App Privacy Policy.

Who is responsible for your information

Site-Hub is workforce software supplied to an employer. In data protection terms that makes your employer the data controller — they decide what is collected, who inside the business can see it, and how long it's kept.

Site-Hub (DGS Limited) is the data processor. We build, host and support the app, and we act on your employer's instructions. We do not use your information for our own purposes.

So: if you want your data corrected or deleted, start with your employer— normally whoever runs your office or payroll. If they need us to act, we will. You can also reach us at info@site-hub.info.

What the app handles

Not every business switches on every part of the app, so some of the below may not apply to you. Broadly, it can hold:

Your account

• Name, work email address, phone number, and a profile photo if one is added.
• Your role in the system (worker, supervisor, office, administrator) and whether your account is active.
• Your password, stored as a one-way hash — nobody, including us, can read it back.
• Which sites and jobs you are assigned to.

Location — at clock-in and clock-out only

When you clock in, the app reads your position once, at that moment, to confirm you are on the site you say you're on. It does the same when you clock out. What is stored is a single pair of coordinates per event, and whether that point was inside the site boundary.

The app never tracks you in the background. It does not follow your journey, does not know where you are between clock-in and clock-out, and does not know where you are when it is closed. It requests foreground location permission only. This is a deliberate design decision, not a limitation we intend to remove.

If you clock in on site and clock out somewhere else, the record is marked for a human to look at. It is not an accusation and nothing is decided automatically.

Time and attendance

• Clock-in and clock-out times, the job they belong to, and the resulting hours.
• Whether an entry was verified, flagged for review, or closed automatically because you forgot to clock out.
• Notes an administrator adds when correcting or approving an entry, and a log of who changed what.

Qualifications, PPE and site compliance

• Cards and certificates you hold — type, number, expiry date, and photographs of the card front and back where your employer requires evidence.
• Your confirmations that you have the required PPE for a job.
• Site documents you have been asked to read, acknowledge or sign, and when you did.
• Your periodic confirmation that your induction details are still accurate.

Forms, reports and site records

• Answers to any form your employer builds — risk assessments, inductions, checklists, quality inspections, onboarding paperwork.
• Photographs you take or attach, and the signatures you draw.
• Accident and incident reports, which by their nature can include health information about you or someone else.
• Voice recordings you make when dictating site notes, and the written transcript produced from them.

Expenses

• Photographs of receipts you submit, and the supplier, amount and date read from them.
• Any note you add, and whether the claim has been sent on.

Pay

• Your pay arrangement — hourly, day rate, fixed price or per unit — and the rate that applies.
• Calculated earnings per day or job, what has been approved, and what has been paid.
• Where your employer's onboarding forms ask for them, tax identifiers such as your UTR or National Insurance number, used for payroll and CIS reporting.

Messages

Messages you send and receive in the app, who they were sent to, and when they were read. These are work messages on a work system — treat them as visible to your employer, because they are.

Device and technical information

• A push notification token, so the app can notify you. It identifies the app installation, not you personally, and is deleted when you sign out.
• Device type, operating system and app version, for support and compatibility.
• IP address and server logs of requests made by the app, for security and diagnosing faults.

What the app does not do

• No background or continuous location tracking. Ever.
• No access to your personal photos beyond the ones you deliberately choose to attach.
• No listening in — the microphone runs only while you are recording a site note, with the recorder open on screen.
• No reading of your contacts, calendar, messages or other apps.
• No advertising, no ad identifiers, no behavioural profiling, no selling of anything to anyone.

Why it's collected, and the legal basis

• To run the work and pay you — assigning jobs, recording hours, calculating pay. Necessary for your employment contract, and your employer's legitimate interest in operating the business.
• To meet health and safety duties — inductions, risk assessments, PPE and certification checks, accident reporting. A legal obligation on your employer.
• To meet tax and payroll duties — including CIS reporting to HMRC. A legal obligation.
• To prove work was done — site reports, photographs, signed-off forms, evidence for clients and insurers. Legitimate interests.
• To keep the system secure — audit logs, sign-in records. Legitimate interests.

Health information in an accident or incident report is handled under the provisions of UK data protection law that allow processing for employment, health and safety, and legal claims. It is kept to the people who need it.

Automated processing and AI

Two parts of the app use automated services to save you typing:

• Voice site notes are transcribed to text by a speech-to-text provider.
• Receipt photos are read by an AI service to pull out the supplier, amount and date.

Both are conveniences. Their output is a draft that a person reviews and can correct. Neither is used to make a decision about you, and there is no automated decision-making in the app that produces legal effects or similarly significant effects on you — pay, approvals and flags are all confirmed by a human.

Who your information is shared with

Inside your business: your supervisors, office administrators and payroll staff, according to the roles your employer has set. Workers see their own records and the jobs they are assigned to — not other people's.

Outside it: only the suppliers needed to make the app work, each under contract and each processing only what it needs:

• Hosting — the servers and database that store the data, in the UK.
• Apple and Google — to deliver push notifications to your device.
• Speech-to-text and AI providers — for the transcription and receipt reading described above.
• Mapping and location lookup services — to show site locations and resolve addresses.
• Email delivery — for notifications and reports sent by email.

Your employer may also share reports generated from this data with their own clients, insurers, or a regulator — for example a signed-off inspection or an accident report. That is their decision as controller.

We never sell your data, and we never share it for advertising.

Where it's stored, and transfers abroad

Data is stored on servers in the United Kingdom. A small number of the services above process data outside the UK; where they do, transfers are covered by UK adequacy regulations or standard contractual clauses with the UK addendum.

How long it's kept

Your employer sets retention, because the obligations are theirs. As a guide to what those obligations usually require:

• Pay and time records — at least six years, for HMRC.
• Health and safety records, including accident reports and inductions — typically three years minimum, and considerably longer where an incident could give rise to a claim.
• Job and site records — for the life of the contract and the period in which a claim could still be brought.
• Your account — deactivated when you leave; the work records you produced remain, because they are records of the business's work.

Keeping it safe

• Everything between the app and the server travels over an encrypted connection.
• Your sign-in token is held in the device's secure storage — the iOS Keychain or the Android Keystore.
• Passwords are stored only as one-way hashes.
• Access is limited by role, and changes to sensitive records are logged with who made them.
• If your phone is lost or stolen, tell your employer — your account can be signed out and disabled.

Your rights

You have the right to:

• be told what is held about you, and get a copy;
• have mistakes corrected;
• have information deleted, where there is no legal reason to keep it;
• restrict or object to certain uses;
• receive your data in a portable format.

Some of these are limited in an employment context — your employer cannot delete a payroll record or an accident report just because you ask, because the law requires them to keep it.

Ask your employer first. If you would rather come to us, or your employer needs our help to answer you, email info@site-hub.info.

You can complain to the Information Commissioner's Office atico.org.uk or on 0303 123 1113.

Permissions the app asks for

• Location — to confirm you are on site when you clock in and out. Foreground only. Decline it and you will not be able to clock in.
• Camera — to photograph documents, receipts, and the site itself.
• Photo library — to attach a picture you have already taken.
• Microphone — to record spoken site notes, while the recorder is open.
• Notifications — to alert you to messages, job changes and reminders.

Each is asked for the first time it is needed, with the reason on screen, and each can be withdrawn in your phone's settings — the related feature then stops working, and nothing else changes.

Children

The app is a workplace tool and is not intended for anyone under 16. Where an employer uses it for apprentices under 18, the same protections in this policy apply.

Changes to this policy

We will update this page and the "last updated" date when anything changes. If a change materially affects what is collected about you, your employer will be told so they can tell you.

Contact

Your employer is your first point of contact. For anything you would rather raise with us directly, email info@site-hub.info.