Your data, in your control.

1. Who we are and how this policy works

Imperago On the Go is a mobile app for employees and managers of organisations that use the Imperago workforce management platform. It is developed, hosted and supported by HFX Limited, part of the AdvT Group.

Your employer (or the organisation that gave you access to the app) decides what the app is used for, which features are switched on and how long records are kept. In data protection terms your employer is the data controller and HFX is the data processor, acting on their written instructions under a contract with them. Your employer's own privacy notice tells you how they use your data as an employer. This policy covers what happens inside the app and on our systems.

Where HFX processes data for its own purposes, for example when you contact our support desk, the AdvT Group privacy policy at advt-group.com/privacy-policy applies alongside this one.

2. What the app collects

The app collects only what it needs to do the job your organisation has set it up for. The table below lists each type of data, where it comes from and why it is used.

The app does not collect your contacts, photos, messages, browsing activity or data from other apps. It does not use advertising identifiers or serve advertising.

3. Location data

The app can use the GPS location of your device in two ways. They work differently and you control both.

Location when you clock in or out

When you clock in or out, the app sends your location with the clocking so that Imperago can assign it automatically to a specific tag, such as a place of work or a site. This gives your organisation an accurate record of where work was carried out.

Location tracking

Separately, the app has the capability to send your location periodically so that your organisation can see where staff are and map their location. This is used to improve efficiency, particularly where an organisation needs to reassign jobs, tasks or locations to staff as its customers require.

Your organisation decides whether the tracking feature is available at all. Where it is, you remain in full control of whether and when it runs on your device.

All location data is sent to the Imperago platform and held in a secure data centre in England. Tracking data is kept for 7 days by default; see section 7.

4. How data is used

HFX uses the data collected by the app only to provide the Imperago service to your organisation and to keep it secure and working. In practice that means:

• recording your clockings, requests and absences and showing you your roster and balances;
• assigning clockings to places of work using location, where enabled;
• showing location to your organisation during the times you have chosen, where you have switched tracking on;
• sending you notifications about rota changes, approvals and reminders;
• authenticating you, protecting your account and detecting misuse;
• diagnosing and fixing faults in the app and the platform;
• meeting our legal obligations and the terms of our contract with your organisation.

The purposes for which your organisation uses the data, and its lawful basis for doing so, are set out in its own privacy notice. HFX does not use app data for marketing, profiling or any purpose of its own beyond running and supporting the service.

5. Who we share data with

We do not sell or rent personal data, and we do not share data collected by the app with third parties unless your organisation instructs us to in writing.

The only parties that have access to app data are:

• Your organisation, whose authorised administrators and managers see the data the app collects according to the permissions they hold in Imperago.
• HFX staff, where access is needed to host, support and maintain the service, under strict access controls and confidentiality obligations.
• Other AdvT Group companies, only where they provide shared support or infrastructure services to HFX under the same controls.
• Apple and Google, who deliver push notifications to your device. Notification content is limited to what is needed to alert you, and these providers do not receive your clocking or location records.
• Regulators, courts or law enforcement, where we are required to by law.

6. Where data is stored

Data collected by the app is sent to the Imperago platform and held in a secure data centre in England. We do not transfer app data outside the United Kingdom. HFX retains direct control over its hosting environment rather than relying on shared public cloud infrastructure, which means we know exactly where your data resides at all times.

Push notifications are delivered through Apple and Google services, which may route the notification itself through their own infrastructure outside the UK. We keep the content of notifications to a minimum for this reason.

7. How long we keep it

Location tracking data is kept for 7 days by default and then deleted. Your organisation may set a longer period under its own policy, and should tell you if it has.

Clocking records, requests, absences, rosters and balances form part of your organisation's employment records. They are kept for as long as your organisation instructs us to under its contract with HFX and its own retention policy, and are deleted or returned in line with the HFX data retention statement when the contract ends.

Device and diagnostic data is kept only as long as needed to run the service and investigate faults. Push notification tokens are removed when you sign out or uninstall the app.

8. Security

HFX is certified to ISO/IEC 27001, the international standard for information security management. Our certification is independently audited and covers the systems that host and process app data. The measures we apply include:

• encryption of data in transit between the app and the Imperago platform;
• role based access controls, so staff and managers only see the records their permissions allow;
• secure authentication for your account, with the option for your organisation to require additional verification;
• monitoring, logging and patching of the hosting environment under our direct control;
• backup and recovery procedures tested as part of our ISO 27001 management system.

Keep your login details private and sign out if you share a device. If you believe your account has been accessed without your permission, tell your organisation and HFX support straight away.

9. Your controls in the app

The app is designed so that you decide what is shared from your device.

• Location permission. Your device asks for permission before the app can use location. You can grant it, limit it to while the app is in use, or decline it, and change this later in your device settings.
• Tracking schedule. Where your organisation has enabled tracking, the app's settings let you switch it on, set the days and times it runs, and switch it off again.
• Notifications. You can turn push notifications off in your device settings at any time.
• Sign out. Signing out ends the app's access to your account on that device and removes the notification token.
• Uninstall. Removing the app deletes any data stored locally on your device. Records already sent to Imperago remain with your organisation under its retention policy.

10. Your rights

Under UK data protection law you have rights over your personal data, including the right to access it, to have it corrected or deleted, to restrict or object to how it is used, to receive a copy in a portable format, and to withdraw consent where consent is the basis for processing.

Because your organisation is the data controller, requests to exercise these rights should go to your organisation in the first instance, usually through HR or your line manager. HFX will support your organisation in responding, and will act on its instructions.

If you are unhappy with how your data has been handled you can also complain to the Information Commissioner's Office at ico.org.uk, although we would ask that you raise the matter with your organisation or with us first so that we can put things right.

11. Device permissions the app asks for

The app does not request access to your camera, microphone, contacts, photos, calendar or files.

12. Children

The app is provided to employees and workers of organisations that use Imperago. It is not directed at children and we do not knowingly collect data from anyone under 16 through it. Access is only granted by an organisation to its own workforce.

13. Changes to this policy

We review this policy when the app changes or the law requires it. The date and version at the top of the page show when it was last updated. Where a change materially affects how your data is used, we will tell your organisation so that it can let you know, and we may also show a notice in the app.

14. Contact

For questions about how your organisation uses the app, contact your organisation directly.

For questions about this policy or how HFX handles data, contact:

• HFX support: support@hfx.co.uk or 0330 122 7200
• AdvT Group Data Protection Officer: DPO@advt-group.com
• Post: The AdvT Group, 11 Buckingham Street, London, WC2N 6DF

HFX Limited is part of the AdvT Group. The group privacy policy is at advt-group.com/privacy-policy.