Mobile App Privacy Policy

Your Data

Isimio is built and maintained by Kruvi Solutions Limited, a company registered in the United Kingdom. If you are using this app, your employer or agency has likely contracted us to provide a workforce management solution to help manage your work schedule.

Your employer or agency is in charge of your data (the “data controller”). They decide what information is held about you and how it is used. We process it on their behalf and only according to their instructions (as a “data processor”).

Depending on where you live, you may have rights over your data under laws such as the UK GDPR, the EU GDPR or US state privacy laws (such as the California Consumer Privacy Act). If you would like to access, correct or delete your data, please contact your employer or agency - we will help them with your request. You may also complain to your local data protection authority, such as the Information Commissioner's Office (ICO) in the UK.

Please note: we do not sell or profit from your personal data, and we do not “sell” or “share” it as those terms are defined under US state privacy laws. This app is designed strictly for the purposes of providing a service that your employer/agency is paying for.

Your data is not shared with anyone besides your employer or agency, and the services used to provide you this functionality, which are listed under Subprocessors below.

We do not engage with advertising services. We do sometimes engage with third party vendors to provide additional services that may use your data, such as location services and push notifications. However, only the absolute minimal required data is shared with these vendors by us.

Your Account

Your account was created by your employer or agency. This means they hold data about you on a server application, the extent of which is controlled by them. Some of this information may be transmitted or processed through this app, but we do not store or share it.

By enabling you to access this app, your employer/agency shared with us the following details, which we keep in order to allow you to log in:

1. Your email address,
2. The company you work for,
3. The last time you used the app.

Your account password is kept with us only. It is salted and hashed as per standard industry practice.

We keep this basic data required for the app to operate (your email address, hashed password and last login time) until your employer or agency removes your account. We may also periodically remove accounts that have not been used for over a year.

In order to provide certain services, such as push notifications, we also collect the following information from your device:

1. A Firebase registration token, which we use to send a push notification just to your device,
2. Your device identifier and platform, to use the correct services according to your device type

Your Work Details

Details about you and your work are kept by your employer or agency on our server application. We access this information for the purposes of transmitting it to your app when you perform certain actions, such as viewing a list of upcoming shifts or signing in to work.

We do not keep any record of these details ourselves, but we do have the ability to access this data until such a time as your employer/agency revokes it. Without such access, the app wouldn't work.

Your Identifying Information

When performing certain actions with this app, you send some identifying information to your employer/agency. For instance, when signing in or out of a shift. Your device transmits the following details:

1. Your device identifier: So we can tell if more than one person is signing in from one device,
2. Your geographic location (GPS): To help identify where you were when signing in and out of a shift,
3. Your IP Address: To help locate where you were when signing in and out of a shift (in case no better information exists),
4. Your device platform: To provide correct services by platform and help fix platform-specific issues,
5. Your device time: In case you're offline, it lets us know when you actually signed in and out of your shift

This app does not:

1. Track your location in the background (if your employer/agency requested this, you will be given the opportunity to explicitly enable this),
2. Allow anyone to check where you are at any given time (with the exception of aforementioned location tracking users),
3. Read your files on the device without your explicit action,
4. Transmit your conversations to third parties

Note that we have introduced a Location Tracking feature that allows, as an option, to track your live geographical location. This is inactive by default for the majority of our users, and will only appear as an option for certain ones. You will see a toggle on the home page if this functionality is enabled in your environment.

We do our best to provide a transparent service that does only what it's supposed to do. If you have any concerns about how your data is used, please reach out to us at [email protected].

Legal Basis

If you are in the UK or EU, we process your data under the following legal basis:

1. Performance of a Contract (Article 6(1)(b)): We have a contract with your employer or agency to provide this service. Creating and maintaining your login credentials is strictly necessary to fulfill this contract.
2. Legitimate Interests (Article 6(1)(f)): We have a legitimate business interest in maintaining system security, preventing unauthorized access, and providing support, which requires us to know who is logging in.

International Transfers

Your data is hosted by Heroku and DigitalOcean in the UK and Europe or, if your employer or agency uses our US hosting, in the United States. As Kruvi Solutions is based in the United Kingdom, our team may access your data from the UK when providing support. Some of our providers are based in the United States and may process your data there, for example to deliver push notifications or emails. Where data from the UK or EU is transferred to the United States, the transfer is protected either by the UK Extension to the EU-US Data Privacy Framework (or the EU-US Data Privacy Framework), where the provider is certified under it, or by the Standard Contractual Clauses and UK International Data Transfer Addendum included in our data processing agreement with that provider.

European Representative under Article 27 of GDPR

We have appointed EU Rep as our Representative under Article 27 of the EU General Data Protection Regulation (“GDPR”). All GDPR queries from EU Data Subjects or Data Protection authorities should be submitted toeurep.ievia their dedicated form. BizLegal Ltd trading as EU Rep have their registered office at 27 Cork Road, Midleton Co. Cork, Ireland. Company number 635921.

Using Your Information

We do not regularly need to access your information. However, we may sometimes need to in order to:

1. Test functionality requested by your employer/agency,
2. Debug issues you or your employer/agency have reported (so that we can reconstruct what happened),
3. Comply with legal obligations, such as a court order

Should you have any questions about this policy, you are welcome to reach out to us at [email protected]!