Data Handling Statement

Your organisation decides what workforce information to enter and how it is used. It is responsible for having a lawful basis to collect it, informing employees where required, setting user roles and access, keeping accounts secure, and making sure schedules, leave rules and attendance practices comply with workplace laws.

Chamberless provides the software. We host and process that information to provide the service, keep it separate from other organisations, apply the access rules your organisation sets, and do not use it for our own purposes such as advertising.

• Employee records, departments, positions and schedules.
• Attendance: clock-in/out times, scheduled hours, attendance status and correction requests. No GPS, biometrics or continuous monitoring.
• Leave: balances, requests, dates, reasons and decisions.
• Clients: names, services, employee assignments and planned allocation. This is planned capacity, not billable time tracking.

Only enter what you need. Avoid entering:

• health details beyond what is needed to administer leave (for example, "personal leave" rather than a diagnosis);
• government identifiers such as tax file numbers, passport or licence numbers;
• bank or financial account details;
• biometric information;
• criminal-history information;
• other sensitive information (for example racial or ethnic origin, religion, sexual orientation or union membership) unless it is necessary and lawful.

Each organisation's data is isolated at the database level. Inside an organisation, access follows assigned roles: Owners and Admins see the whole organisation, Managers see their direct reports, and Employees see their own records. Chamberless platform staff see account-level information and aggregate counts, not employee records, attendance details, leave reasons, client contacts or reports, as part of normal operations.

Owners, Admins and Managers can download reports (employees, attendance, leave, client assignments and allocation) as CSV files within their access scope. For a fuller export of your organisation's data, contact support@chamberless.com.

• Active accounts: data is kept while your organisation is active.
• Deactivating people: Owners and Admins can mark employees inactive or terminated and suspend their login access. This keeps history rather than deleting it.
• Cancelled organisations: after cancellation we keep your data for 90 days in case you resubscribe, after which it becomes due for deletion. This retention period is carried out manually through the deletion process below.
• Deletion: the organisation's Owner can request deletion from within Chamberless under Company → Data & deletion, by typing the organisation name to confirm. A deletion request does not immediately delete anything — Chamberless reviews and processes each request securely, and Owners can withdraw a pending request. You can also contact support@chamberless.com for assistance with deletion. We will delete or de-identify the data, except records we must keep by law.
• Billing records: subscription and transaction records may be retained as required for tax and accounting purposes.
• Backups: our infrastructure keeps backups for disaster recovery. Deleted data may remain in backups for a limited period until they are overwritten.

If we become aware of a security incident affecting your organisation's data, we will notify the Owner without undue delay and cooperate with you on any notification obligations you have.

Employees should usually direct questions about their records to their employer. Anyone can contact us at support@chamberless.com.