What we keep, and why
Privacy notice and cookies
This notice is written from the code that runs the site. Every kind of data it stores is listed below, with what is in it, why, the lawful basis under the UK GDPR, how long it stays, and who handles it for us.
It covers this website, the floor-walk desk on it, and email sent to the team address. Information about people on your floor during a piece of work, such as time studies and interview notes, is covered by the statement of work for that piece, agreed before it starts.
Who is responsible
The controller
- Controller
- JB90 SOLUTIONS LTD
- Registration
- Registered in England and Wales, company number 17430755
- Registered office
- 4 George Street BICESTER, OX26 2EG United Kingdom
- Questions about this notice
- team@jb90solutions.site, or by post to the registered office
The company has not appointed a data protection officer and is not required to: it does not monitor people on a large scale or handle special categories of data. Questions go to the team address above.
What the floor-walk desk keeps
Eight kinds of data, and nothing else
Two of them are stored by the site itself, in Cloudflare's key-value storage; one lives only on your browser; the rest are counters, mailboxes and logs.
| What | What is in it | Why, and the lawful basis | How long |
|---|---|---|---|
| A floor-walk request, stored under its reference (FW- and eight characters) | The morning and the time your shift starts; the floor's postcode, the place it is in and the business name if given; the kind of floor and the size band of a shift; what you write about where it knots and what to know before we arrive; your name, email address and telephone if given; the knot map if you attach it; the scope of the walk if you choose one (areas, lines, questions, outputs, the length of your induction, the shift pattern and units a shift makes, the date a new space must work by and whether a drawing exists); a short history of what has happened to it; and whether our email copy went. | To arrange and run the walk you asked for. Steps taken at your request before entering into a contract: UK GDPR Article 6(1)(b). The tick on the form confirms you have read how the request is kept. | Deleted automatically at the end of the 90th day after the morning. Cancelling deletes it at once, and so does asking us. Once the morning has passed it can still be deleted from its own page. |
| A held morning, stored under its date | Only the reference of the request holding that morning. | To show the morning as taken to anyone else opening the calendar. Article 6(1)(b). | Two days after the morning, or at once when the walk is moved or cancelled. |
| The walk pass, a cookie on your browser | The reference of the request opened on that browser, the moment the pass runs out, and a signature so it cannot be forged. Nothing about it is stored on our side. | To show an opened request to the browser that opened it and to nobody else. Strictly necessary for the service you asked for; Article 6(1)(b). | 30 minutes, or until you close it on the request page. |
| Counts of forms sent | A one-way hash of the connection's IP address; with a new request, a one-way hash of the email address too; when a request is opened, its reference. | To stop one connection flooding the forms or guessing references. Our legitimate interest in keeping the desk usable and safe: Article 6(1)(f). | Counted by Cloudflare for one minute. Also held in the Worker's memory for up to an hour and never written to storage. |
| Our email copy of a request | The same details as the request, sent to the team mailbox when it arrives, moves, gains a scope or is cancelled. This starts when the jb90solutions.site domain is connected; until then no copy is sent. | So the team can read the request and answer it. Article 6(1)(b). | Deleted on the day the request is, unless the walk leads to work; then it stays with that work's correspondence until six years after the work ends. |
| Messages you send to team@jb90solutions.site | What you write, your address and anything you attach. | To answer you, and for nothing else. Article 6(1)(f); Article 6(1)(b) when it is about work you asked for. | Two years after the last message in the thread, or six years after the work ends when it is part of a piece of work. |
| Request logs | Cloudflare's logs of each request our Worker answers: the address asked for, the time, the result, and the technical details Cloudflare attaches to a connection, such as the IP address and the browser. | To find faults and misuse. Article 6(1)(f). | Three days, then deleted by Cloudflare. |
| A concern you raise | What you tell us, our answer, and what was done about it. | To deal with it and to show later what was done. Article 6(1)(f). | Six years after it is closed: the time within which a claim about it could be brought. |
The site never asks for staff names, health details or anything else about a person on your floor, and the forms have no field for them.
What is not kept
Worked in your browser, then gone
- The takt calculator works entirely in your browser; nothing typed into it is sent.
- The knot check draws its map in your browser. Without scripts, the answers travel to the Worker in the address of the map page, are drawn and forgotten; they appear only in the request logs, for three days, and they describe a floor, not a person.
- No analytics, advertising or tracking of any kind, ours or anyone else's. Fonts and scripts are served from this site alone.
- No automated decisions about you. The booking form compares the floor's postcode district with the list printed beside it; outside that list, it asks you to write, and a person answers.
Who handles it for us
Two processors, and no one else
Cloudflare, Inc. hosts this site and runs everything behind the desk: the Worker that answers the forms, the key-value storage, the counting of sends, the request logs and the routing of mail sent to the team address. It acts as our processor under its data processing terms.
Our email provider hosts the mailbox where our copies of requests and your messages arrive. It, too, acts as our processor. Nothing is sold, shared for marketing or passed to anyone else.
Cloudflare runs a worldwide network and the email provider may keep mail outside the UK, so data can be handled abroad. Both transfer it under safeguards UK law recognises, adequacy regulations or the UK International Data Transfer Addendum, as set out in their data processing terms.
Cookies
One cookie, set only when you open a walk
| Name | What it is for | Set when | Lasts | Kind |
|---|---|---|---|---|
jb90_walkpass |
Shows an opened floor walk to this browser. Holds the reference, the moment it runs out and a signature. | You send a request, or open one with its reference and email. | 30 minutes | Strictly necessary; first party; HttpOnly, Secure, SameSite=Lax |
Your rights
What you can ask for, and how
- See what is kept
- Open your walk with its reference and email: its page shows every field stored, and the engagement summary prints them. Or ask us for a copy.
- Correct it
- Move the morning or change the scope on the walk's own pages. For anything else, write to us, or cancel and send the request again.
- Delete it
- Cancel and delete on the request page; it goes at once. Or ask us, and we delete it and our email copy.
- Restrict or object
- Ask us to stop using your data while a question about it is settled, or object to a use that rests on our legitimate interests.
- Take it with you
- Ask for the stored request in a common machine-readable form, and we send it as a JSON file.
- How we answer
- Within one month, at no charge. We confirm it is you by answering to the email address on the request.
If you are unhappy with how we handle it
Tell us, then the regulator
Write to us first; the steps and the times we commit to are under raising a concern. You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have come to us.
This notice was last changed on 13 November 2026, when the scope of a walk began to be kept with its request. When what the site keeps changes, this page changes the same day. The site is for businesses and is not aimed at children.
- The regulator
- Information Commissioner's Office
- Helpline
- 0303 123 1113
- Post
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF