Privacy Policy. How SUMS handles personal information.

SUMS is a subscription-based hospitality operations management platform used by organisations, managers, employees and other authorised people. This Privacy Policy explains how personal information is handled across the SUMS website at my-sums.com, the SUMS web application, the SUMS iOS and Android applications, including companion applications, and associated SUMS services, enabled modules and integrations. These are referred to together as the Services.

This is one policy for the SUMS platform. The information processed depends on the Services your organisation enables, your role and permissions, and how you and your organisation use them. Describing a category of information or an available function does not mean that every organisation or every application collects it.

This policy applies to website visitors, prospective and current customer contacts, Administrators, Authorised Users, employees whose records are held in SUMS, and other people whose information is included in customer records. It includes young workers under 18. A Customer is an organisation or other business person contracting for the Services; an Administrator is someone appointed to manage its access or records; an Authorised User is someone it permits to use the Services, including an employee or authorised contractor. Customer Data means information and content provided by or for a Customer or generated from its use of the Services, including employment and operational records.

Your organisation should also provide its own employee, recruitment or other relevant privacy notice. That notice explains its decisions about collecting and using information in SUMS. This policy does not replace that notice, the customer agreement or any required data processing agreement. A privacy notice explains processing; reading or accepting it is not blanket consent to that processing.

SUMS is operated by Saif Patel, a sole trader trading as SUMS. References to SUMS, we, us and our mean Saif Patel trading as SUMS.

Our postal address is 11 Fairway, Preston, PR1 0EJ, United Kingdom. You can contact us for privacy enquiries, rights requests, complaints and support at support@my-sums.com. Please indicate if your enquiry concerns privacy and identify the relevant organisation or account without sending unnecessary confidential information.

SUMS has not appointed a data protection officer. Saif Patel is responsible for data protection at SUMS and deals with privacy enquiries using the contact details in section 2.2. SUMS currently provides the Services to organisations in the United Kingdom and has not appointed a representative in the European Union.

Customer-controlled information. A Customer normally decides why and how personal information about its workforce, sites, suppliers and operations is used. It is the controller of that information. SUMS normally acts as its processor, handling Customer Data on documented instructions to provide the Services, including storage, access management, reporting, technical support and deletion or return as agreed. Where the Customer acts for another controller, the relevant processing chain and responsibilities must be addressed in its agreement with SUMS.

An employer may use SUMS to manage staff records, rotas, time and attendance, employment documentation, incidents, performance or compliance. It remains responsible for deciding which records to create, who may see them, the legal grounds for processing, any necessary sensitive-data conditions and how long records should be kept. Using SUMS does not transfer those decisions to SUMS.

SUMS-controlled information. We act as an independent controller where we decide to use information for our own business purposes: managing enquiries and business relationships, administering our subscription and financial records, handling complaints and rights requests, protecting our own service and legal rights, and meeting our legal duties. Security and account information can also be processed on a Customer's behalf; the role depends on the particular purpose. Operational access to Customer Data does not by itself make SUMS its controller.

If you want to exercise rights over employer-controlled records, contact your employer or its privacy contact. If you contact SUMS, we will help identify the responsible organisation and assist it as appropriate. We do not independently decide to erase or amend its employment or operational records merely because a user asks us to do so. This does not prevent us complying with our own legal duties or processing a request concerning information for which we are the controller.

Account and access information can include your name, email address, profile information, password authentication records, verification and password-reset information, two-factor authentication information where used, organisation and site memberships, role, permissions, login sessions and API or connected-application authorisations. Authentication secrets should not be included in support messages or ordinary uploads.

Workforce and employment information, where the Customer uses the relevant functions, can include staff identifiers, contact and address details, date of birth, employment status, job and department, employment dates, work location, emergency contact information, National Insurance and tax information, right-to-work status and references, identity or immigration documents, pay rates, bank account details, and employment or HR documents. Bank and pay information supports employment administration; this does not mean SUMS independently provides banking or processes a full payroll for every Customer.

Scheduling, attendance and development records can include availability, rota assignments, shift changes, timesheets, breaks, absence and leave, approvals, time and pay calculations, recruitment or promotion applications, references, objectives, performance reviews, ratings, comments and supporting records. The Customer decides how these are used in employment decisions.

Operational information can include audit and checklist answers, scores, findings, follow-up actions, assignments, signatures or acknowledgements, food-safety and compliance records, maintenance or asset issues, and associated dates and actions. Incident reports may contain names and contact details of injured people or witnesses, accounts of events, injury and treatment details, first-aid records, investigation material and references to preserved evidence. Relevant records may concern staff, visitors, customers or other third parties.

Sales, purchasing, stock, supplier, financial and reporting records can include business contact details, invoice and delivery information, approvers, transaction references, comments and records of who created or changed entries. A business record can be personal information where it identifies someone, including a sole trader. Where connected order, delivery or review services supply them, Customer Data can also include guest contact or delivery details, order information, and public reviewer names and review content. The information received by an integration can be more detailed than the figures displayed in a report. Aggregate commercial figures are not necessarily personal information but can still be confidential Customer Data.

Uploaded content can include documents, photographs, scanned pages, evidence, correspondence and generated reports or exports. The content may identify people other than the uploader. Posts, comments, reactions, meeting records and actions can identify participants and other people mentioned in them; document assignments and acknowledgements can record who received, accessed or acknowledged material. Image and file metadata may contain dates, device information or location information embedded by the device or original file. Providing a photograph does not mean SUMS continuously tracks your location.

Technical and activity information can include IP addresses, browser and operating-system information, device or app version information supplied with requests, session identifiers, request and error records, security events, record changes, timestamps and actor details in audit or sensitive-record access logs. Logging differs between functions; this does not mean every action or every read is logged.

Communications and business records can include enquiries, support correspondence and attachments, complaint and rights-request records, customer and supplier contacts, subscription and invoice details, and payment-status or transaction information provided through the agreed billing arrangements. Customers pay by bank transfer against invoices that we prepare and send by email ourselves. We do not use a card payment or Direct Debit provider and do not receive card details. The providers that process personal information for us are listed in section 8.2.

Special category and criminal offence information. Health records, medical certificates, allergies, fitness-to-work notes, adjustments, sickness-related information and injury or treatment records may be processed where the Customer uses the relevant functions. Other special category information may appear in documents or evidence supplied by a Customer. Criminal allegation, offence or conviction information is subject to separate restrictions; free-text fields and uploads must not be used to collect it routinely without a lawful and necessary reason and appropriate safeguards.

Customers must identify both a general lawful basis and any additional condition required for special category information, and any authority or statutory condition required for criminal offence information. Employment, social protection, legal claims or other conditions may be relevant depending on the circumstances; they are not automatic permissions for every record. Customers should minimise sensitive information and restrict access appropriately.

Information may be provided directly by you, your employer or another Customer, its Administrators or other Authorised Users. It can also come from authorised imports or integrations, people supplying references or incident evidence, and records created as you use the Services. Technical information is generated through requests, sessions, security and operational systems.

The Customer is responsible for telling people when it obtains information about them from another source and for checking that the source may lawfully provide it. An emergency contact, witness or supplier contact may have information in SUMS without having a SUMS account.

Some information is needed to establish an account, authenticate access, respond to a request or administer a subscription. If it is not supplied, the relevant access or service may not be possible. Optional profile information, evidence methods and device permissions depend on the function. Your organisation should explain any employment-related statutory or contractual requirement to provide information and the consequences of not providing it; SUMS does not impose a general obligation to provide every available field.

When processing Customer Data on instructions, we provide the enabled Services: making information available to permitted users; supporting workforce and site workflows; storing and synchronising records; calculating configured schedules, totals and scores; producing reports and exports; delivering service communications; supporting integrations; troubleshooting; and maintaining appropriate operational and security records. The Customer identifies the relevant lawful bases and sensitive-data conditions. Our processor role is governed by the applicable data processing terms rather than a separate blanket consent from employees.

Where SUMS acts as a controller, we use the following bases for the corresponding purposes:

1. (a)Business enquiries, demonstrations, customer relationship management and support: our legitimate interests in responding to people, providing a business service and resolving problems. If you contract with us personally, including as a sole trader, processing necessary to take requested pre-contract steps or perform that contract may instead be based on contract. An employee is not automatically personally party to the Customer's subscription contract.
2. (b)Subscription administration, invoicing and payment follow-up: contract where the individual is the contracting party; otherwise our legitimate interests in administering the Customer relationship and collecting sums properly due. Keeping accounting or tax records and responding to binding legal requirements is based on the relevant legal obligation.
3. (c)Protecting SUMS, investigating misuse, preventing unauthorised access and maintaining reliability: our legitimate interests in securing the platform, preventing harm and keeping it working, balanced against individuals' rights. Information processed solely to meet a Customer's security instructions remains subject to those instructions.
4. (d)Managing privacy enquiries, complaints and rights requests and complying with enforceable disclosure duties: compliance with the relevant legal obligation. Establishing, exercising or defending legal claims may also rely on our legitimate interests in protecting legal rights, subject to applicable safeguards.
5. (e)Understanding service faults and improving usability: our legitimate interests in maintaining and improving the business service, using information proportionately. A legitimate interest does not override a requirement for consent or another condition for storing or accessing information on a device.

Consent is used where the applicable processing genuinely depends on a freely given choice or the law requires it. A device permission authorises a device function; it is not a substitute for identifying a lawful basis for all subsequent processing. We do not rely on employee consent as a general basis for employment records.

We send occasional marketing emails about SUMS, such as product news and offers, to contacts at Customers and to people who have asked us for a demo or for information. We send them from our own Microsoft 365 email account, using the business contact details you gave us. For contacts at companies and other organisations, we rely on our legitimate interests in telling business customers and prospective customers about SUMS. For sole traders and partners, and wherever else the law requires it, we send marketing emails only with consent, or to existing customers about similar services where they were given the chance to refuse when we collected their details. Every marketing email tells you how to stop receiving them: reply "unsubscribe" or email support@my-sums.com and we will stop. Service messages, such as sign-in emails, reports and support replies, are not marketing. We do not use identifiable product analytics or advertising tracking on the website, in the web application or in the mobile applications.

Where we rely on legitimate interests, those interests are assessed against your rights and reasonable expectations, including the additional protection needed by young workers. If information is to be used for a materially different purpose, the responsible controller must assess lawfulness and provide additional information as required before that processing.

Access is structured around organisation, site, membership, role and permissions. Available functions apply access controls intended to limit records to authorised users. Your organisation appoints Administrators and is responsible for keeping permissions and employment access current. Some authorised management or group-level roles may have access across several sites or organisations where legitimately assigned; membership of one organisation does not automatically grant access to another.

Staff self-service access and management access differ. Particular HR, medical, bank or incident records can be subject to additional permissions or restricted access. Your employer should explain which people can see your information and which records are used in management decisions. A manager's ability to use a function does not remove the need for a lawful purpose.

SUMS may need access to relevant records to operate the Services, investigate a technical issue, respond to a security incident or provide authorised support. Such access must be limited to the purpose and the relevant instructions or legal duty. Do not place unnecessary employee or sensitive information in a support request.

Authorised users can create exports, download evidence or send reports where the enabled function permits this. Once a Customer shares an export, email or downloaded file, its recipient and storage arrangements also matter. The Customer remains responsible for ensuring that sharing is authorised, including when sending information outside its organisation.

Information may be processed by providers used for application hosting and network services, databases and file storage, delivery of email or other service messages, monitoring and technical support, and payment administration where applicable. AI processing and customer-connected services are addressed in section 15. Suppliers processing on our behalf are subject to the data protection arrangements applicable to their role, including confidentiality, security and instructions where required.

The providers that process personal information for us, and what they do, are:

1. (a)DigitalOcean: hosting for the SUMS application servers and databases.
2. (b)Cloudflare (R2): storage for uploaded files, documents and photographs.
3. (c)Microsoft (Microsoft 365): email, including service messages, support correspondence and marketing emails.
4. (d)OpenAI: AI-assisted report observations and related public research, where those functions are used (see section 15).
5. (e)Apify: collection of public Google reviews for sites where a Customer uses review monitoring.

We do not use a payment processor, or third-party analytics, advertising or crash-reporting services. Apple and Google distribute the mobile applications (see section 8.4), and Customer-authorised integrations are described in section 8.3. We will update this list when our providers change, and you can ask for the current list at support@my-sums.com.

Customer-authorised business relationships, such as ordering from a distribution centre or supplying another organisation, can share relevant order, delivery, invoice and contact information with the other participating business. Access remains subject to the permissions and relationship configured for that transaction; organisational separation does not mean that all cross-business sharing is prohibited. When a Customer or user authorises an integration or external application, relevant information can pass to or from that service within the authorised permissions. External providers may act as the Customer's processors or as separate controllers under their own terms and privacy information. Revoking access prevents future authorised connections as implemented; it does not by itself retrieve information already exported to the external service.

Apple and Google distribute the mobile applications and may separately process app-store account, download, purchase or platform diagnostic information under their own privacy notices. That does not mean SUMS receives every item of information they hold. Device-generated reports shared with SUMS, if any, must be included in the applicable diagnostic disclosures.

Information may be disclosed to professional advisers, insurers, regulators, courts or law-enforcement bodies where there is a lawful and proportionate reason. A proposed transfer of the SUMS business may involve necessary disclosures under appropriate confidentiality and data protection safeguards; affected people will be informed as required. These provisions do not authorise unrestricted disclosure of Customer Data contrary to the applicable processing instructions or law.

The SUMS application and its databases run on DigitalOcean servers in London, United Kingdom, and server backups are made and held by DigitalOcean. Uploaded files are stored with Cloudflare R2, which may store and serve them from locations outside the UK. Email is provided by Microsoft 365. OpenAI and Apify process the information described in sections 8.2 and 15 in their own facilities, which can be outside the UK, including in the United States and the European Union. Only Saif Patel has administrative access to the live systems, from the United Kingdom. Where personal information is transferred outside the UK, we rely on UK adequacy regulations, for example for the European Economic Area or for US organisations certified under the UK Extension to the EU-US Data Privacy Framework, or on the safeguards described in section 9.3.

A server location alone does not determine whether information is transferred internationally. Support access, supplier subprocessors, connected applications and AI services can also involve overseas processing. Before a restricted transfer, the responsible organisation must identify a permitted mechanism, such as applicable adequacy regulations or approved contractual safeguards, and complete any assessment and additional safeguards required by law.

For UK transfers, safeguards may include the UK International Data Transfer Agreement or the UK Addendum to approved EU standard contractual clauses. EU requirements, including EU standard contractual clauses where relevant, must be considered separately where EU GDPR applies. The applicable mechanism depends on the destination and recipient and must be documented for the relevant transfer. Contact support@my-sums.com to request information or a copy of relevant safeguards, with confidential or unrelated information removed as appropriate.

The application includes authentication, permission and membership checks, organisation and site scoping, and additional restrictions for selected sensitive functions. Selected workforce sensitive, medical and bank fields use application-level encryption. These measures do not mean that every field or every uploaded file is individually encrypted, that every record access is logged, or that access can never fail.

Users should protect credentials, use available account-security features, secure devices, sign out of shared devices and report suspected compromise to their organisation and support@my-sums.com. Downloaded files, shared reports and offline working copies require appropriate protection on the receiving device.

Connections to the website, web application and mobile applications are encrypted in transit using HTTPS. Bank details, National Insurance numbers, dates of birth, home addresses, emergency contacts and the credentials used for integrations are also encrypted by the application before they are stored. Passwords are stored as one-way hashes, two-factor authentication is available for accounts, and access within SUMS is limited by organisation, site, role and permission. Only Saif Patel has administrative access to the servers and databases. The servers are backed up automatically by DigitalOcean and backups are kept for up to four weeks. Application logs are kept for up to 14 days. If we become aware of a security incident, we investigate and contain it and make the notifications described in section 10.4.

No system or transmission method can guarantee absolute security. Where a personal data breach occurs, the responsible organisations must assess it and make any legally required notifications. As a processor, SUMS must notify the relevant controller without undue delay on becoming aware of a personal data breach and provide the assistance required by applicable law and processing terms.

Customer Data is retained to provide the Services for the Customer and in accordance with its lawful instructions, agreed processing terms and applicable legal requirements. A Customer’s binding agreement or data processing terms may specify its return, export and deletion arrangements; those arrangements must be read alongside this general policy. The Customer must set suitable periods for employment, health, pay, tax, incident, compliance and other records. Different records can have different requirements; retention of a former employee's records is not determined solely by whether that person can still sign in.

Historical records, audit trails, supporting evidence and generated exports may be needed to explain decisions, meet legal record-keeping duties or resolve disputes. A record being archived, hidden or marked deleted in a user interface does not necessarily mean it has been permanently erased from storage. Customer instructions and the retention procedure must address copies, attachments, exports and historical actor information as well as visible account records.

For information we control, the retention criteria are the purpose of the relationship or enquiry, the time needed to resolve support or complaints, statutory accounting or other record-keeping requirements, the need to investigate security incidents, and relevant legal claims or preservation duties. We retain only information needed for those purposes and restrict information retained for a legal duty or hold to that purpose.

Before a Customer's subscription ends, its Administrators can export its data using the export functions in SUMS, and during the following 90 days the Customer can ask us to restore temporary access to export anything it still needs. After 90 days we delete the Customer's data, including stored files, from the live systems, unless its agreement says otherwise or the law requires us to keep it, and backups containing that data expire within four weeks after that. During a subscription, the Customer decides how long to keep its records. User accounts that are disabled or no longer linked to an organisation remain until the Customer or the user asks us to delete them, or until the Customer's data is deleted. Demo requests sent through our website are deleted from SUMS after 90 days, and enquiries, support emails and demo requests in our mailbox are kept for up to one year from the last contact. Application logs are kept for up to 14 days. Our own invoices and accounting records are kept for as long as tax law requires, currently at least five years after the 31 January filing deadline for the tax year they relate to. Working copies saved on a device for offline use are covered in section 14.

Backups may follow a different deletion cycle from live systems. Any such delay, its maximum duration, restrictions on use and treatment after a restoration must form part of the confirmed arrangements above. Information cannot be kept indefinitely merely because storage is available.

Account access, an organisation's subscription and the personal information within employment or operational records are separate matters. An Administrator can manage organisational access; leaving employment or disabling that access does not automatically terminate the organisation's subscription or erase its records.

Accounts are deleted on request, as section 12.3 explains. Deleting a user account is not a command to remove every employer-controlled record relating to that person. Some historical or linked records may remain where the responsible controller has a lawful basis and retention requirement; conversely, retention of historical records is not a reason to keep unnecessary login credentials or unrelated personal information.

You can send an account or personal-information deletion request to support@my-sums.com, including after uninstalling a mobile application. Tell us which account and organisation are involved. We will verify identity and authority proportionately, identify the responsible controller and explain the request's outcome and any lawful grounds for retaining particular information. You do not have to use a statutory phrase or obtain your employer's permission to raise a rights request with SUMS.

The mobile applications do not create SUMS accounts: accounts are set up by SUMS or by a Customer's Administrator. Accounts are deleted only on request: to delete your account, email support@my-sums.com from the address linked to your account. There is no delete-account option in the web application or the mobile applications, and you can send the request after uninstalling an app. When we receive a request, we will confirm that it comes from you, tell the relevant Customer where its records are affected, and let you know what has been deleted and anything kept, with the reason. Deleting an account does not delete the employer-controlled records described in section 12.2.

Uninstalling an app or disconnecting an integration does not itself delete server-held records. Locally cached or exported copies may also need to be cleared or handled separately. A Customer ending its subscription should arrange authorised exports and return or deletion under its agreement and processing terms.

Depending on the applicable law and the processing, you may have rights to obtain information and a copy of your personal information; correct inaccurate or incomplete information; request erasure; restrict processing; and receive information you supplied in a portable format where the statutory conditions apply. Erasure and portability do not apply identically to every employment record or lawful basis. Information about other people, legal privileges and statutory exemptions may affect a response.

Your right to object. You may object to processing based on legitimate interests for reasons relating to your situation. The responsible controller must stop that processing unless it can demonstrate the legal grounds for continuing, including applicable grounds concerning legal claims. You can object at any time to use of your information for direct marketing, including related profiling, and that use must stop.

Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Contact us or use the relevant preference control. Device permissions can also be changed in your device settings, although that alone does not erase previously collected information or stop processing based on another lawful ground.

You also have applicable rights concerning solely automated decisions that have legal or similarly significant effects, including to obtain information, make representations, request meaningful human intervention and challenge a decision. The precise safeguards and conditions depend on the applicable law; UK and EU rules are not identical. Section 15 explains the automation in the Services.

For Customer-controlled information, contact the organisation's privacy contact or Administrator, or ask SUMS to help route the request. For information controlled by SUMS, contact support@my-sums.com or write to the address in section 2. If a request involves both, each controller must deal with its responsibilities. We may request proportionate information to identify you or clarify a request where permitted, without seeking unnecessary identity documents.

Rights requests are generally free and must be answered without undue delay, normally within one month under UK GDPR, subject to lawful extensions, clarification or identity-verification rules and applicable exceptions. If a request is refused or a fee is permitted by law, the responsible controller must explain the grounds and available complaint routes. Overseas laws may give additional rights or different response requirements.

The web application uses browser cookies and local or session storage for functions such as authenticated sessions, security and remembering selected appearance, navigation or working preferences. Offline audit functions can keep working records and evidence in browser or device storage so that work can be continued and synchronised. This can include personal or confidential Customer Data. Use a secure device and take particular care with shared devices and unsynchronised work.

The iOS and Android applications use secure device storage for authentication and local working storage for enabled functions. Audit drafts and associated evidence can remain on the device after sign-out or a change of workspace; signing out does not automatically erase that working material. Contact your Administrator or SUMS for help with supported removal procedures and take care not to remove unsynchronised work you need to retain. Camera or document-scanning and selected photo or file access support uploads when you choose those features. Permissions and available pickers differ by operating system and app. You can refuse or change permission in system settings; the corresponding capture or upload method may then be unavailable. Use any available alternative appropriate to the task.

A notification shown within SUMS is different from an operating-system push notification. If a particular app offers device notifications, its actual permission and provider arrangements must be disclosed and you can manage them through the controls provided by the app or device. We do not treat permission to receive service messages as consent to promotional marketing.

The public website at my-sums.com sets no cookies and uses no analytics or tracking. It stores only your choice of light or dark appearance in your browser. The web application uses the following:

1. (a)A session cookie, to keep you signed in. It ends when you sign out or after a period of inactivity.
2. (b)The XSRF-TOKEN cookie, which protects forms against cross-site request forgery, for the same period.
3. (c)A remember-me cookie, only if you choose to stay signed in, lasting up to 30 days.
4. (d)The appearance and sidebar_state cookies, and browser local storage, which remember your display preferences and layout.
5. (e)Browser storage (IndexedDB) for offline audits and draft stock counts, so work can continue without a connection.

These are needed for the service you have asked for or remember choices you make, so they do not require consent. We do not use analytics, advertising or tracking cookies. The mobile applications keep sign-in details in the device's secure storage and working data for enabled functions, as described in section 14.2. They ask for camera or photo access only when you choose to scan or upload a document or photo, and may ask to save files you export. They do not use location, push notifications, biometrics, analytics, advertising identifiers or crash-reporting services.

Storage or access needed for a communication or a service you request can fall within a legal exception to consent requirements. Other limited UK exceptions have specific conditions, including clear information and a simple free means of objecting where required. Technologies requiring consent must not be activated before that consent; changing preferences must be available. A device permission, a privacy notice or continued use is not by itself a valid substitute for a required consent mechanism.

Browser settings can restrict cookies and clear stored information, but doing so may interrupt sign-in, preferences or offline work. The practical controls and durations must be set out in the confirmed disclosures above. App-store privacy labels and Google Play Data safety information must reflect the actual app and third-party technologies; those disclosures supplement this policy.

Certain reporting functions can generate AI-assisted observations from organisation, brand and site trading figures, labour or purchasing totals, comparisons and anomaly information. Where enabled, AI-assisted reporting uses OpenAI's API. The submitted material can include Customer and site names, reporting dates and location context. Optional public research uses site and location/date briefs to obtain external context. Such information may identify a sole trader or otherwise include personal information even when it concerns a business.

These reporting functions are designed around commercial report evidence, rather than sending entire staff files, medical records or bank details to generate observations. This is not a representation that all available AI connections receive only anonymous data. SUMS retains report evidence and generated outputs as part of the reporting workflow. Provider-side retention and any provider use of submitted information are governed by the verified service arrangements described below.

The AI functions in use are the weekly report observations described in section 15.1, which use OpenAI's API, and the AI Connector described in section 15.4. For the weekly observations, SUMS sends OpenAI the report evidence for the organisation, brands and sites in the report: their names, dates and locations, trading, labour and purchasing figures, and comparisons. Staff names, contact details, staff files, medical records and bank details are not sent. Where public research is used, OpenAI's web search looks up site, location and date details to find external context such as local events or weather. Requests are made with OpenAI's storage option turned off. Under OpenAI's API terms, OpenAI does not use this information to train its models and may keep it for up to 30 days to check for abuse before deleting it. OpenAI may process it in the United States; section 9 describes the safeguards. SUMS keeps the evidence and the generated observations with the report for as long as the Customer keeps the report. With the AI Connector, the Customer or user chooses the AI assistant, such as ChatGPT or Claude, and what that assistant receives and keeps is governed by its provider's terms and the user's settings there.

Where a Customer or Authorised User connects an external AI assistant through an authorised integration, the assistant may receive information returned within the granted permissions, including relevant operational or workforce reports where access permits, and may be able to request limited changes through specifically authorised tools. The user and Customer should check the external provider's terms and privacy practices before connecting it. Permissions and connection authorisations should be reviewed and revoked when no longer needed; revocation does not erase copies already received by that provider.

SUMS also uses rules and calculations for functions such as rota proposals, totals, scores, pass/fail outcomes and workflow alerts. Rota generation can use deterministic scheduling rules rather than an external AI model. Automated calculation is not necessarily a solely automated decision with a significant effect on a person.

AI observations and proposed schedules require appropriate human review before business or employment action. The Customer remains responsible for decisions about its staff, including pay, performance, discipline and scheduling, and for accuracy, fairness and any required impact assessment. AI output can be incorrect or incomplete. If a Customer intends to use any function to make a solely automated significant decision, it must establish the applicable lawful conditions, give meaningful information about the logic, significance and likely consequences, and provide the required challenge and human-intervention safeguards. Special category information attracts additional restrictions. This policy does not authorise such decision-making merely because a function exists.

Employees under 18 can use SUMS where their organisation lawfully authorises access for employment, training or related operations. SUMS is a business service, but young workers' information and rights require particular care. We do not impose an adult-only condition through this policy or treat an employer's authorisation as blanket parental consent.

The Customer must ensure that the work, account access, permissions and information collected are appropriate for the young worker and comply with employment and data protection requirements. Information should be necessary, proportionate and explained in language the young person can understand. Customers should take particular care with health records, monitoring, performance information and automated outputs affecting young workers.

Young workers may contact SUMS directly about privacy or ask for an explanation they can understand. A parent or another representative may assist where the individual authorises this or the law permits, but does not automatically have unrestricted access to employment records. We will consider the young person's understanding, rights and circumstances when handling a request.

If you are concerned about processing controlled by your organisation, contact its privacy contact. You can also complain to SUMS at support@my-sums.com or by post to section 2's address. For complaints concerning processing we control, we will acknowledge receipt within 30 days, make appropriate enquiries without undue delay, keep you informed and tell you the outcome without undue delay. Where the concern relates to a Customer's processing, we will assist the responsible controller as appropriate.

You have the right to complain to the ICO, the UK's data protection regulator. Information about making a complaint is available at ico.org.uk/make-a-complaint. You do not lose that right by contacting SUMS or your employer, and you do not have to waive any other legal remedy. Where another country's data protection law applies, you may also have rights to complain to its supervisory authority, including the authority where you live or work in the EEA where EU GDPR applies.

This policy uses UK data protection terminology. It does not remove mandatory protections that apply to a Customer or individual in another jurisdiction. The relevant Customer must consider its local employment and data protection obligations, and SUMS must meet any directly applicable duties for its own processing.

We will review this policy as the Services, operating arrangements and applicable law change. The effective and revision dates will identify the current version. Material changes will be brought to affected people’s attention through the Services or another appropriate channel as required. A policy change does not by itself authorise a new use of information that otherwise requires consent, a lawful instruction or another legal condition.

For privacy enquiries, assistance or a copy of the current policy, contact support@my-sums.com or Saif Patel trading as SUMS, 11 Fairway, Preston, PR1 0EJ, United Kingdom.