AROHub Privacy Notice
Last updated: 22 August 2026

1. About this Privacy Notice
AROHub ("AROHub", "the Platform", "we", "us" or "our") is a digital business, workforce, recruitment and property-management platform used by ARO businesses, their employees, workers, candidates, clients, customers and authorised users.
AROHub is committed to protecting personal information and processing it lawfully, fairly and transparently.
This Privacy Notice explains:

• what personal information we collect;

• why we collect and use it;

• how information is stored and shared;

• how long we retain information;

• how technology and artificial intelligence may be used;

• your rights in relation to your information; and

• how to contact us about privacy or data protection.

This Notice should be read alongside any specific candidate, employee, worker, customer or client privacy information provided to you.
2. Who is responsible for your information?
AROHub is operated within the ARO group of businesses.
Depending on the service being provided and your relationship with AROHub, the organisation responsible for determining how and why your personal information is processed may include ARO Resourcing Ltd and/or the relevant ARO business providing the service.
In some circumstances, AROHub may process information on behalf of another organisation, such as an employer, client or contracting organisation. In those circumstances, that organisation may be the data controller and AROHub or the relevant ARO business may act as a data processor.
For privacy and data-protection enquiries, contact:
Email: info@aromgmt.com
Website: aromgmt.com
Platform: arohub.io
3. Who this Notice applies to
This Privacy Notice may apply to:

• employees;

• temporary workers and contractors;

• job applicants and recruitment candidates;

• former employees and workers;

• clients and prospective clients;

• client representatives;

• property owners and landlords;

• guests, lodgers and customers;

• suppliers and service providers;

• AROHub administrators;

• authorised business users; and

• visitors to AROHub.

The information collected depends upon your relationship with us and which AROHub services you use.
4. Information we may collect
Account and identity information
We may collect:

• full name;

• email address;

• telephone number;

• username and account identifiers;

• profile information;

• organisation or employer;

• job title and role;

• account permissions;

• authentication information; and

• account activity.

We do not store passwords in readable form where authentication is handled through an appropriately configured authentication provider.
Employment and worker information
Where AROHub is used for workforce management, we may process:

• employment or engagement details;

• job title and department;

• manager or reporting structure;

• start and end dates;

• working arrangements;

• employment documentation;

• working hours;

• timesheets;

• attendance records;

• pay-related information;

• payroll records;

• bank/payment information where required;

• leave and holiday requests;

• absence information where appropriate;

• objectives and goals;

• performance information;

• training and development records;

• onboarding information; and

• other information necessary to manage a working relationship.

Recruitment and candidate information
Where AROHub is used for recruitment, we may process:

• CVs and applications;

• employment history;

• qualifications and skills;

• interview notes;

• interview scores and assessments;

• availability;

• salary or rate expectations;

• references;

• recruitment communications;

• right-to-work information;

• identity documentation;

• DBS-related information where legally appropriate and necessary;

• onboarding records; and

• recruitment status and decisions.

Where special category or criminal offence information is processed, we will only do so where we have an appropriate lawful basis and additional legal condition.
Client and CRM information
AROHub may store information relating to clients and business contacts, including:

• names;

• business contact information;

• company details;

• role and position;

• enquiries;

• correspondence;

• services provided;

• contracts;

• invoices and payment information;

• meeting or interaction records; and

• account management information.

Property, booking and guest information
Where AROHub is used to manage accommodation, bookings or property operations, we may process:

• guest/customer name;

• contact details;

• booking dates;

• property or room booked;

• number of guests;

• payment status;

• booking communications;

• check-in/check-out information;

• service requests;

• complaints or incidents; and

• other information required to administer the booking.

Documents and uploads
Users may upload documents, images or other information to AROHub.
Depending upon the service, these may include:

• CVs;

• employment documentation;

• timesheets;

• invoices;

• identity or compliance documentation;

• property photographs;

• booking-related documents;

• operational photographs or videos; and

• other files required to provide or administer ARO services.

Users should only upload information that they are authorised to provide.
Technical and security information
When you access AROHub, we may automatically collect information such as:

• IP address;

• browser and device information;

• login dates and times;

• authentication events;

• system activity;

• audit logs;

• security events;

• error information; and

• cookie or similar technology information.

This information may be used to operate, protect, troubleshoot and improve the Platform.
5. Where we obtain information
Information may be obtained:

• directly from you;

• from an employer or organisation you work for;

• from an ARO client;

• from recruitment agencies or recruitment platforms;

• from referees;

• from publicly available professional sources where appropriate;

• from property booking platforms;

• from authorised ARO employees;

• from suppliers or service providers;

• automatically when you use AROHub; or

• from another lawful source connected with the service being provided.

6. Why we use your information
We may process personal information to:

• create and administer AROHub accounts;

• authenticate users and protect accounts;

• manage employees, workers and contractors;

• process and approve timesheets;

• administer payroll and payments;

• manage leave and absence;

• administer onboarding;

• manage employee goals and performance;

• provide recruitment and staffing services;

• assess and communicate with candidates;

• conduct appropriate employment or recruitment checks;

• manage clients and business relationships;

• manage property and accommodation bookings;

• communicate with guests and customers;

• manage invoices and payments;

• provide customer support;

• send operational notifications;

• maintain business and financial records;

• detect misuse, fraud or security threats;

• maintain audit trails;

• comply with legal and regulatory obligations;

• establish, exercise or defend legal claims;

• improve AROHub and ARO services; and

• develop or operate new Platform functionality.

We will not use personal information for purposes that are incompatible with the purpose for which it was originally collected unless permitted by law.
7. Our lawful bases
Depending upon the processing activity, we may rely on one or more of the following lawful bases:
Contract
Processing may be necessary to enter into or perform a contract with you, including employment, worker, recruitment, accommodation or service arrangements.
Legal obligation
We may process information where necessary to comply with legal obligations, including employment, tax, accounting, immigration, safeguarding and regulatory requirements.
Legitimate interests
We may process information where necessary for legitimate business interests, provided those interests are not overridden by your rights and interests.
These interests may include:

• operating AROHub;

• administering our workforce;

• providing recruitment and business services;

• managing client relationships;

• protecting our systems;

• preventing fraud;

• maintaining business records;

• improving our services; and

• establishing or defending legal claims.

Consent
Where required, we may ask for your consent.
Where processing relies upon consent, you may withdraw that consent at any time. Withdrawal does not affect processing already lawfully carried out before consent was withdrawn.
Special category and criminal offence information
Where we need to process special category information or criminal offence information, we will identify an appropriate additional condition under applicable data-protection legislation and maintain appropriate safeguards.
8. Timesheets and payroll
AROHub may be used to submit, review and approve working hours.
Timesheet information may be shared with authorised managers, payroll personnel, accountants, clients or other organisations involved in confirming hours or processing payment.
Payroll and payment information will only be accessible to people who require access for legitimate business purposes.
9. Recruitment and candidate assessments
AROHub may be used to manage recruitment applications, interviews, assessments and onboarding.
Candidate information may be reviewed by authorised ARO staff and, where appropriate, relevant prospective employers or clients.
Candidate assessments, scores or recommendations are intended to support recruitment decisions and should not, unless expressly permitted by law with appropriate safeguards, be treated as the sole basis for a legally or similarly significant decision about a candidate.
10. Artificial intelligence and automated tools
ARO may use artificial intelligence ("AI"), automation or machine-assisted tools to support certain business activities.
These may include, for example:

• summarising information;

• assisting with administrative work;

• analysing operational information;

• reviewing property or room-preparation photographs;

• generating draft communications;

• organising or categorising information;

• supporting recruitment administration or analysis; and

• identifying potential errors, omissions or inconsistencies.

Where personal information is processed using an AI or automated service, we will assess the purpose, necessity, data-protection implications and appropriate safeguards.
AI-generated recommendations or assessments may be subject to human review.
Unless otherwise permitted by applicable law with appropriate safeguards, ARO does not intend to rely solely on AI to make significant employment, recruitment, disciplinary or similarly consequential decisions about individuals.
Where we introduce processing that creates a high risk to individuals, we will consider whether a Data Protection Impact Assessment is required before implementation.
11. Who we may share information with
Where necessary and lawful, personal information may be shared with:

• authorised ARO employees and managers;

• companies within the ARO group;

• employers and prospective employers;

• recruitment clients;

• payroll providers;

• accountants and professional advisers;

• IT and cloud service providers;

• hosting and database providers;

• authentication providers;

• email and communications providers;

• automation providers;

• AI service providers where applicable;

• payment providers;

• property owners or managers where necessary;

• booking platforms;

• government departments;

• local authorities;

• regulators;

• law-enforcement agencies; and

• other organisations where disclosure is required or permitted by law.

We require service providers processing personal information on our behalf to handle that information appropriately and only for authorised purposes.
We do not sell personal information.
12. International transfers
Some technology, cloud, communications, automation or other service providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps to ensure the transfer complies with applicable UK data-protection law.
Depending upon the destination and circumstances, this may include reliance upon:

• UK adequacy regulations;

• recognised appropriate safeguards;

• approved contractual protections; or

• another lawful transfer mechanism.

13. How long we keep information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, contractual, accounting, regulatory and dispute-resolution requirements.
Retention periods differ according to the type of information.
As a general approach:

• unsuccessful recruitment information will normally be reviewed for deletion or anonymisation after the relevant recruitment and reasonable claims period;

• employee and worker information may be retained for the duration of the relationship and for an appropriate period afterwards;

• payroll, accounting and transaction records may be retained for periods required by tax and accounting legislation;

• client and contractual information may be retained for the duration of the relationship and an appropriate period afterwards;

• booking and transaction information may be retained where required for accounting, contractual or legal purposes;

• security and technical logs will normally be retained only for the period reasonably required for security, troubleshooting and audit purposes; and

• uploaded documents will be deleted or anonymised when they are no longer reasonably required, subject to legal or contractual retention requirements.

ARO periodically reviews stored information and may securely delete or anonymise information that is no longer required.
14. Information security
We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
These measures may include:

• account authentication;

• role-based access controls;

• restricted administrative access;

• encryption where appropriate;

• private file storage;

• security logging;

• backups;

• access reviews;

• secure cloud infrastructure; and

• staff access controls and confidentiality obligations.

No internet-based system can be guaranteed to be completely secure. Users are responsible for keeping their login credentials confidential and must notify us promptly if they suspect unauthorised access to their account.
15. Data breaches
Suspected personal-data breaches are assessed and investigated.
Where required by applicable law, we will notify the Information Commissioner's Office ("ICO") and/or affected individuals within the applicable legal timeframe.
Users should report suspected security or privacy incidents promptly to ARO.
16. Your data-protection rights
Depending upon the circumstances and applicable lawful basis, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• request correction of inaccurate information;

• request deletion of information;

• request restriction of processing;

• object to certain processing;

• request portability of certain information;

• withdraw consent where processing relies upon consent; and

• exercise rights relating to automated decision-making.

These rights are not absolute and may be subject to legal exemptions.
We may need to verify your identity before responding to a request.
17. Your right to object
You have the right to object to processing based on legitimate interests in certain circumstances.
Where personal information is used for direct marketing, you may object to that use at any time.
18. Complaints
If you have concerns about how your personal information has been handled, please contact ARO first so that we can investigate.
You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
ico.org.uk
19. Children's information
AROHub is primarily intended for business, workforce, recruitment, property-management and authorised operational use and is not designed as a general service for children.
Where information relating to children or young people must be processed in connection with safeguarding, recruitment, employment or contracted services, additional care and appropriate legal safeguards will be applied.
20. Changes to this Privacy Notice
We may update this Privacy Notice where AROHub, our services or applicable legal requirements change.
Material changes may be communicated through AROHub, email or another appropriate communication method.
The latest version will always display its most recent revision date.
21. Contact us
For questions, requests or concerns relating to privacy or personal information:
AROHub Privacy Team
Email: info@aromgmt.com
Website: aromgmt.com
Platform: arohub.io