Last updated: 3 April 2026
Gaffer is a construction workforce management platform operated by Flowstate Systems ("we", "us", "our"), a sole trader business based in Derry, Northern Ireland, United Kingdom, operating under the trading name Flowstate Systems.
For the purposes of UK data protection law - including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 - the roles are as follows:
Contact: hello@gafferai.uk
The following table sets out the categories of personal data we collect, the purpose of collection, and the legal basis under UK GDPR.
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Admin: name, email, phone, password | Account creation, authentication, communication | Contract performance (Art. 6(1)(b)) |
| Worker: name, phone, email, PIN | Worker identification, account access, communication | Legitimate interest of employer (Art. 6(1)(f)) |
| Employment details (pay rate, CIS/PAYE status, trade) | Payroll data aggregation, workforce categorisation | Contract performance / Legitimate interest |
| Photographs (face stamp) | Identity verification at clock-in and clock-out | Legitimate interest (workforce compliance). See Section 3 for full detail. |
| GPS location coordinates | Location verification at clock events, site attendance confirmation | Legitimate interest (site compliance). See Section 4 for full detail. |
| Clock-in/out timestamps | Attendance tracking, hours calculation, payroll | Contract performance / Legitimate interest |
| Signatures | Form sign-off, compliance verification, safety acknowledgements | Contract performance / Legal obligation |
| Form submissions | Health and safety records, inductions, toolbox talks, risk assessments | Legal obligation (Health and Safety at Work Act 1974, CDM Regulations 2015) |
| CSCS card details (number, type, expiry) | Certification tracking, expiry alerts, site access compliance | Legal obligation (CDM Regulations 2015) |
| Device information (browser, push token) | Push notifications, PWA functionality, offline sync | Consent (Art. 6(1)(a)) |
| AI conversation data | Providing AI assistant responses to admin queries | Contract performance (Art. 6(1)(b)) |
Gaffer captures a photograph of the worker using their device's front-facing camera at each clock-in and clock-out event. This is a core feature of the Service designed to verify that the correct individual is clocking in at the correct time and location.
Under ICO guidance, a photograph becomes biometric data only when it is processed through specific technical means (such as facial recognition software) to extract biometric identifiers. Because Gaffer stores photographs solely for manual visual review and does not process them through any biometric analysis, they are treated as standard photographic images rather than special category biometric data under Article 9 of UK GDPR.
If this position changes - for example, if we introduce facial recognition features in the future - we will update this policy, conduct a Data Protection Impact Assessment (DPIA), and obtain appropriate consent or establish an alternative lawful basis before any such processing begins.
Employers using the face stamp feature must inform their workers before first use that photographs will be taken at clock events and explain the purpose. Workers should be given this information as part of the employer's own privacy notice or employment documentation.
GPS coordinates are captured at the moment of clock-in and clock-out only. Gaffer does not perform continuous location tracking, background tracking, or any monitoring of worker movements outside of clock events.
The worker's device will request permission to access location services. If a worker denies location permission, the clock event will still be recorded but without GPS data. The employer will see that no location was captured for that event.
We process personal data for the following purposes:
We do not sell personal data to any third party. We do not use personal data for advertising, marketing profiling, or any purpose unrelated to providing the Service.
The AI assistant feature (available on Pro and Enterprise tiers) is powered by Anthropic's Claude API. When an admin user sends a query to the AI assistant:
In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will:
We share personal data with the following third-party service providers who act as sub-processors:
| Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database hosting, file storage, authentication | All account and worker data | EU (Ireland) |
| Vercel | Application hosting, serverless function execution | Request data (transient processing only) | EU / US (edge network) |
| Anthropic | AI assistant feature (Pro and Enterprise tiers only) | Company data included in AI queries | US |
| OpenStreetMap Nominatim | Reverse geocoding (GPS to address conversion) | GPS coordinates only (no personal identifiers) | Various |
All third-party processors are bound by their own data processing terms and privacy policies. We select processors that maintain appropriate technical and organisational security measures.
Where personal data is transferred outside the United Kingdom (for example, to Anthropic in the United States or to Vercel's edge network), such transfers are made in compliance with UK GDPR requirements. We rely on the following safeguards:
Under UK data protection law, individuals whose data is processed through Gaffer have the following rights:
You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). We will respond within one calendar month.
You have the right to request correction of inaccurate or incomplete personal data.
You have the right to request deletion of your personal data where there is no compelling reason for continued processing. Note that we may need to retain certain data to comply with legal obligations (for example, health and safety records required under CDM Regulations).
You have the right to request that we restrict processing of your data in certain circumstances, such as while we verify the accuracy of data you have contested.
You have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON).
You have the right to object to processing based on legitimate interests. Where you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Where processing is based on consent (such as push notifications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
If you are a worker: In the first instance, contact your employer (the company that manages your Gaffer account). As the data controller, your employer is responsible for handling your rights requests. If your employer is unresponsive or you are unable to resolve the matter, you may contact us directly at hello@gafferai.uk and we will work with the employer to address your request.
If you are an admin account holder: Contact us directly at hello@gafferai.uk.
We will respond to all valid requests within one calendar month. In complex cases, we may extend this by a further two months, but we will inform you of any extension and the reasons within the first month.
There is no fee for exercising your rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.
If you are not satisfied with how we handle your data or your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
While your account is active, data is retained according to your subscription tier:
Data older than your tier's retention period is automatically archived and then permanently deleted.
Certain records may need to be retained by the employer for longer periods to comply with UK legislation. For example, health and safety records under the CDM Regulations 2015 or RIDDOR may need to be kept for specific periods. It is the employer's responsibility to export and retain such records independently before account cancellation.
Gaffer uses only essential cookies and local storage required for the Service to function. We use:
We do not use analytics cookies, advertising cookies, social media tracking pixels, or any third-party tracking scripts. We do not track user behaviour for marketing purposes.
The Service is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly. In the construction industry context, workers are expected to be of legal working age (16 or over in the UK).
Given that Gaffer processes location data and photographs of workers, we have conducted a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of UK GDPR. We review and update this assessment periodically and whenever we introduce significant changes to our data processing activities.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
If you have any questions about this Privacy Policy, our data processing practices, or wish to exercise your data protection rights, please contact us: