Privacy policy
Draft version: 26 September 2026
Pre-launch draft. The company behind Bevelty is not registered yet. The operator details and items marked [CHECK] must be completed before this becomes the final notice. This draft does not limit any privacy rights you already have.
Bevelty is developing a staffing service that connects businesses with workers and manages assignments, hours and related administration. This policy explains personal data use on our website and in its connected account, staffing and support services.
You can contact us about your data at info@bevelty.com. You do not need an account to make a privacy request.
1. Who is responsible for your data
A controller decides why and how personal data is used. The person or organisation operating Bevelty is the controller for its website, account administration, enquiries and its own staffing activity.
- Current operator and controller: [CHECK: full legal name of the person or persons responsible before incorporation, and their contact address].
- Company after incorporation: [CHECK: registered legal name, registered address, registration number and country. Do not use a proposed company name as proof of registration].
- Privacy contact: info@bevelty.com.
- EU/EEA representative and data protection officer: [CHECK: assess whether either appointment is required and add the appointed contact details, if applicable].
The business plan proposes incorporation in Monaco. The final operating countries have not been confirmed. Where the EU General Data Protection Regulation (GDPR) applies, this policy must be read with its requirements and the applicable national rules. Monaco operations must also meet Monaco Law No. 1.565 of 3 December 2024 where it applies. Monaco is outside the EU and EEA.
When an agency uses the software
The planned agency service has a different allocation of responsibilities. The employing agency is normally the controller for its recruitment, assignments, employment and payroll records. Bevelty may process those records on the agency's instructions under a separate data processing agreement.
Bevelty remains responsible for processing it determines itself, such as its own security and business administration. The relevant agency and any additional privacy notice must be identified before you use that service. This policy does not replace the agency's notice or a data processing agreement.
2. Information we collect
The information depends on the service you use.
- Visitors and enquiries: contact name, company, email address and the message you send, together with technical information needed to serve and protect the website.
- Accounts: name, email, phone number where provided, account role, verification status, password hash, account changes and notification preferences. Session records can include IP address, browser information and sign-in times.
- Terms acknowledgment: the account identifier, account type, confirmation time and exact version of the draft terms you confirm during registration or invitation acceptance. We retain the associated terms text as evidence of what was displayed. This acknowledgment is not consent to personal-data processing, marketing or tracking.
- Business contacts: organisation and legal-company details, registration and tax identifiers, workplace addresses, contact people, team roles, invitations, billing recipients, bank details and supporting documents. Business records can contain personal data about representatives and sole traders.
- Worker profiles and onboarding: name, contact and postal details, profile photo, introduction, work history, skills, languages, IBAN and identity-document images. Identity images can include a passport photo page or the front and back of an identity card. Submission records preserve the details sent for review.
- Assignments and work records: applications, selections, bookings, workplace and shift details, reported and approved hours, corrections, ratings, endorsements, TrustPool membership, attendance issues, strikes, disputes and associated financial records.
- Support and security: correspondence, reports, relevant account activity, access records and diagnostic information about errors and service performance.
Before paid employment begins, the responsible employer may need additional information such as date of birth, work permission, social-security or tax details, pay records and bank account-holder information. The employer must explain that collection in the relevant employment notice. A prototype field or feature does not mean that payroll or a payment service is already operating.
Sensitive information
Identity documents and bank details need particular care. A photograph is not automatically biometric data under GDPR; the current identity review does not use facial recognition or create biometric identification templates.
Do not put health details, criminal records or unrelated sensitive information into profiles, enquiries or free-text reviews. If an employment or incident process requires health or other specially protected data, the responsible controller must first explain the purpose, recipients and applicable legal condition, including GDPR Article 9 or 10 where relevant.
[CHECK] Confirm the necessity of each onboarding field and identity copy in the launch country, the lawful conditions for sensitive employment information, and any required impact assessment.
3. Where information comes from
Most information comes from you. Other information comes from a business inviting you to its organisation, a company you apply to or work for, the responsible agency, and authorised support staff.
Businesses and workers may provide time records, ratings or dispute evidence about each other. Technical information comes from your browser and the services described below. Selected workplace addresses and coordinates can come from Google Maps or Places.
When someone supplies your information before you contact us, we must give you the applicable privacy information within the legal deadline. Under GDPR this is generally within one month, or at the first communication or disclosure if that happens earlier, subject to the permitted exceptions.
4. Why we use data and the legal grounds
We must have an applicable legal basis for each purpose. Accepting website terms is not consent to every use of personal data.
| Purpose | Information used | GDPR basis, where applicable |
|---|---|---|
| Create and operate an individual account, respond to a requested service and manage applications | Account, contact and relevant profile information | Taking steps at your request before a contract, or performing a contract with you: Article 6(1)(b) |
| Administer business relationships, organisation invitations and staff access | Business contact details, team roles and correspondence | Legitimate interests in providing the service to the organisation and managing its authorised contacts: Article 6(1)(f) |
| Arrange assignments and administer employment where we are the employer | Eligibility, assignment, hours, contact and pay information | Contract where objectively necessary: Article 6(1)(b); applicable EU or Member State legal obligations: Article 6(1)(c) |
| Meet applicable accounting, tax and employment record duties | Relevant contracts, invoices, pay and compliance records | Article 6(1)(c), where the duty is established by applicable EU or Member State law |
| Prevent fraud, control access, investigate incidents and maintain a reliable service | Security events, session information and proportionate diagnostic data | Legitimate interests in protecting people, records and the service: Article 6(1)(f) |
| Resolve complaints, correct records and establish or defend legal claims | Relevant correspondence, work records and evidence | Legitimate interests in fair dispute resolution and legal protection: Article 6(1)(f), or an applicable legal obligation |
| Document the account process and the terms shown to you | Terms acknowledgment and the associated terms text | Legitimate interests in keeping an accurate account record and resolving disputes: Article 6(1)(f) |
| Send optional marketing or use optional tracking if introduced | Contact details and the specific data explained at the time | Consent where required: Article 6(1)(a), together with applicable electronic-communications rules |
For company representatives, the organisation's contract does not automatically provide a contract basis for processing the representative's personal data. Legitimate interests require an assessment of necessity and the effect on the person concerned.
A Monaco legal obligation is not, by itself, an EU or Member State obligation under GDPR Article 6(1)(c). Where both regimes apply, the relevant Monaco basis and an appropriate GDPR basis must each be established.
[CHECK] Complete the country-specific record of purposes, legal obligations and legitimate-interest assessments before live staffing. Assess consequential automated decisions separately as described in section 9.
Fields marked as required are needed for the stated account, service or legal purpose. Without them, we may be unable to create an account, verify eligibility, arrange work or make a payment. Optional information should remain optional. We will explain any materially different purpose before using data for it.
5. Who can receive information
Access depends on the person's role and the task they need to perform.
- Relevant businesses: applicant and previous-worker profiles can show name, photo, work history, skills, languages, ratings and reliability information. This may include the names of businesses previously worked for. A worker's phone number is shared with the relevant business after hiring. Identity images, IBAN and account email are not included in the client-facing worker profile.
- The responsible employer or agency: information needed for lawful recruitment, assignment administration, pay and employment obligations. The agency must be identified for the assignment.
- Authorised staff: support and operational information appropriate to their role. Identity-image review is restricted to authorised Finance support and access is recorded. Technical administrators may need access to operate or secure the underlying systems.
- Service providers: hosting, storage, email, maps and diagnostics providers, as described below.
- Professional advisers and authorities: information needed for accounting, insurance, legal advice, lawful reporting or a binding request. We disclose only what is justified for the purpose.
Worker and client information is not a public directory. Information must not be reused between agency customers without an applicable legal basis and appropriate notice. We do not sell personal data or provide it to advertising brokers.
External services
The current website integrates the following services; availability depends on deployment.
| Service | Purpose and information involved |
|---|---|
| Microsoft Azure, where configured | Database or private-file hosting. The precise services, regions, backup locations and contractual provider must be confirmed for production. |
| Resend | Transactional and operational email delivery. This includes recipient details and the content of the message. An enquiry sent to the team may contain the enquiry text. |
| Google Maps and Places | Workplace maps and address search. Browser maps contact Google directly and can send IP address and browser information; searches can send the entered address. Selected addresses and coordinates are saved with the workplace. |
| Sentry, where enabled | Error reporting and sampled performance diagnostics. The application filters sensitive fields and does not enable Session Replay. Diagnostic processing remains subject to the configured service and retention settings. |
| Calendly, if you follow the demo-booking link | An external appointment-booking service. Calendly receives the information you choose to submit on its site under its own notice. The link does not embed its booking form on this website. |
The website does not request your device's current geolocation. A workplace's saved coordinates describe the workplace, not live tracking of a worker.
[CHECK] Confirm the production provider list, controller/processor roles, contractual entities, data processing agreements, retention settings and any additional payroll, banking or insurance recipients. Describe additional providers before they receive personal data.
6. International transfers
Your information may be accessed or processed outside the country where you live, including by the services above. A European hosting region alone does not guarantee that all support access, backups and subprocessors remain in the EEA.
Where GDPR Chapter V applies, a transfer must rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses with the necessary assessment and supplementary measures. A narrow legal exception may be used only when its conditions are met.
As of this draft, Monaco is not on the European Commission's adequacy list. Transfers subject to GDPR from the EEA to a Monaco recipient therefore require a valid transfer arrangement; Monaco's own recognition of EU countries does not supply one.
You can ask info@bevelty.com which safeguards apply and request a copy, subject to necessary redactions.
[CHECK] Identify the actual destination countries, remote-access arrangements and safeguards for each production provider and any Monaco recipient. This draft does not establish that those arrangements have been signed.
7. Cookies and similar technologies
The website uses first-party authentication cookies to keep you signed in and protect account access.
| Cookie | Purpose | Configured lifetime |
|---|---|---|
| __Secure-better-auth.session_token | Identifies an authenticated session | Up to seven days; active sessions can be renewed |
| __Secure-better-auth.session_data | Holds a short-lived signed session cache | Up to five minutes |
On local HTTP development sites these names do not have the __Secure- prefix. Cookie expiry does not mean that the corresponding server record has been deleted.
The current website does not integrate an advertising-pixel or audience-analytics product. Google map features and optional diagnostics can still involve third-party communications. Their storage and device-access behaviour must be assessed separately from our login cookies.
Strictly necessary storage is used for the service you request. Any non-essential storage or access that requires consent must stay disabled until you actively choose it. Consent must be as easy to withdraw as to give; accepting the terms or continuing to browse is not cookie consent.
You can delete or block cookies in your browser, although blocking authentication cookies prevents normal sign-in. For optional processing introduced later, the relevant control and notice must explain the provider, purpose, lifetime and withdrawal method.
[CHECK] Audit the deployed cookies and SDKs, especially Maps and Sentry, and implement any required consent controls before enabling non-essential processing. This draft does not claim that a cookie preference centre already exists.
8. How long information is kept
We retain information only for a documented purpose and for no longer than that purpose or an applicable obligation requires. Different records need different retention rules.
| Record | Retention criteria |
|---|---|
| Enquiries and correspondence | While responding and for a justified follow-up or dispute period |
| Account and profile information | While the account is used, with a defined inactivity and closure review |
| Account-linked terms acknowledgments | With the account record for evidence of registration and relevant disputes; removed when the underlying account is deleted |
| Unsuccessful applications and unused onboarding submissions | For the recruitment or verification purpose and a justified claims period; longer talent-pool retention needs a separate basis |
| Identity copies and onboarding snapshots | Only for a demonstrated verification or legal requirement, with a shorter period where keeping the verified result is sufficient |
| Contracts, time records, payroll, tax and invoices | The applicable employment, accounting and tax periods, plus any justified legal hold |
| Ratings, attendance records, strikes and access logs | For the relevant operational, challenge or security period; a restriction ending does not itself delete its history |
| Diagnostic records and backups | The documented provider retention and backup-rotation periods |
An account-closure request does not automatically erase records needed for a legal obligation or claim. Retained records must have restricted access and must not be used for unrelated purposes. Erasure must also address file storage, copies and backups under an appropriate deletion or expiry procedure.
[CHECK] Approve the actual time limits for each country and provider, including inactive accounts, identity copies, submission snapshots and backups. General automatic erasure and export workflows are not yet implemented; contact us to make a request.
9. Matching and automated processing
Some existing prototype workflows use rules that affect assignments and account access:
- A worker in a business-selected TrustPool can be booked automatically when they apply to an eligible shift, subject to capacity and overlapping-booking checks.
- The third active strike can trigger a 30-day block on further applications.
- Where the automatic check-out process is enabled, expiry of a response period can approve hours or corrections, or record a no-show and a related strike.
These processes can affect access to work, attendance records and the hours used for financial administration. The applicable rules and deadlines need to be explained before the feature is used.
AI recommendations and personalised pay offers described in the business plan are planned features. This notice does not present them as live. Before introducing them, we must explain the data used, the main factors, the consequences, the human role and the applicable rights.
You can challenge an inaccurate record or consequential decision at info@bevelty.com, explain your circumstances and request human review. Where GDPR Article 22 applies, you have protection against solely automated decisions with legal or similarly significant effects, subject to its limited exceptions and safeguards.
[CHECK] Assess the existing rules under Article 22 and applicable employment law. Put a staffed review process, meaningful explanations and any required impact assessment or consent in place before live use. A contact email alone does not complete those safeguards.
10. Security
We use account permissions, server-side access checks, password hashing and private-file access controls. Worker identity images are additionally encrypted by the application and authorised review access is logged. That statement does not mean that every database field uses the same encryption.
Security also depends on the deployed hosting, transport encryption, key management, backups and staff procedures. We must assess incidents and notify the relevant authority and affected people when the law requires it.
11. Your rights and how to use them
Depending on the applicable law and the circumstances, you can:
- Ask for access to your personal data and information about its use.
- Correct inaccurate information and complete relevant missing information.
- Request erasure when we no longer have a lawful reason to retain it.
- Restrict processing in the circumstances provided by law.
- Receive portable data that you provided, where processing is automated and based on consent or contract, and request transmission where technically feasible.
- Object to processing based on legitimate interests because of your situation. Direct-marketing objections must be honoured without requiring a reason.
- Withdraw consent at any time for processing based on consent, without affecting the lawfulness of earlier processing.
- Challenge consequential automated decisions and use the protections described in section 9.
Email info@bevelty.com with your request and enough information to locate the relevant records. We may need proportionate identity verification; do not send a passport or bank details in an ordinary email unless a secure and necessary process has been agreed.
Under GDPR, we must respond without undue delay and normally within one month. For complex or numerous requests, the law allows up to two additional months, with reasons given within the first month. Requests are normally free. Any permitted refusal or fee must be explained, together with the available complaint and court remedies.
You can complain to a competent supervisory authority without contacting us first. Under GDPR this includes the authority where you habitually live, work or where the alleged infringement occurred. The European Data Protection Board lists the EEA authorities. For Monaco matters, contact the Autorité de Protection des Données Personnelles.
Where an agency is the controller, you can contact that agency or ask us to direct the request to it. Your rights are not lost because information is held in an agency workspace.
12. Children and updates
The staffing accounts are intended for adults aged 18 or over. If you believe a child has supplied personal information, contact us so the matter can be assessed and the information removed where appropriate.
The date at the top identifies this draft. Material changes to an operative notice must be communicated through an appropriate channel before new processing begins where required. A notice update does not replace consent or another required legal basis.
See also our Terms and conditions and Legal notice.