What we hold, why, and who can see it.

Your employer is the data controller. They decide that attendance is recorded, who may see it, and how long it is kept. Great White Design Ltd operates TradeZiller HR on their behalf as a data processor, which means we hold and protect the data but do not decide what it is used for.

In practice that is why most requests below go through your employer. If you ask us directly to delete your attendance history, we are not allowed to act on it without them — the record is theirs, and in many cases they are required by law to keep it.

For this website itself — the pages you are reading now — Great White Design Ltd is the controller.

Only what a screen actually needs. There is no advertising, no analytics profile, no tracking across other apps or sites, and nothing is ever sold or shared for marketing.

Who you are

Name, work email address, job title, and the identifiers your employer uses — an employee number or payroll reference. Your employer enters these; you cannot change your own email address, because it is the link to your workplace.

Attendance

The time of each clock in, clock out and break, the site it happened at, and the shift it belongs to. These records are never edited or deleted — a correction adjusts the day's totals and leaves the original scan intact, so the history can always be audited.

Location

Latitude, longitude and accuracy, read ONCE at the moment you scan a code, and only while the app is open in front of you. There is no background location and the app does not ask for permission to do it. It is used to say whether the scan happened at the site, and for nothing else. If you refuse the permission, or there is no signal, you are still clocked in.

Your device

An identifier for the app installation, the platform, and the IP address the request came from. This is what lets a manager see that a clock-in came from an unfamiliar phone. It never blocks you.

Leave and absence

Dates, the type of leave, and any reason recorded. A reason may include health information. Reasons marked sensitive are shown only to people your employer has given permission to see them, and are hidden on shared team calendars.

Health and safety

Documents you have read and acknowledged, training certificates and their expiry, tasks assigned to you, machine inspections you complete, and incident reports. An incident report may include injury detail, which is sensitive health information and is restricted to the people your employer nominates.

Pay

Payslips and payroll figures where your employer uses TradeZiller HR to prepare them.

Photos

Only photographs you deliberately take or attach as evidence for a safety task or an incident. The app never reads your photo library on its own.

Under UK GDPR our lawful bases are your employer’s legitimate interests in running their business — knowing who is at work, and paying them correctly — and legal obligation, because employers must keep working-time and health-and-safety records.

Health information, including absence reasons and injury detail, is handled under the employment and social-security condition in Article 9(2)(b) and the associated conditions in the Data Protection Act 2018. It is not used for anything else.

Consent is not the basis for attendance, and we do not pretend it is: you cannot meaningfully refuse your employer’s timekeeping. Consent is used only where a choice is genuine — the camera and location permissions on your phone, which you can refuse or withdraw in your device settings at any time.

Inside your workplace: only the people your employer has given a role to, and roles are narrow by design. A manager sees their own team. Sensitive absence reasons and injury detail are separately permissioned, so an ordinary manager cannot read them.

Outside it, we use a small number of suppliers to run the service. They process data on our instructions and for no purpose of their own:

Google Firebase

Sign-in, database and file storage.

Vercel

Hosting for the website and the API.

Resend

Sending email, such as an invitation to set your password.

Expo

Delivering updates to the phone apps.

Some of these process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Addendum or an adequacy decision.

We do not sell data, and we do not share it with anyone else unless the law requires it.

Your employer decides, within what the law requires — working-time records generally for two years, payroll records for six, and accident records for at least three.

Two things are deliberately permanent while the account exists. Clocking records are never edited or deleted, because an attendance history that can be quietly rewritten is worth nothing in a dispute. Audit records are never editable either — every change made in the system records who made it and when. When somebody leaves, their record is archived rather than deleted, so the history behind it still makes sense.

You can ask to see the data held about you, to have it corrected, to have it erased, to restrict or object to how it is used, and to receive a copy in a portable form.

Ask your employer first. They are the controller and they can act on it. If you contact us instead, we will pass it to them and help them answer it.

If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk.

Data is encrypted in transit and at rest. Sign-in uses your own password, held only by Google Firebase and never by us — we cannot read it. On a phone, the signed-in session is kept in the operating system’s own secure store, the iOS Keychain or the Android Keystore, and can be locked behind Face ID or a fingerprint.

The phone apps cannot be signed up for. An account exists only when an employer invites a specific work email address, and an account with no employer attached is refused by every part of the system.

Every company’s data is separated at the database level rather than by a filter in the application, and no part of the app can write data directly — every change goes through a checked server route that records who made it.

TradeZiller HR is a workplace system and is not intended for anyone under 16. Accounts are created only by employers for their own staff.

If what we collect changes, this page changes with it and the date at the top moves. Anything that materially affects employees will be told to employers directly rather than only posted here.

Great White Design Ltd, Company No. 16725058
Unit 5 Wareham Road, Blackpool, Lancashire, England, FY3 7XG
luke@greatwhitedesign.co.uk