Staff Privacy Notice Template
A template for BrieflyWorks customers to complete and provide to staff before using staff-related features.
Version and effective date: 2026-08-24
How to use this template
The employer or engaging business, not BrieflyWorks, normally acts as controller for staff information. Replace every bracketed field, check the legal basis with your adviser, address works-council rights where applicable, and give the completed notice to affected people before entering or forwarding their information.
1. Controller and contact
Controller: `[employer's full legal name and address]`
Privacy contact: `[email and, if applicable, data protection officer]`
2. Purpose and legal basis
We use BrieflyWorks to organise selected operational notes, tasks, follow-ups, and factual workplace observations for `[specific purposes]`. Our legal basis is `[identify and document applicable basis, including Section 26 BDSG where appropriate]`. The tool must not be used as the sole or decisive basis for hiring, dismissal, discipline, promotion, compensation, monitoring, or task allocation based on personal traits or behaviour.
3. Data processed
Depending on use, we may process name, work role, dates, tasks, explicit operational observations contained in business notes, source references, and status as active/former staff. We prohibit health information, biometric data, religion, political opinions, union membership, sexuality, private communications, and other sensitive information unless a separate lawful process has been approved.
4. AI assistance and human review
The service may use AI to associate an explicit note with a named staff profile and suggest a factual summary or follow-up. AI can be wrong. It does not assign a performance score or independently change employment status. An authorised person must review the source and confirm any consequential action.
5. Recipients and international processing
Authorised `[management/operations roles]` may access the data. BrieflyWorks processes it for us under a data-processing agreement and uses subprocessors listed in its DPA, including hosting, database, email, and AI providers. Some processing may occur outside the EEA under an adequacy decision, Standard Contractual Clauses, or another lawful safeguard.
6. Retention
We review staff observations every `[90]` days and delete information when it is no longer necessary. Former-staff profiles are deleted or anonymised after `[six months]` unless a documented legal duty or claim requires longer retention.
7. Your rights
Subject to legal conditions, you may request access, correction, deletion, restriction, or object to processing and may complain to a competent data-protection authority. Contact `[employer privacy email]`. You may request human review and correction of any inaccurate AI-organised observation.
8. Source of data
Information is supplied by `[managers, business owners, selected operational emails, or other specified sources]`. We do not collect private social-media, biometric, or covert-monitoring data through BrieflyWorks.