SubbyTeam Privacy Policy

1. Who We Are

SubbyTeam provides software to businesses and their authorised users.

Depending on how you use SubbyTeam:

• SubbyTeam may act as a data controller for information relating to customer accounts, subscriptions, support, security and administration.
• A business using SubbyTeam will normally be responsible for the employee and workforce information it enters into the platform.
• In those circumstances, SubbyTeam may process that information on behalf of the business.

Employees should also refer to their employer's own privacy or employee-monitoring policies where applicable.

2. Information We May Collect

The information collected depends on which SubbyTeam features are being used.

This may include:

Account information

• First name
• Last name
• Email address
• Mobile number
• Company or business name
• Company ID
• User role
• Login and authentication information
• Profile photograph

Employee and staff profile information

Where provided by the user or their employer, this may include:

• Home address
• Date of birth
• Emergency contact details
• Employment or worker information
• Preferred working arrangements
• Full-time, part-time or seasonal status
• Working hours
• Workplace or site assignments
• Manager or reporting relationships

Shift and attendance information

SubbyTeam may process:

• Scheduled shifts
• Clock-in times
• Clock-out times
• Attendance records
• Late attendance records
• Missed clock-ins
• Timesheets
• Hours worked
• Work locations
• Shift changes and swaps
• Time-off requests
• Absence information

Location information

Where location-based features are enabled, SubbyTeam may use location information to help confirm that a worker is at the correct workplace when using features such as GPS clock-in or clock-out.

Depending on the feature and device permissions, this may include approximate or precise device location.

SubbyTeam does not use employee location information for advertising.

Location access should only be used for legitimate SubbyTeam workplace and attendance functionality.

Businesses using SubbyTeam are responsible for ensuring that their use of employee location information is appropriate, transparent and lawful.

3. NFC Clock-In and Clock-Out

SubbyTeam may allow employees to clock in or out by tapping a SubbyTeam NFC tag or sticker at an authorised workplace.

When an NFC tag is used, SubbyTeam may process information including:

• NFC site or tag identifier
• Workplace
• User account
• Date
• Time
• Clock-in or clock-out action
• Related attendance information

NFC access is used to recognise authorised SubbyTeam workplace tags.

SubbyTeam does not use NFC functionality to read payment card information.

4. Device Permissions

Certain SubbyTeam features require permission from your phone or tablet.

Permissions are only requested when required for the relevant functionality.

Location

Location permission may be required for:

• GPS clock-in
• GPS clock-out
• Workplace verification
• Location-based attendance features

Depending on how a feature is configured, your device may request access to precise or approximate location.

Where background location is genuinely required for a specific feature, SubbyTeam will request the appropriate device permission and explain why it is needed.

You may disable location permissions through your device settings, although some attendance features may stop working correctly.

NFC

On compatible devices, NFC may be used to recognise SubbyTeam workplace tags and initiate attendance actions.

NFC access does not give SubbyTeam unrestricted access to everything scanned by your device.

Camera and Photos

Camera or photo-library access may be requested when you choose to:

• Upload a profile photograph
• Take a workplace photograph
• Report a workplace problem
• Upload supporting images
• Add documents or other permitted content

SubbyTeam does not access your camera or photographs without the relevant permission or user action.

Microphone and Voice Features

If voice features such as SubbyTeam PA are enabled, microphone permission may be requested when you choose to speak to the service.

Voice information may be processed to understand your request and provide a response.

Where third-party technology is used to process speech or AI requests, information will only be shared where necessary to provide that functionality and subject to appropriate safeguards.

You can choose not to enable microphone access and use non-voice features instead where available.

Notifications

SubbyTeam may request permission to send push notifications.

These may include:

• Shift reminders
• Shift changes
• Clock-in reminders
• Attendance alerts
• Time-off updates
• Payslip notifications
• Workplace notifications
• Manager alerts
• Account and security notifications

Notification permissions can be changed at any time through your device settings.

Face ID, Fingerprint and Device Biometrics

SubbyTeam may allow supported devices to use Face ID, fingerprint or another device-level biometric authentication method.

Your fingerprint or facial biometric template is managed by your phone's operating system.

SubbyTeam does not receive or store a copy of your fingerprint or Face ID biometric template.

SubbyTeam only receives confirmation from the device that authentication succeeded or failed.

Files and Documents

Where you choose to upload or download information, SubbyTeam may request access required by your device to select, save or view documents.

5. Device and Technical Information

We may automatically process limited technical information necessary to operate, secure and improve SubbyTeam.

This may include:

• Device type
• Operating system
• App version
• IP address
• Browser information
• Login timestamps
• Session information
• Security logs
• Crash information
• Diagnostic information
• Device or application identifiers where necessary

We may use this information to:

• Keep accounts secure
• Detect suspicious activity
• Diagnose errors
• Improve reliability
• Prevent abuse
• Understand technical performance

6. Payments and Subscriptions

Where a business purchases a SubbyTeam subscription, payment information may be processed by an authorised payment provider.

SubbyTeam may receive information such as:

• Subscription status
• Payment status
• Billing date
• Transaction reference
• Package or plan
• Last four digits or limited card information supplied by the payment provider

SubbyTeam does not need to store your complete debit or credit card number where payment processing is handled securely by the payment provider.

If payment is processed through Apple, Google or another payment provider, their privacy terms may also apply.

7. How We Use Information

We may use information to:

• Create and manage accounts
• Authenticate users
• Provide role-based access
• Operate staff dashboards
• Operate management dashboards
• Provide shift management
• Record attendance
• Provide clock-in and clock-out functionality
• Verify workplace location
• Operate NFC attendance
• Produce timesheets
• Manage time-off requests
• Provide payslip access
• Send notifications
• Provide SubbyTeam PA and support features
• Provide customer support
• Process subscriptions
• Maintain security
• Prevent misuse
• Diagnose technical problems
• Improve the SubbyTeam service
• Meet legal and regulatory requirements

We do not sell employee personal information to advertisers.

8. Lawful Bases for Processing

Where UK data-protection law applies, personal information may be processed on one or more lawful bases depending on the circumstances.

These may include:

Contract

Processing that is necessary to provide SubbyTeam services requested by a customer or user.

Legitimate Interests

Processing necessary for legitimate business interests such as:

• Operating SubbyTeam
• Maintaining security
• Preventing fraud
• Supporting customers
• Improving reliability

We consider these interests against the rights and interests of individuals.

Legal Obligations

Certain information may be processed or retained where required by law.

Consent

Where consent is the appropriate lawful basis, such as certain optional device permissions or communications, you may withdraw that consent.

Device permissions can normally be changed through your phone or tablet settings.

A business using SubbyTeam remains responsible for determining the appropriate lawful basis for employee information it collects and uses through the service.

9. Employers and Employee Monitoring

SubbyTeam provides tools that businesses can use to manage attendance and staff.

The business using SubbyTeam is responsible for ensuring its use of features such as GPS attendance, NFC attendance and employee records complies with applicable employment, privacy and data-protection requirements.

Businesses should make employees aware of:

• What information is collected
• Why it is collected
• When location information may be used
• Who can access the information
• How long records may be retained

SubbyTeam should not be used for secret or unlawful employee monitoring.

10. Who Can See Your Information

Information may be visible to authorised users within the organisation you work for or are associated with.

Access depends on the permissions and role assigned to the account.

For example:

• Employees may access their own staff information and available staff features.
• Managers may access information necessary for the people or locations they manage.
• Area managers may be given access to multiple locations.
• Owners or authorised administrators may have wider organisational access.

Businesses are responsible for assigning appropriate permissions to their users.

11. Service Providers

We may use trusted service providers to operate SubbyTeam.

These may include providers of:

• Cloud hosting
• Databases
• Authentication
• Email
• Push notifications
• Payment processing
• Analytics
• Error monitoring
• Customer support
• Artificial intelligence or voice-processing technology where enabled

Providers are permitted to process information only where required to provide their services and subject to appropriate data-protection arrangements.

Where information is processed outside the United Kingdom, appropriate legal safeguards will be used where required.

12. Artificial Intelligence

SubbyTeam may provide AI-assisted features such as SubbyTeam PA.

Information entered into an AI feature may be processed to understand the request and generate a response.

SubbyTeam PA is intended to assist users with business administration and navigation.

It should not be relied upon as a substitute for professional:

• Employment advice
• Legal advice
• Accounting advice
• Payroll advice
• Health and safety advice

Important decisions about employees should be reviewed by an authorised person.

SubbyTeam does not intend to make legally significant employment decisions solely through automated AI processing.

13. Data Security

We use technical and organisational measures intended to protect information from:

• Unauthorised access
• Accidental loss
• Misuse
• Alteration
• Disclosure
• Destruction

No internet-based service can guarantee absolute security.

Users are responsible for keeping passwords, PINs and devices secure and should notify SubbyTeam or their employer if they believe their account has been compromised.

14. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for:

• Providing the SubbyTeam service
• Maintaining business and attendance records
• Resolving disputes
• Preventing fraud or misuse
• Meeting legal requirements
• Establishing or defending legal claims

Different information may have different retention periods.

Where a business closes its SubbyTeam account, information may be deleted or anonymised after an appropriate retention period unless it must be retained for legal, accounting, security or dispute-related reasons.

Businesses may also retain copies of workforce records outside SubbyTeam.

15. Account Deletion

Users can request deletion of their SubbyTeam account through:

Settings → My Account → Delete My Account

or by contacting SubbyTeam.

Deleting an application login may not automatically require an employer to delete employment or attendance records that it is legally entitled or required to retain.

Where SubbyTeam processes workforce information on behalf of an employer, requests relating to those employment records may need to be directed to the employer.

16. Your Privacy Rights

Depending on applicable law and the circumstances, individuals may have rights including:

• The right to be informed
• The right to access personal information
• The right to correct inaccurate information
• The right to request deletion
• The right to restrict certain processing
• The right to object to certain processing
• The right to data portability where applicable
• The right to withdraw consent where consent is relied upon

Some rights are subject to legal exceptions.

Where information is controlled by your employer, your request may need to be made directly to that employer.

You have the right to object to processing based on legitimate interests in applicable circumstances.

17. Complaints

If you have concerns about how your information has been handled, please contact SubbyTeam first so that we can investigate.

You may also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

18. Changes to This Privacy Policy

We may update this Privacy Policy when:

• SubbyTeam features change
• Our data-processing practices change
• Technology changes
• Legal or regulatory requirements change

The latest version will always display its effective date.

Where a material change affects how personal information is used, we may provide an additional in-app or account notification.

19. Contact Us

For questions regarding privacy, personal information or account deletion, contact:

SubbyTeam

Operated by SUBBYHQ Limited

Email: hello@subbyteam.com

Please include enough information for us to identify the relevant account and understand your request.