App Privacy Policy

1. About this policy

This policy explains how the Hitdesk app for Android and iOS (“the app”) collects and uses personal data. Staff of companies that use Hitdesk use the app to manage their shifts, patrols, timesheets and reports. For our website, see our website Privacy Policy.

Hitdesk Automation Limited (“Hitdesk”, “we”, “us”) is registered in England and Wales under company number 15015834and is registered with the Information Commissioner's Office (ICO).

2. Who is responsible for your data

Your employer gives you access to the app and decides what data is collected and how it is used, so your employer is the data controller. Hitdesk processes the data on your employer's behalf, as their data processor, under a Data Processing Agreement.

Send questions or requests about your data to your employer first. You can also contact us at hello@hitdesk.co.uk, and we will help or pass your request on to them.

3. Location data

• When you clock in and out. The app records your location at that moment, to confirm you are at the right site.
• While you are clocked in. The app records your location continuously, in the background, until you clock out. Android shows a persistent “Shift in progress” notification and iOS shows its location indicator throughout.
• Arriving at and leaving your site (Android). On a day when you have a shift, the Android app sets a boundary around that shift's site and records when you enter or leave it, with your location at that moment. This can happen before you clock in and after you clock out, even when the app is closed. Your device does this without a notification.

The app does not record your location at any other time.

We use location data to:

• confirm that you are at the right site when you clock in, and when you arrive at and leave it
• check your welfare and safety while you are lone working
• record when patrols and checkpoints are visited
• show your employer’s control room where on-shift staff are, so that they can send the nearest person to an incident and see the routes driven for mobile patrols and response visits

Location data goes only to your employer's Hitdesk account. We do not sell it, use it for advertising or share it with advertisers or data brokers. Your employer sets how long it is kept, as part of your working records.

You can withdraw location permission at any time in your device settings. If you do, features that rely on location, such as site arrival, patrol verification and welfare checks, will stop working.

4. Other data the app collects

• Account and work information. Your name, email address, employee details, shifts, timesheets, messages, and the incident, patrol and other reports you submit.
• Photos and files. The app uses the camera when you choose to take a photo or scan a code, for example to attach evidence to an incident report or to scan a checkpoint QR code. QR codes are read on your device.
• Clock-in photos. If your employer turns this on, the app may sometimes ask you to take a photo of yourself just after you clock in, so that they can confirm who is on shift. The photo is sent to your employer's Hitdesk account.
• Device identifiers. A push-notification token so that the app can send you shift, message and welfare alerts.
• Biometrics. You can choose to unlock the app with your fingerprint or face. Your device carries out this check, and Hitdesk never receives your biometric data.

The app does not contain advertising, and it does not use third-party analytics or tracking.

5. Who we share your data with

We do not sell your personal data. We share it only as needed to run the app:

• Your employer, through their Hitdesk account.
• Cloud hosting providers (AWS), which store and process data on our behalf under data processing agreements.
• Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS), which receive your push token and the content of notifications so they can deliver alerts.
• Mapping and routing providers, which receive locations to work out drive times when your employer sends someone to a job.
• Law enforcement or regulators, where the law requires us to disclose information.

6. Security and retention

All data sent between the app and Hitdesk is encrypted in transit. Your employer decides how long your data is kept, in line with their legal obligations, such as for timesheets and incident records. When your employer stops using Hitdesk, their data is deleted or returned under the terms of their contract with us.

7. Your rights and deleting your data

Under UK GDPR, you have the right to:

• access the personal data held about you
• ask for inaccurate data to be corrected
• ask for your data to be deleted
• object to how your data is processed
• complain to the ICO at ico.org.uk

To use these rights, or to delete your account and its data, contact your employer or email hello@hitdesk.co.uk. Some records, such as timesheets, may have to be kept for as long as the law requires.

8. Changes to this policy

We may update this policy when the app changes. The “last updated” date at the top of this page shows the most recent revision.