KithHR Logo
KithHR

Privacy Policy

Your Privacy is Our Priority

At KithHR, we understand that workforce management and employee attendance data are highly sensitive. This policy explains how we collect, process, store, and protect your information in strict compliance with the **UK Data Protection Act 2018**, **UK GDPR**, and **Google Play / Apple App Store developer policies**.

1. Data Controller & UK GDPR Roles

KithHR is a UK-based workforce platform. When providing our timekeeping and workforce services:

  • Data Controller: Your employer (or company administrator) acts as the Data Controller for all workplace, attendance, shift, and employee profile records.
  • Data Processor: KithHR acts strictly as the Data Processor on behalf of your employer. All data is hosted on encrypted cloud infrastructure with UK / EU data residency (europe-west2), processed in accordance with Information Commissioner's Office (ICO) guidelines.
  • Account Controller: KithHR acts as Data Controller solely for direct business account management (e.g. workspace manager subscription & billing data).

2. Information We Collect & Device Permissions

To provide timekeeping and HR features, KithHR requests specific device permissions and collects the following data types:

  • Employee Profile Records: Full name, workplace email address, phone number, job position, department, hourly pay rates, and employee PIN.
  • Attendance & Shift Records: Clock-in/out timestamps, break durations, shift schedules, holiday/sickness requests, and total accrued pay.
  • Geolocation Verification (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION): When geofenced check-ins are enabled by an employer, location coordinates (latitude & longitude) are verified only at the precise moment of clock-in or clock-out. Continuous or background location tracking is never performed.
  • Camera Verification (CAMERA): Optional clock-in photos or signatures taken at a tablet kiosk are stored exclusively as transactional verification records for the employer. KithHR does not upload, extract, sell, or process raw biometric templates, facial recognition vectors, or AI facial scans to cloud servers, complying fully with ICO biometric standards.
  • Push Notifications (POST_NOTIFICATIONS): Encrypted push notifications sent for shift reminders, roster changes, and manager announcements.
  • NFC & Device Identity (NFC): Unique device identifiers and NFC tag UIDs registered by managers for physical site clock-in verification.

3. Third-Party Integration & Subprocessors

To deliver our services, KithHR integrates with trusted third-party infrastructure providers. We NEVER sell personal data to advertisers, data brokers, or third parties:

  • Google Cloud Platform & Firebase (UK/EU): Encrypted database hosting, user authentication, and secure push notifications (FCM).
  • Stripe Inc.: Subscription payment processing and invoice handling (PCI-DSS Level 1 compliant).
  • Slack, BambooHR & Xero: Optional API data synchronization configured voluntarily by company managers for payroll and shift management.

4. Account Deletion & Data Rights (Google Play & UK GDPR)

In compliance with Google Play User Data policies and UK GDPR, users have full control over their personal data:

  • Account & Workspace Deletion (In-App & Web): Workspace managers can delete their entire company account, employee roster, attendance logs, and audit records in-app via Settings → Data Privacy → Delete Account, or by submitting a web deletion request via email to info@kithhr.co.uk. Account deletion permanently wipes all database records, storage files, and active subscriptions within 30 days.
  • Employee Data Rights: Employees can view and update their profile details directly in the Employee Portal or request exported copies from their employer (Data Controller). Employees may also request account/data erasure through their employer or by contacting our Data Protection Officer at info@kithhr.co.uk.
  • Statutory Record Retention: Deletion wipes active database data, but employers may be required under UK employment law to retain specific payroll and tax summary records for statutory retention periods (e.g. HMRC timesheet records).

5. Cookies & Local Storage

KithHR uses essential local storage (`LocalStorage`, `SessionStorage`, and `IndexedDB`) strictly to keep your session secure and enable offline timekeeping in Kiosk mode. We do not use third-party tracking cookies or advertising pixels.

6. Children's Privacy

KithHR is a professional workplace management application intended exclusively for business operations and working employees aged 16 and over. We do not knowingly collect or solicit personal data from children under the age of 13 (or under 16 in the UK/EEA). If we learn that personal data from a child has been collected without verified employer or parental authorization, we will delete that information immediately.