Privacy Notice
Who we are
trading as MiWeek is Controller for its own billing, direct customer/account administration, support, security, fraud/abuse prevention and legal/corporate information. For most workforce and operational records, the subscribing organisation/employer is Controller and MiWeek processes the data on that organisation's behalf.
Information we handle
Depending on context: name, email, role, company/account data; billing contacts; support records; login/MFA/security/audit metadata; browser/push subscription information; and Customer Data processed for customer companies including timesheets, pay/rates, holidays/absence, sites, vehicles, work/forms/certificates, photographs and signatures; inventory and grouped-stock references; uploaded form examples, templates and completed forms.
Device drafts and offline submissions
Where supported, completed forms, signatures and evidence are retained on the device while awaiting upload. Native pending-form files are encrypted in account-scoped storage; browser dynamic-form drafts use encrypted local browser storage. A local completion time is distinct from server receipt. Retries run when the app is open and connectivity permits; closing the app does not guarantee a background upload. Users should protect devices and retain access to the original account until pending work has synchronised.
Special-category information
MiWeek does not require medical diagnoses for general absence recording. A simple absence status may not itself reveal health information, but sickness details or diagnoses can become special-category data. Customers and users should minimise sensitive detail and follow the employer's policy where health information is genuinely required.
Why we use information
For our own Controller data, purposes include performing customer contracts/account administration, legitimate interests in service security/support/abuse prevention, and legal obligations such as accounting/compliance. Where MiWeek is Processor, the customer determines its lawful basis for workforce/operational data.
Who receives information
Authorised MiWeek personnel, core infrastructure/service providers, professional advisers under confidentiality, authorities where legally required and parties involved in a genuine corporate transaction subject to safeguards. Core service providers are listed in the Subprocessor Notice.
International transfers
Where MiWeek is responsible for a restricted transfer, it will use an applicable lawful route and any required assessment/data-protection test.
Retention
There is no universal automatic deletion period for customer operational records. Records remain available until an authorised deletion or offboarding process is agreed, subject to legal retention requirements. Customers should tell us their lawful retention and export requirements. Billing, security and support records may be retained for applicable legal, security and business needs. Protected backup deletion follows the provider's backup cycle; removal from live records does not immediately remove a protected backup copy.
Your rights
Where MiWeek is Controller, individuals may have rights of access, correction, erasure, restriction, portability and objection depending on the circumstances. Requests about employer-controlled workforce records should generally be made to the employer/customer Controller; MiWeek will assist that customer as Processor.
Complaints and contact
Privacy contact: . You may also complain to the UK Information Commissioner's Office where applicable.
Automated decision-making
MiWeek does not currently make solely automated decisions that produce legal or similarly significant effects. Calculations and status indicators support human customer decisions.