Privacy

Privacy Notice

This notice explains how CrewFill handles personal information across its public website, business enquiries, managed dispatch services and user portals.

Last updated: 3 August 2026

1. Who we are

CrewFill is operated by Humantra-AI Ltd, trading as CrewFill. Humantra-AI Ltd is registered in England and Wales under company number 16826185.

Our registered business address is Ability House, 121 Brooker Road, Waltham Abbey, EN9 1JH. Our Information Commissioner's Office registration number is ZC101683.

Our role depends on the processing involved. For website enquiries, platform security, service administration and our own business records, CrewFill normally acts as a data controller. When we process worker, contractor or operational information on a labour provider's instructions, the provider will normally be the controller and CrewFill will normally act as its processor. The relevant service agreement may provide further details.

2. Who this notice covers

This notice may apply to:

  • visitors to the CrewFill website;
  • people who submit a demo or business enquiry;
  • agency administrators and agency team members;
  • contractors and contractor team members;
  • workers included on an agency roster;
  • workers using the CrewFill worker portal;
  • authorised CrewFill operations users;
  • site contacts and other people whose information is included in a labour request;
  • people whose information is entered by an authorised agency, contractor or operations user.

3. Information we may collect

Website and enquiry information

  • name and company or organisation;
  • email address and phone number;
  • type and approximate size of labour provider;
  • current dispatch method;
  • service and compliance support requested;
  • information included in an enquiry or message.

Account and organisation information

  • account name, email address and user role;
  • agency, contractor or other organisation membership;
  • access status and invitation status;
  • authentication and password-reset events;
  • account creation and last-access timestamps;
  • security, session and audit records.

CrewFill does not make users' plain-text passwords available to agency, contractor or operations users.

Worker and roster information

  • name, email address and phone number;
  • worker and portal status;
  • engagement type;
  • skills, roles and roster information;
  • CSCS card type, status and relevant dates;
  • right-to-work status, review status and relevant dates;
  • compliance notes, missing-information indicators and expiry information;

Job and dispatch information

  • job reference, role, dates, times and duration;
  • number of workers requested;
  • general and exact site-location information;
  • site access instructions and site-contact details;
  • job requirements, notes and safety information;
  • worker offer or pay-rate information;
  • client charge-rate or commercial information where required for the provider's workflow;
  • worker broadcasts, responses, acceptance and assignment;
  • attendance, no-show, cancellation and replacement information;
  • where GPS-supported attendance is enabled, the worker's precise latitude and longitude at the moment they press check in or check out;
  • GPS accuracy, event time, event type, configured site coordinates, site postcode, permitted radius, calculated distance from the site and verification result;
  • operational notes and status history.

Technical and notification information

  • IP address, browser and device information;
  • page, portal and feature usage;
  • timestamps, error records and security events;
  • email delivery status and notification history;
  • push-notification subscription and device identifiers where push notifications are enabled.

Imports, exports and audit records

  • spreadsheet column headings and imported worker data;
  • report type, date range and export timestamp;
  • the authorised user who performed an action;
  • changes to access, jobs, attendance, compliance and operational records.

4. Where information comes from

We may receive personal information:

  • directly from the person it relates to;
  • from an agency or labour provider;
  • from an authorised agency team member;
  • from a contractor or contractor team member;
  • from a CrewFill operations user;
  • through a spreadsheet or roster supplied by an authorised client;
  • through job responses, attendance records and platform activity;
  • automatically from hosting, authentication, security, email or notification infrastructure.

Where an agency or labour provider supplies worker information, that organisation is responsible for having an appropriate reason and lawful basis for supplying it and for providing any privacy information it is required to give to the worker.

5. How we use information

Personal information may be used to:

  • respond to enquiries and arrange demonstrations;
  • create, secure and administer user accounts;
  • manage agency and contractor access;
  • maintain worker rosters;
  • receive and review labour requests;
  • broadcast suitable jobs to workers;
  • record worker responses and assignments;
  • coordinate replacements and unfilled requirements;
  • record attendance and no-shows;
  • provide GPS-supported evidence of a worker's location when they actively check in or check out;
  • display missing, valid, expiring or expired compliance information;
  • send operational emails and push notifications;
  • produce operational reports and CSV exports;
  • maintain security and audit trails;
  • investigate misuse, errors or security incidents;
  • provide support and improve the service;
  • comply with contracts, legal requirements and legitimate business-record obligations.

GPS-supported attendance

An authorised agency may choose to enable GPS-supported attendance for a particular job. When enabled, CrewFill requests the worker's device location only after the worker actively presses the check-in or check-out button and confirms the action.

CrewFill does not continuously track workers and does not collect background location information between attendance actions. Device or browser location permission is required. If location is unavailable or permission is not granted, GPS evidence cannot be created and the agency may use its manual attendance process.

The recorded position is compared with the fixed job-site position and permitted radius. CrewFill stores the attendance time, coordinates, device-reported accuracy, calculated distance and a result such as location verified, outside the configured radius or low accuracy.

GPS information is supporting attendance evidence only. It does not automatically mark a worker as attended or as a no-show. Location accuracy can vary, and authorised agency users remain responsible for reviewing the evidence, considering relevant circumstances and making attendance decisions.

When an agency or labour provider determines the purpose and means of this processing, that organisation is responsible for establishing an appropriate lawful basis, assessing necessity and proportionality, providing any additional worker information required and completing a data protection impact assessment where appropriate. CrewFill will normally process the information on that organisation's documented instructions.

6. Lawful bases

The lawful basis depends on the purpose and CrewFill's role. We may rely on:

  • Contract: where processing is necessary to provide an agreed service or administer an account;
  • Steps before a contract: when responding to a prospective client's enquiry or arranging a demo;
  • Legitimate interests: for secure service operation, business communications, auditing, support, fraud prevention and service improvement, where those interests are not overridden by individual rights;
  • Legal obligation: where information must be used or retained to comply with applicable law;
  • Consent: where consent is appropriate, including optional notifications, non-essential technologies or marketing communications.

When CrewFill acts as a processor, the relevant agency or labour provider determines the lawful basis for the underlying worker and operational processing.

7. Compliance-record visibility

CrewFill may store and display CSCS, right-to-work and other compliance statuses, dates and notes entered by an authorised agency or labour provider.

CrewFill does not inspect, verify, approve or certify CSCS cards, right-to-work evidence, identity documents or any other worker-compliance evidence. CrewFill does not decide whether a worker is compliant, legally eligible to work or suitable for an assignment.

The relevant agency or labour provider remains fully responsible for collecting evidence, carrying out all required checks, recording accurate information, deciding worker eligibility and keeping its records current.

Status indicators, missing-information flags and expiry reminders are administrative visibility tools only. They do not replace legal checks, document verification or the provider's professional judgement.

Users must not upload identity documents, special-category information or other sensitive evidence unless CrewFill expressly introduces and documents a suitable secure process for that information.

8. Sharing information

Information may be shared only where required for the relevant workflow, service or legal purpose, including with:

  • the agency or labour provider responsible for the worker or job;
  • authorised agency, contractor and operations users;
  • workers receiving or accepting a job opportunity;
  • cloud hosting, database and authentication providers, including Supabase;
  • email-delivery and operational communication providers;
  • push-notification providers, including OneSignal where enabled;
  • website hosting, security and technical-support providers;
  • accountants, insurers, legal advisers and professional consultants;
  • regulators, courts or public authorities where legally required.

Service providers may only use information for the agreed service and are subject to appropriate contractual and security requirements.

Precise GPS attendance evidence is restricted to authenticated users authorised to manage the relevant job and to service providers processing the information under appropriate instructions. It is not made available to unrelated organisations or other workers.

CrewFill does not sell worker or portal-user personal information.

9. International transfers

Some technology providers may store or process information outside the United Kingdom.

Where a restricted international transfer occurs, the responsible controller will use an applicable lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another legally recognised safeguard.

Further information about relevant safeguards can be requested using the contact details below.

10. How long we keep information

We keep information only for as long as needed for the relevant purpose. Retention depends on the type of record, contractual requirements, legal obligations, security needs and the relevant client's documented instructions.

Our current retention approach is:

  • enquiry and demo information is normally retained for up to 24 months after the last meaningful contact;
  • account and organisation records are retained while the account or client service remains active and for a reasonable period afterwards;
  • job, response, attendance, replacement and compliance records, including GPS-supported attendance evidence, are retained according to the relevant client's instructions and service agreement and only for as long as reasonably necessary for the relevant operational, audit or legal purpose;
  • security and audit records are retained for as long as reasonably required to protect the service, investigate incidents and demonstrate authorised activity;
  • contracts, invoices and related business records may be retained for the period required by tax, accounting and legal obligations;
  • backup copies may remain for a limited backup-deletion cycle after live information is removed.

Information may be retained for longer where required for an active dispute, legal claim, investigation or legal obligation.

11. Cookies, sessions and notifications

CrewFill portals use essential browser storage and similar technology to maintain authentication, security and portal functionality.

Optional push notifications require the user's device or browser permission. A user can withdraw that permission through their browser or device settings.

If CrewFill introduces non-essential analytics, advertising or similar tracking, appropriate information and consent controls will be provided before those technologies are used where required by law.

12. AI and automated tools

CrewFill may use automated tools to assist with operational tasks such as suggesting how spreadsheet columns correspond to worker-record fields.

These suggestions support an authorised human user and should be reviewed before information is imported. CrewFill does not currently use this feature to make solely automated decisions that produce legal or similarly significant effects for workers.

If an external AI provider is introduced for personal-data processing, the relevant privacy information, contracts and safeguards will be reviewed before that processing begins.

13. Your rights

Depending on the circumstances and lawful basis, individuals may have the right to:

  • request access to their personal information;
  • request correction of inaccurate information;
  • request deletion of information;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • request transfer of eligible information;
  • withdraw consent where processing relies on consent;
  • complain to the Information Commissioner's Office.
Your right to object: where processing is based on legitimate interests, you may have the right to object based on your particular circumstances. You may object to direct marketing at any time.

When CrewFill processes information on behalf of an agency or labour provider, we may need to pass the request to that organisation or assist it in responding.

We may request information needed to verify identity before fulfilling a rights request.

14. Security

CrewFill uses technical and organisational measures intended to protect personal information. These include authenticated accounts, role-based access, organisation separation, database access controls, restricted privileged functions, audit records and service monitoring.

Users are responsible for protecting their login credentials, using a secure device and promptly reporting suspected unauthorised access.

No website or online service can be guaranteed to be completely secure.

15. Children

CrewFill's business and portal services are intended for organisations and people of working age. The service is not directed at children.

Agencies and labour providers must not add a person to a worker roster where doing so would breach employment, data protection or safeguarding requirements.

16. Changes to this notice

We may update this notice when the website, platform, service model, subprocessors or data-processing activities change.

Material changes will be brought to affected users' attention where reasonably appropriate. The latest version will remain available on this page.

17. Contact and complaints

Questions, privacy requests or concerns can be sent through the contact form on the CrewFill website or in writing to:

Humantra-AI Ltd t/a CrewFill
Ability House
121 Brooker Road
Waltham Abbey
EN9 1JH

Please mark written correspondence “Data Protection”.

You may also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint .

We would appreciate the opportunity to address a concern before a complaint is submitted to the ICO.