risk Scoring

Purpose: Identify potentially fraudulent accounts or suspicious activity

How it works:

Data used:

Impact on you:

3. Performance & Rating Systems

Purpose: Calculate performance scores and reliability ratings

How it works:

Data used:

Impact on you:

4. Pricing & Fee Optimization

Purpose: Determine platform fees and suggested hourly rates

How it works:

Data used:

Impact on you:

Your Rights Regarding Automated Decisions:

1. Right to Information: You have the right to know:

2. Right to Human Review: You can request that a human reviews any automated decision that significantly affects you.

What constitutes "significant effect":

How to request human review:

Include:

Our Process:

  1. Acknowledgment: Within 5 working days
  2. Human Review: A trained staff member will review the decision within 10 working days
  3. Investigation: We'll examine the data, algorithm output, and your circumstances
  4. Decision: We'll either uphold, modify, or reverse the automated decision
  5. Explanation: We'll provide clear reasoning for our decision
  6. Appeal: If you're still dissatisfied, you can escalate to our Data Protection Officer or the ICO

3. Right to Contest the Decision: You can challenge the accuracy of data used in automated decisions and provide additional context that wasn't considered by the algorithm.

4. Right to Explanation: You can request a detailed explanation of:

Safeguards We Implement:

To ensure fairness and accuracy in automated decision-making:

✓ Regular Algorithm Audits: We review algorithms for bias and accuracy

✓ Human Oversight: Critical decisions have human review checkpoints

✓ Data Quality Checks: We ensure data used is accurate and up-to-date

✓ Transparency: We document and explain algorithmic logic

✓ Bias Testing: We test for discriminatory outcomes based on protected characteristics

✓ Appeal Mechanisms: Clear processes for challenging decisions

10. Your Right to Complain

If you believe we have not handled your personal data properly or have violated your data protection rights, you have the right to complain.

Step 1: Contact Us First

We encourage you to raise concerns with us directly so we can resolve them quickly.

How to Complain:

What to Include:

Our Response Process:

  1. Acknowledgment: Within 5 working days
  2. Investigation: We'll thoroughly investigate your complaint
  3. Response: Within 30 calendar days, we'll provide:
    • Our findings
    • Actions we've taken or will take
    • Explanation of our decision
    • Your right to escalate to the ICO
  4. Follow-up: We may contact you for additional information during the investigation

Step 2: Escalate to the Information Commissioner's Office (ICO)

If you're not satisfied with our response, or prefer to contact the regulator directly, you can lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

ICO Contact Details:

What the ICO Can Do:

When to Contact the ICO:

Note: You can complain to the ICO at any time - you don't have to contact us first, though we encourage you to give us the opportunity to resolve your concerns.

11. Updates to This Notice

We may update this Fair Processing Notice periodically to reflect changes in our data practices, legal requirements, technology, or business operations.

When We Update:

Routine Updates (Minor Changes):

How we notify you:

Significant Updates (Material Changes):

How we notify you:

Version History:

Previous versions of this notice are available upon request at support@flokjobs.com.

Your Acceptance:

Continued use of our services after the effective date of an updated notice constitutes acceptance of the changes.

If you don't agree with updates:

12. Contact Information & Version Control

Contact Us:

For questions, concerns, or requests regarding this Fair Processing Notice or our data practices:

Flok Jobs Ltd

General Inquiries:

Email: support@flokjobs.com

Website: www.flokjobs.com

Data Protection Officer:

Email: support@flokjobs.com

Post: 128 City Road, London, United Kingdom, EC1V 2NX

Data Subject Requests:

Email: support@flokjobs.com (with request type in subject line)

Complaints:

Email: support@flokjobs.com (Subject: "Data Protection Complaint")

Business Information:

Registered Company Name: Flok Jobs Ltd

Registered Address: 128 City Road, London, United Kingdom, EC1V 2NX

Company Registration Number: [Insert when registered]

ICO Registration Number: [Insert when registered]

Response Times:

Document Version Control:

Revision History:

Legal Compliance Statement

This Fair Processing Notice is designed to comply with:

✓ UK General Data Protection Regulation (UK GDPR)

✓ Data Protection Act 2018

✓ Privacy and Electronic Communications Regulations (PECR) 2003

✓ Human Rights Act 1998 (Article 8 - Right to Privacy)

✓ Relevant employment, tax, and immigration legislation

This notice is regularly reviewed and updated to maintain compliance with evolving legal requirements, regulatory guidance from the ICO, and industry best practices.

Independent Review: This notice has been prepared with reference to ICO guidance and legal standards as of the effective date.

© 2026 Flok Jobs Ltd. All rights reserved.

This notice was last reviewed on 22 January 2026 and will be reviewed again by 1 February 2027.