1. Who is responsible
Your employer (the business you work for) decides how Verimly is used and is the controller of your data. Verimly, which provides Verimly, processes your data on your employer’s behalf as its processor. Your employer should also inform you about its own policies, such as how timesheets are approved and how tips are shared.
For questions or to exercise your rights, contact your employer first. If you cannot reach your employer, write to privacy@verimly.com and we will forward your request.
2. What is recorded
| Area | Data | Purpose |
|---|---|---|
| Staff profile | Name, employee code, phone number, email address, role and permissions, the locations you work at | To give you the right access |
| POS sign-in | Your personal PIN (stored only in hashed form), the terminal you are signed in to, time of last sign-in | So that every sale and cash movement is recorded in the name of the person who did it |
| Actions on the POS and in the back office | Orders, payments, discounts, voids, refunds, cash counts and other actions, with time, device and, where applicable, the manager who approved | Accountability, cash reconciliation and preventing errors and fraud |
| Time clock | Clock-in and clock-out times, breaks, the device and location used, notes, corrections and who made them, approval status. Your physical location (GPS) is not recorded | Registering working hours and preparing payroll |
| Planning | Schedules, open shifts, swap and give-away requests, availability, days you are unavailable, time-off requests and their type | Making schedules and handling requests |
| Pay rates | Hourly wage and employer costs, if your employer enters them. Only people with the relevant permission can see them | Calculating labour costs |
| Sales and tips | Sales attributed to you, your share of tip pools, and, if your employer uses score-based tip pooling, your scores | Performance reports and sharing tips |
| Staff portal | The email address or phone number you sign in with, devices and sessions, notification preferences and messages | Giving you access to your shifts, hours and tips |
If you request time off because you are ill, your employer should record only that you are absent, not why. Do not include medical details in notes.
3. Legal basis
- Necessary for your employment contract, for example for paying wages and tips (art. 6(1)(b) GDPR).
- Necessary for your employer’s legal obligations, for example working time records and tax and bookkeeping requirements (art. 6(1)(c)).
- Your employer’s legitimate interest in running its business, accountability for cash and sales, and preventing fraud (art. 6(1)(f)). You may object to processing based on this interest.
4. How score-based tip pooling works
If your employer shares tips based on scores, Verimly calculates a suggestion for each person’s share. The suggestion combines the hours you worked with: punctuality and attendance (compared with your scheduled shifts), sales per hour compared with the team average (limited to at most 1.25 times the average, so that one high performer cannot take a disproportionate share), and any scores entered by managers, according to weights your employer has chosen. A manager reviews and finalises every tip pool before it takes effect. Decisions are therefore not taken solely by automated means.
You can see your tips and scores in the staff portal. If you disagree with a score or your share, ask your employer to explain and review it.
5. Who can see your data
- People at your employer with the relevant permissions, such as managers and payroll staff. Your colleagues can see your name and, for swaps, your shifts.
- Verimly, only as far as necessary to provide, secure and support the service.
- Verimly’s sub-processors for hosting and for sending sign-in codes and notifications (listed on the Subprocessors page).
- Where your employer uses the AI assistant in Verimly, the AI providers Anthropic and Voyage AI (listed on the Subprocessors page) process the data the assistant looks up, on your employer’s behalf. The AI features are not designed for decisions about you, such as hiring, firing, disciplining or pay, and your employer is not permitted to use them for that under our terms.
- Your employer may export timesheets and tips, for example for its payroll provider or accountant.
6. Your calendar link and sign-in
The staff portal can give you a personal calendar link to see your shifts in your calendar app. Anyone with the link can see your shifts, so treat it like a password. You can renew the link in the staff portal, which stops the old one working. Sign-in codes are valid for 10 minutes; you can see and end your active sessions in the staff portal.
7. Retention and your rights
Your employer decides how long it keeps your data, within legal requirements. For example, Dutch law requires working time and payroll records to be kept for a number of years after they were made. When you leave, your employer can deactivate your access; records of past sales and hours remain for accountability and legal purposes.
You have the right to access, correct and erase your data, to restrict or object to its processing, and to data portability, within the limits of the law. Contact your employer to exercise these rights. You may also lodge a complaint with the Autoriteit Persoonsgegevens or the data protection authority in your country.