Skip to content
WagePilot
Browse help topics

Plans, billing & data

Data, privacy & GDPR

Owner-only data-protection console: export everything, handle your team’s access and erasure requests, the retention notice, and closing your account.

Open in WagePilot

As the business, you are the data controller for your team’s information. WagePilot is built for UK GDPR with data minimisation from day one, and gives you a console, in Settings → Data & privacy, to meet your obligations: a full export, an inbox of worker requests, the retention notice, and account closure.

What WagePilot collects (the minimum needed to run and legally record work) versus what it never touches.

What is and isn’t collected

Location
Read once, only at the moment of clock-in/out, to confirm on-site. Never continuous, never background tracking.
Hours & pay
Clock events, breaks and rates: the records you’re legally required to keep anyway.
Identity photo
Only if you turn on the kiosk’s identity-photo option. Then the tablet takes one at clock-in and again at clock-out, stored against that entry.
Card details
Never stored by WagePilot: payments run through Stripe.

Export everything

  1. 01

    Open Data & privacy

    Go to Settings and find the Data & privacy card.

  2. 02

    Download organisation data

    Click Download organisation data. WagePilot builds a machine-readable JSON copy of everything your business holds and saves it as wagepilot-org-export-<date>.json.

Action requests from your team

Each pending worker request shows who asked, what for, and the buttons to fulfil, complete or reject it.

When a staff member downloads their data it’s self-service, but a deletion request comes to you as the controller. Pending requests appear under Requests from your team, each showing the person’s name, the type (Data download or Account deletion), the date, and any note they left. Empty inbox reads “No open data requests.”

The buttons on each request

Download & fulfil
On a data-download request: builds that person’s JSON export, downloads it for you to send on, and closes the request as completed in one action.
Review & erase
On a deletion request: opens that person’s profile, where you erase their personal identifiers. Disabled if the request isn’t linked to a current employee record.
Mark done
Closes the request as completed: use it once you’ve handled the request another way.
Reject
Declines the request (for example if it isn’t valid). It’s recorded as rejected.

How long records are kept

The How long we keep records section lists the statutory minimums that apply after someone leaves, so an erasure never quietly breaks a legal duty:

RecordMinimum
National Minimum Wage records (hours, pay, rates)6 years
Payroll / PAYE records3 years
Tips / tronc records3 years
Working time & break records2 years
Right-to-work check evidence2 years

Closing your account

  1. 01

    Open the Close account card

    At the bottom of Settings is a red Close account section. Click Close account & delete everything.

  2. 02

    Download the full records archive

    The dialog offers Download full records archive: a ZIP of spreadsheets covering employees, time entries, breaks, edits and audit log, correction requests, leave, pay rate history, payroll figures by pay period, pay period closes, tips and a documents index. You must keep pay and working time records for 6 years after you close, and WagePilot cannot recover anything afterwards.

  3. 03

    Confirm you have kept your records

    Tick I have downloaded my records and understand I must keep them for 6 years.

  4. 04

    Type your organisation name

    The Delete everything button stays disabled until the box is ticked and you type your exact business name. This is deliberate friction.

  5. 05

    Confirm

    Deleting erases your business, team, rotas, timesheets and history for everyone and signs you out immediately. Your team loses access at once.

Common questions

Where is my data stored, and can I export or delete it?
Your data is stored securely with encryption in transit and at rest, hosted in the EU/UK region. You own your data: download a full JSON export of your organisation any time from Settings → Data & privacy, action individual worker download/deletion requests there, and close the account entirely (typing your business name to confirm). Billing is handled by Stripe; we never store full card details.
A staff member asked me to delete their data. What do I do?
Their request appears under Requests from your team in Settings → Data & privacy. Click Review & erase to open their profile and remove their personal identifiers, then the request is closed. Certain de-identified pay records must be kept by law for up to six years, so those are retained without their personal details rather than deleted.