Staff Privacy Notice
This notice explains how JBG Holdings ("we", "the Company") handles your personal data in our internal payroll exception portal. It is in addition to the wider Staff Privacy Notice covering your overall employment.
Who is responsible
JBG Holdings is the data controller. Questions or requests relating to your data should go to Myra Cox, Payroll Manager at myra.cox@jbgholdings.co.uk.
What data we hold in the portal
Each month we record, for each employee: employee number, name, store, contracted hours, hourly rate, gross salary, start date, and a flag indicating whether you are aged 21 or over. Throughout the month we may also record exceptions to your standard pay — overtime, bonus, sickness hours, statutory sick pay periods, holiday days taken, paternity leave dates, and your leaving date if applicable.
We do not store your date of birth, home address, bank details, or National Insurance number in this portal — those live in our payroll system (Sage).
Why we hold it and on what legal basis
We process this data to pay you correctly under your employment contract (UK GDPR Article 6(1)(b)) and to meet our obligations under employment law (Article 6(1)(c)) — including paying the correct National Living Wage band, applying long-service sick-pay entitlement for employees over five years' service, calculating Statutory Sick Pay, and meeting Working Time Regulations on holiday.
Sickness records are health data under Article 9; we process them under the employment-law exemption at Article 9(2)(b).
Who sees it
Your store manager can see exceptions for their own store. The payroll manager and a small number of senior and admin users can see all stores. The data is hosted on our behalf by Supabase Inc. in their AWS Ireland (EU) data centre. It is exported to Sage at month-end for payment processing. We do not sell or share your data with anyone else.
How long we keep it
Full records for the current month are held while payroll is being processed. After the month closes, a manager runs a "cleanse" that removes pay, hours, sickness and name detail — leaving only your employee number, store and total holiday days taken, which we need to keep a running annual record for your final pay. Underlying payroll records (in Sage) are kept for the period HMRC requires us to retain them.
No automated decisions
No decision with legal or similarly significant effect is made about you by the portal automatically — pay is always reviewed by a person before submission to Sage.
Your rights
You have rights under UK GDPR to access your data, request correction of inaccuracies, and in some cases request erasure or restriction. To exercise any of these, contact Myra Cox, Payroll Manager at myra.cox@jbgholdings.co.uk.
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).