1. Who we are
OraSpere Ltd (trading as OraSpere) operates www.oraspere.com. It is registered in England and Wales under company number 17481717. Its registered office is 61 Bridge Street, Kington, United Kingdom, HR5 3DJ. In this policy, “OraSpere”, “we”, “us” and “our” mean OraSpere Ltd.
For our own website enquiries, business correspondence and subscription billing, OraSpere Ltd is the controller. For an employer's workforce records in the platform, that employer normally decides why and how its staff data is used, while OraSpere provides the service under its instructions. The applicable customer agreement and each employer's staff privacy notice must identify the actual roles. Contact us at admin@oraspere.com.
2. Information we collect
We may collect information you provide directly through our contact form or by email, including:
- full name;
- email address;
- contact telephone number;
- enquiry type;
- restaurant, organisation or business details, where provided; and
- message content and subsequent correspondence.
We may also receive limited technical information necessary to deliver and secure the website, such as IP address, browser type, device information, requested URL, timestamps and server or security logs. We do not currently use Vercel Web Analytics, Google Analytics, advertising pixels or behavioural tracking tools on the marketing website.
For customer subscriptions and invoices, we may process a business contact's name, work email, billing address, company details, invoice items, amounts, payment status and related correspondence. We do not ask for payment-card details through the general contact form.
Do not submit special category information, confidential employee records, health information, payment-card details or other sensitive information through the general contact form.
3. How we collect information
We collect personal information when you submit the contact form, email us, request a demonstration or commercial discussion, or interact with the website where hosting and security systems generate technical logs.
4. Purposes and lawful bases
| Purpose | Information used | Lawful basis |
|---|---|---|
| Responding to enquiries and arranging demonstrations | Identity, contact, business and message information | Legitimate interests in responding to business enquiries; and steps requested before entering into a contract where applicable |
| Discussing services, pricing or commercial arrangements | Identity, contact, business and correspondence information | Steps requested before entering into a contract; and legitimate interests in developing our business |
| Managing subscriptions, invoices and payments | Business contact and billing details, invoices, payment status and correspondence | Contract where the contact is a party; legitimate interests in administering business customer accounts; and legal obligations for accounting and tax records where applicable |
| Operating, protecting and troubleshooting the website | Limited technical and security-log information | Legitimate interests in maintaining a secure, reliable website |
| Meeting legal requirements and protecting legal rights | Relevant contact, correspondence and technical information | Legal obligation and legitimate interests |
5. Contact form
Our website contact form is submitted to an OraSpere same-origin Vercel API. We validate and limit the submission before using Resend to deliver the enquiry to our business mailbox. Do not use the form for special-category information, employee files, passwords, payment-card information or other highly confidential material.
6. Hosting and service providers
- Vercel, which hosts and delivers the website and application and may process technical request, network and security-log data;
- Resend, which delivers website enquiries and transactional service communications such as account invitations, password-reset messages, starter invitations and invoices;
- Supabase, which provides application database services and private document storage for the workforce platform; and
- Zoho Mail, which stores and delivers OraSpere business email, enquiries and correspondence.
We also use n8n for selected configured workflow automation. Depending on the deployed route configuration, this may include retained rota generation/publication and other workforce workflow integrations. We review enabled routes and data fields as part of deployment and customer onboarding.
We may disclose information to professional advisers, regulators, law-enforcement bodies or courts where reasonably necessary or legally required. We do not sell personal information.
6A. Workforce platform and employee information
Customer organisations use OraSpere to manage store staffing. Depending on the modules they enable, records may include names, Staff IDs, contact details, date of birth, home address and emergency contacts; employment, pay, contracted-hours, student and under-18 status; rota, availability, shift-swap, clock, attendance and timesheet records; holiday; sickness, return-to-work information and fit notes; onboarding, right-to-work, passport/ID, visa, tax, training, disciplinary and other employee documents; manager accounts, permissions and audit records; and limited device, IP-address and user-agent information used for security and clock-event integrity.
Sickness records, fit notes and return-to-work information are health information and therefore special-category data. Identity, right-to-work, tax, pay and disciplinary records also require heightened access, minimisation and retention controls. Managers access only their authorised organisation and stores; employees use a separate portal that can resolve their permitted store from a company or store link.
Workforce records are processed to provide the service selected by the customer organisation, including rota planning, workforce operations, absence management and payroll preparation exports. The employer must give staff its own notice explaining its purposes, lawful bases, any special-category condition, retention periods and recipients. OraSpere does not determine an employer's legal basis or retention schedule through this website notice. To request access, correction or deletion of employment records, contact your employer first; you may also contact us so we can direct the request to the appropriate customer organisation.
The platform uses Vercel for the application, Supabase for database and private document storage, Resend for transactional service emails, and n8n for selected configured workflow automation, which may include retained rota generation/publication and other workforce workflow routes where enabled. Access to workforce documents is subject to customer-authorised roles and short-lived access links. See the Cookie Policy for manager sessions and employee browser storage.
OraSpere's private AI Office is for OraSpere's own business, not a customer's employee workspace. Optional AI-provider and company-mail connections require separate activation. Before enabling them, we will review the provider, information sent to it and applicable transfer safeguards. We do not use the private AI Office to process a customer's employee records.
The service can generate rota, coverage and workforce recommendations from employee availability, role, skill and working records. OraSpere does not itself make solely automated significant employment decisions. Customer organisations remain responsible for ensuring meaningful human involvement when OraSpere outputs inform employment decisions. If a customer configures processing that could produce legal or similarly significant effects, it must assess the applicable automated-decision rules, provide required information and safeguards, enable human intervention and review where required, and explain the processing to affected workers.
7. International transfers
Some service providers may process information outside the United Kingdom. Before OraSpere initiates a restricted transfer, we assess the relevant processing location and transfer route. Where UK adequacy regulations do not cover the destination, we use an appropriate safeguard where available, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and complete the required data protection test. We keep provider and transfer information under review when services or processing locations change.
You may ask admin@oraspere.com for current information about relevant providers and transfer safeguards.
8. Retention
We generally retain ordinary enquiries and related correspondence for up to 24 months after our last meaningful interaction. We may retain information longer where discussions become a customer relationship, records are needed for legal, accounting or dispute purposes, or the law requires a different period.
We retain issued invoices, recorded payments and related billing information for the period required by applicable accounting and tax law, and longer only where another lawful reason applies. Closing a customer account does not automatically erase records we must retain.
Technical and security logs are retained according to the relevant provider’s settings and only for as long as reasonably necessary for security, reliability and legal purposes.
Customer workforce retention and deletion are governed by the employer's agreed instructions, applicable law and the final customer agreement. This public policy does not set a universal retention period for employee records. Backup copies may persist for an agreed limited backup cycle; the customer contract and operational retention schedule must state what applies in practice.
Archiving a record is not the same as deleting it. Live records, archived records, exported files, provider logs, database backups and private document backups must each follow the agreed retention and erasure process. Where immediate removal from a protected backup is not technically possible, the record must be put beyond ordinary use and erased when that backup expires or is restored.
9. Security
We take reasonable technical and organisational measures to protect personal information. No internet transmission or storage system can be guaranteed completely secure.
10. Your rights
Depending on the circumstances and lawful basis, you may have rights to access, correct, erase, restrict, object to processing, receive certain information in a portable format, and withdraw consent where processing is based on consent.
For our own website or enquiry information, email admin@oraspere.com to exercise a right. For employer workforce data, contact the employer responsible for that data; you can also write to us and we will route the request to the relevant customer after appropriate identity and authority checks. Do not send sensitive records through the general website contact form.
11. Data protection complaints
You have the right to make a data protection complaint to us. Email privacy@oraspere.com or admin@oraspere.com and clearly state that you are making a data protection complaint. We will acknowledge a complaint within 30 days, investigate it appropriately, keep you informed where further time is needed, and communicate the outcome.
You do not have to complain to us before contacting the UK Information Commissioner’s Office (ICO), and contacting us does not affect your right to complain to the ICO.
12. Children and young workers
The public website is intended for business users and is not directed at children. Customer workforce records may, however, relate to lawful young workers or employees aged under 18. In that context the customer organisation is responsible for providing appropriate privacy information, using a valid lawful basis and applying any additional employment or safeguarding requirements that apply to young workers.
13. Automated decisions
We do not use information collected through the public website to make solely automated decisions producing legal or similarly significant effects. The workforce platform can generate recommendations, but OraSpere does not itself make solely automated significant employment decisions. Customer organisations must ensure meaningful human involvement and any other safeguards required by data protection and employment law when using platform outputs in significant decisions.
14. Changes
We may update this policy when our business, website, providers or legal obligations change. Material new uses of personal information will be brought to affected individuals’ attention where required.
15. Contact
OraSpere Ltd
Registered in England and Wales · Company number 17481717
Registered office: 61 Bridge Street, Kington, United Kingdom, HR5 3DJ
Email: admin@oraspere.com
Website: www.oraspere.com