Plans, billing & data
Data, privacy & GDPR
The owner’s data-protection console: export everything, action your team’s access and erasure requests, the statutory retention notice, and closing your account.
As the business, you are the data controller for your team’s information. WagePilot is built for UK GDPR with data minimisation from day one, and gives you a console — in Settings → Data & privacy — to meet your obligations: a full export, an inbox of worker requests, the retention notice, and account closure.
What is and isn’t collected
- Location
- Read once, only at the moment of clock-in/out, to confirm on-site. Never continuous, never background tracking.
- Hours & pay
- Clock events, breaks and rates — the records you’re legally required to keep anyway.
- Identity photo
- Only if you turn on the kiosk’s identity-photo option. Then the tablet takes one at clock-in and again at clock-out, stored against that entry.
- Card details
- Never stored by WagePilot — payments run through Stripe.
Export everything
- 1
Open Data & privacy
Go to Settings and find the Data & privacy card.
- 2
Download organisation data
Click Download organisation data. WagePilot builds a machine-readable JSON copy of everything your business holds and saves it as
wagepilot-org-export-<date>.json.
Action requests from your team
When a staff member downloads their data it’s self-service, but a deletion request comes to you as the controller. Pending requests appear under Requests from your team, each showing the person’s name, the type (Data download or Account deletion), the date, and any note they left. Empty inbox reads “No open data requests.”
The buttons on each request
- Download & fulfil
- On a data-download request: builds that person’s JSON export, downloads it for you to send on, and closes the request as completed in one action.
- Review & erase
- On a deletion request: opens that person’s profile, where you erase their personal identifiers. Disabled if the request isn’t linked to a current employee record.
- Mark done
- Closes the request as completed — use it once you’ve handled the request another way.
- Reject
- Declines the request (for example if it isn’t valid). It’s recorded as rejected.
How long records are kept
The How long we keep records section lists the statutory minimums that apply after someone leaves, so an erasure never quietly breaks a legal duty:
| Record | Minimum |
|---|---|
| National Minimum Wage records (hours, pay, rates) | 6 years |
| Payroll / PAYE records | 3 years |
| Tips / tronc records | 3 years |
| Working time & break records | 2 years |
| Right-to-work check evidence | 2 years |
Closing your account
- 1
Open the Close account card
Below Data & privacy is a red-bordered Close account card. Click Close account & delete everything.
- 2
Download a copy first
The dialog offers Download a copy first — the same full org export — because closure can’t be undone.
- 3
Type your organisation name
The Delete everything button stays disabled until you type your exact business name in the confirm field. This is deliberate friction.
- 4
Confirm
Deleting erases your business, team, rotas, timesheets and history for everyone, signs you out immediately, and returns you to the homepage. Your team loses access at once.