Privacy Policy

[Your company legal name] ("we", "us") operates Clock & Kit, a workplace kiosk service for attendance, PPE, and related records. This policy explains how we handle personal data when you use the service.

Contact: support@example.com

• Account data — name, email, password (stored securely), company name, and address.
• Kiosk & workforce data — employee names, attendance, PPE issues, vehicle inspections, and related operational records entered by your organisation.
• Technical data — IP address, device/browser information, and logs needed to secure and operate the service.

• To provide, maintain, and improve Clock & Kit.
• To prevent fraud and abuse.
• To send service-related emails (e.g. password reset, account notices).
• To comply with legal obligations.

We rely on one or more of the following, depending on the processing:

• Contract — to deliver the service you sign up for.
• Legitimate interests — security, fraud prevention, and service improvement.
• Legal obligation — where the law requires us to keep or disclose data.
• Consent — where required (e.g. optional marketing, if offered).

We use trusted providers to run the service, including:

• Supabase — authentication and database hosting
• Email and SMS providers — transactional messages where configured

We do not sell personal data. We may disclose data if required by law.

We keep data while your account is active and for a reasonable period afterwards for backups and legal compliance. You may request deletion of your account from the kiosk settings; some records may be retained where the law requires.

Under UK data protection law you may have the right to:

• Access, correct, or delete your personal data
• Object to or restrict certain processing
• Data portability, where applicable
• Withdraw consent where processing is based on consent
• Lodge a complaint with the ICO (ico.org.uk)

To exercise your rights, contact support@example.com.