Privacy Policy
Data controller: ExcelTTC Limited · Company number: NI740696
Registered office: 24 Phoenix Fields, Ballymena, BT42 2BF, United Kingdom
Effective date: 18 July 2026 · Privacy contact: contactus@workcura.com
This Privacy Policy (“Policy”) explains how ExcelTTC Limited (“ExcelTTC”, “WorkCura”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal information through the WorkCura website, web application and related services (together, the “Service”). WorkCura provides agency healthcare-worker shift management for staffing agencies, healthcare and care facilities, and healthcare workers.
This Policy applies to website visitors, prospective and registered customers, agency and facility representatives, authorised users, healthcare workers, people who contact us, and other individuals whose information is processed through WorkCura.
Important distinction. ExcelTTC is a controller for information used for its own account administration, billing, security, support, legal compliance and business operations. Where an agency or facility submits workforce information to WorkCura and determines why and how it is used, that organisation is normally the controller and ExcelTTC acts as its processor. You may therefore need to contact your agency or facility about information it controls.
1. Who we are and how to contact us
ExcelTTC Limited is a company registered in Northern Ireland under company number NI740696. Our registered office is 24 Phoenix Fields, Ballymena, BT42 2BF, United Kingdom.
For privacy questions, requests or complaints, contact:
- Email: contactus@workcura.com
- Support: support@workcura.com
- Post: Privacy Team, ExcelTTC Limited, 24 Phoenix Fields, Ballymena, BT42 2BF, United Kingdom
2. Our data-protection roles
2.1 When ExcelTTC is the controller
We act as controller when we decide the purposes and means of processing, including for:
- website operation and enquiries;
- customer registration, account administration and authentication;
- subscription management, billing and Stripe integration;
- service security, fraud prevention, audit trails and incident response;
- technical support, service communications and complaint handling;
- platform administration, service improvement and legal compliance; and
- establishing, exercising or defending legal claims.
2.2 When ExcelTTC is a processor
Agencies and facilities generally determine the purposes for which workforce, compliance, shift and timesheet information is entered into WorkCura. For that information, the relevant organisation is normally the controller and we process the information on its documented instructions under our contractual data-processing terms.
If you are a healthcare worker or facility contact and have questions about information entered by your agency or facility, contact that organisation first. We will assist it with your request where required.
3. Personal information we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, telephone number, postal or workplace address, organisation, job title and account role. |
| Account and authentication | User identifier, password hash, invitation and password-reset status, account status, login history, session information, accepted-Terms version and profile photograph. |
| Organisation information | Agency or facility name, company number, business contact details, locations, authorised representatives, subscription package and account configuration. |
| Workforce and professional | Role, work history, qualifications, professional registration, training, skills, references, availability and agency relationship. |
| Compliance documentation | Document type, uploaded files, issue and expiry dates, approval status and reviewer records. Depending on the document, this may include right-to-work, DBS or equivalent, health, training and professional information. |
| Shift and attendance | Shift requests, facility, location, assigned role, start and end times, breaks, attendance, cancellations, notes, approvals and status history. |
| Timesheet and signature | Hours worked, payable time, facility representative name, electronic signatures, declarations, timestamps, IP address and browser or device information associated with signing. |
| Pay, payroll and holiday | Hourly rates, calculated earnings, payable hours, payroll-run information, holiday accrual and holiday requests. WorkCura is not itself the worker’s payroll provider. |
| Billing and transaction | Subscription, invoice, payment status, Stripe customer/subscription references and transaction metadata. We do not store complete payment-card numbers. |
| Communications | Messages, notifications, enquiries, support correspondence, complaint records, delivery status and feedback. |
| Technical, security and audit | IP address, user agent, device/browser details, request identifiers, timestamps, access and activity logs, security events, error records and diagnostic information. |
| Website information | Pages requested, essential cookie/session information and information submitted through public forms. |
4. Where we obtain personal information
We obtain information:
- directly from you when you register, update a profile, upload a document, request or complete a shift, submit a timesheet, sign a record, send a message, contact support or make a complaint;
- from the agency or facility that creates your account, manages your work or submits information about you;
- from authorised administrators and other users involved in shift, compliance or timesheet workflows;
- automatically from your browser, device and use of the Service;
- from Stripe concerning subscription and payment status;
- from email-delivery and other contracted service providers; and
- from public or professional sources where an agency or facility lawfully uses them to verify registration or compliance.
5. How we use information and our lawful bases
We process personal information only where we have a lawful basis. The basis depends on our role and the circumstances.
| Purpose | Information commonly used | Lawful basis |
|---|---|---|
| Create and administer accounts; authenticate users; provide requested features | Identity, contact, account, organisation and technical information | Performance of a contract; legitimate interests in providing and administering the Service |
| Manage agency subscriptions, billing and payment status | Organisation, billing, transaction and account information | Performance of a contract; legal obligations; legitimate interests in receiving payment and administering subscriptions |
| Manage workers, facilities, availability, shifts, timesheets, payroll support and holiday workflows on a Customer’s instructions | Workforce, shift, attendance, timesheet, pay and holiday information | Processor activity under the controller’s instructions; where we are controller, contract and legitimate interests |
| Track qualifications, training and compliance | Professional and compliance information, including sensitive information where applicable | Processor activity under the controller’s instructions; legal obligations and legitimate interests where ExcelTTC acts as controller, together with an applicable special-category or criminal-data condition |
| Send invitations, security alerts, Trial-expiry reminders, service notifications and support communications | Identity, contact, subscription, account and operational information | Performance of a contract; legitimate interests in service administration, security and support; legal obligations where applicable |
| Secure the Service, prevent misuse, investigate incidents and maintain audit trails | Account, technical, security, audit and communications information | Legitimate interests in protecting users and the Service; legal obligations |
| Diagnose errors, maintain availability and improve usability and performance | Technical, diagnostic, error, audit and appropriately minimised usage information | Legitimate interests in maintaining and improving the Service |
| Respond to rights requests, complaints, regulators, courts and lawful authorities | Relevant account, communications, audit and case information | Legal obligations; legitimate interests in resolving disputes and protecting legal rights |
| Establish, exercise or defend legal claims and enforce our Terms | Any information relevant and proportionate to the claim | Legitimate interests; legal claims condition for special-category information where applicable |
Where we rely on legitimate interests, we assess the necessity of the processing and balance those interests against the individual’s rights and reasonable expectations. You may request information about that assessment.
Where processing relies on consent, you may withdraw consent at any time. Withdrawal does not affect processing already undertaken lawfully. We do not generally rely on consent where the processing is necessary to provide contracted business services or comply with law.
6. Special-category and criminal-offence information
Healthcare-worker compliance records may reveal health information, disability, vaccination or occupational-health status, trade-union information, racial or ethnic origin, or other special-category information. DBS and equivalent vetting records may contain criminal-offence information.
Agencies and facilities are responsible for ensuring that they have both an Article 6 lawful basis and an applicable Article 9 condition or criminal-offence processing authority before submitting such information. Depending on the circumstances, relevant conditions may include employment and social-protection law, assessment of working capacity, substantial public interest, legal claims or explicit consent where consent is genuinely appropriate.
Customers must minimise sensitive information, restrict access, keep it accurate, apply suitable retention periods and avoid uploading patient or service-user clinical information unless WorkCura has expressly agreed that a feature is designed and contracted for that purpose.
7. Who we share information with
We may disclose personal information, where necessary and proportionate, to:
- the agency, facility or other Customer responsible for the relevant account, worker, shift or timesheet;
- authorised users whose roles require access, such as agency managers, facility contacts and the relevant worker;
- Stripe for subscription checkout, billing, payment and customer-portal services;
- hosting, database, secure storage, backup, email-delivery, monitoring, support and security providers acting under contract;
- professional advisers, insurers, auditors and prospective purchasers or investors under appropriate confidentiality safeguards;
- courts, regulators, law-enforcement bodies, tax authorities and other public bodies where disclosure is required or permitted by law; and
- another organisation involved in a merger, reorganisation or transfer of the WorkCura business, subject to appropriate safeguards.
Our current service-provider information is published on the WorkCura Subprocessors page. We do not sell personal information.
8. International transfers
Some suppliers may process information outside the United Kingdom. Where personal information is transferred internationally, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, binding corporate rules or another lawful safeguard. We also assess whether supplementary technical or organisational measures are appropriate.
You may contact us for further information about safeguards relevant to your information. A Customer acting as controller may also be responsible for international transfers it initiates through WorkCura.
9. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose collected, including contractual, operational, safeguarding, tax, accounting, regulatory, dispute and legal-claim requirements. Retention may differ where an agency or facility controls the information.
| Record type | Typical approach |
|---|---|
| Accounts and Customer records | For the account or Customer relationship and a reasonable period afterwards for support, disputes, legal obligations and claims. |
| Worker, shift, timesheet, payroll-support and compliance records | As configured or instructed by the relevant controller and for applicable employment, tax, safeguarding, professional or contractual retention requirements. |
| Application error logs | Default operational retention: 90 days, unless changed by authorised platform settings or needed for an active investigation. |
| Email-delivery logs | Default operational retention: 180 days. |
| Audit logs | Default operational retention: 730 days. |
| Stripe event logs | Default operational retention: 730 days; Stripe separately retains information under its own policies. |
| Schema migration logs | Default operational retention: 365 days. |
| Expired password-reset tokens and expired sessions | Eligible for deletion after expiry under the configured cleanup process. |
| Complaints and rights requests | For as long as necessary to resolve the matter and demonstrate compliance, taking account of applicable limitation periods. |
| Backups | Deleted information may remain in protected backups until overwritten under the normal backup cycle; it is not restored for ordinary use. |
Information may be retained longer where required by law, subject to a legal hold, necessary for safeguarding or needed to establish, exercise or defend legal claims. When no longer required, it is deleted, securely destroyed or irreversibly anonymised.
10. How we protect information
We use technical and organisational measures appropriate to the nature and risk of the processing. Measures include, as appropriate, role-based access, authentication controls, password hashing, secure sessions, encryption in transit, private document storage, file validation, logging and monitoring, security headers, vulnerability and patch management, backups, recovery planning, supplier controls, staff confidentiality and incident-response procedures.
No internet service can guarantee absolute security. Users must protect credentials, use individual accounts, secure their devices and notify us promptly at support@workcura.com if they suspect unauthorised access or a data incident.
11. Automated rules and decisions
WorkCura uses rules to support administration, including role-based permissions, subscription and Trial-expiry restrictions, compliance-status checks, shift eligibility indicators, reminders, usage calculations and security controls. These rules may restrict access to features or prevent a shift request where required information is missing or expired.
WorkCura is not intended to make solely automated employment, recruitment, disciplinary or clinical decisions on behalf of Customers. Agencies and facilities remain responsible for reviewing information and making consequential decisions. If you believe a rule produced an incorrect or unfair outcome, contact the relevant agency or facility or email support@workcura.com to request human review.
12. Cookies and similar technologies
WorkCura uses strictly necessary technologies to provide secure sessions, authentication, security protections, preferences and core application functions. These technologies are necessary for the Service and cannot normally be disabled without preventing it from functioning correctly.
Payment pages or linked third-party services, including Stripe, may use their own cookies under their notices. If we introduce non-essential analytics, advertising or similar technologies, we will provide appropriate information and obtain consent where required before using them. Browser settings may block cookies, but blocking essential cookies will prevent sign-in or other features.
13. Service and marketing communications
We send operational communications needed to administer WorkCura, such as invitations, password resets, security alerts, shift and timesheet notifications, Trial-expiry reminders, billing messages and support responses. These are service communications rather than direct marketing.
If we send optional electronic marketing, we will do so only where permitted by law and will provide an unsubscribe method. Unsubscribing from marketing does not stop essential service or security messages.
14. Your data-protection rights
Depending on the circumstances, you may have the right to:
- be informed about how your personal information is used;
- request access to your personal information and receive a copy;
- ask us or the relevant controller to correct inaccurate or incomplete information;
- request erasure where there is no lawful reason to keep the information;
- request restriction of processing;
- receive information you provided in a structured, commonly used and machine-readable format and transmit it to another controller where data portability applies;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent where processing relies on consent;
- request safeguards relating to solely automated decisions where applicable; and
- complain to us and to the Information Commissioner’s Office.
Rights are not absolute and exemptions may apply. We may ask for information needed to verify your identity and authority. We normally respond within one month, although the period may be extended where the law permits for a complex or numerous request. We do not ordinarily charge a fee, but the law permits a reasonable fee or refusal in limited circumstances.
To exercise a right, email contactus@workcura.com. If an agency or facility controls the information, we may refer your request to it or ask you to contact it directly.
15. Data-protection complaints
You may complain to us about how we use your personal information by emailing contactus@workcura.com with the subject “Data Protection Complaint”, or by writing to our registered office. Please explain what happened, the information involved and the outcome you seek.
We will take reasonable steps to help you make a complaint, acknowledge it within 30 days, investigate it appropriately and respond without undue delay. We will tell you the outcome and, where appropriate, the steps taken or proposed.
You also have the right to complain to the UK Information Commissioner’s Office (“ICO”). Information is available at ico.org.uk/make-a-complaint. The ICO may generally be contacted by telephone on 0303 123 1113. We would appreciate the opportunity to address your concern first, but this does not affect your right to contact the ICO.
16. Children
WorkCura is a business workforce-management service intended for people aged 18 or over. It is not directed at children, and children must not create accounts or use the Service. If you believe a child’s information has been submitted inappropriately, contact us promptly.
17. Third-party websites and services
The Service may link to websites or services operated by other organisations. Their privacy practices are governed by their own notices, and we are not responsible for information they collect independently. Review the relevant notice before providing information.
18. Changes to this Privacy Policy
We may update this Policy to reflect changes in the Service, suppliers, law or our processing. We will publish the revised version at workcura.com/privacy and change the effective date. Where a change is material, we will provide an appropriate additional notice, such as an email or in-app message.
19. Contact details
ExcelTTC Limited
Company number NI740696
24 Phoenix Fields
Ballymena
BT42 2BF
United Kingdom
Privacy and complaints: contactus@workcura.com
Technical support: support@workcura.com
Website: https://workcura.com/
Related information: Terms of Use · Subprocessors