Mobile app privacy policy

This Privacy Policy explains how Timax ("Timax", "we", "us", "our") collects, uses, stores, and protects personal information when you use the Timax mobile application ("the App") for phones and tablets (uk.timax.mobile).

Timax is operated by Guardtrack Limited, trading as Timax, Suite No. 3 Unit 4 Town Quay Wharf, Abbey Road, Barking, Essex, England IG11 7BZ.

The App is a workforce tool for security and field staff. It lets you view shifts, book on and off site, complete welfare check-ins, respond to pre-shift confirmations, capture duty evidence, receive operational alerts, and manage your account on the move.

This policy applies only to the Timax mobile app. If you use Timax in a web browser (timax.uk or your organisation subdomain), see our separate Website Privacy Policy at https://timax.uk/privacy.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Timax is a business-to-business platform. In most cases:

• Your employer or contracting organisation (the organisation that invited you to Timax) is the data controller for employment and operational data about you, such as shift records, welfare check-ins, and evidence you submit while working.
• Timax acts as a data processor, providing the technology that stores and processes that information on the organisation's instructions.
• Timax is the data controller for limited platform data needed to operate the App itself, such as your login account, device registrations, and support communications with us.

If you have questions about how your employer uses your shift or welfare data, contact your employer first. For App, account, or platform questions, contact us using the details in section 17.

The App is for staff members whose employer uses Timax. Access is limited to staff whose employer has added them to Timax. You can create your account in the App only with an email address your employer has registered, verified by a one-time code sent to that address. The App is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children.

Information you provide or generate in the App:

• Account details: name, email address, organisation membership, and role information returned from your Timax account
• Sign-up details: first name, last name, email address, password, and the one-time verification code emailed to you when you create your account in the App
• Authentication data: email and password when you sign in (your password is transmitted securely and stored by us only as a secure hash; we never store your plain-text password on the device)
• Shift and roster data: assigned shifts, open shifts, jobs, instructions, duties, notifications, and responses such as accept, decline, or apply
• Welfare and attendance records: book-on, check-in, and book-off submissions, including timestamps, notes, and answers to configured evidence questions
• Precise location: GPS latitude, longitude, and accuracy. While you are booked on to an active shift, the App shares your live position with your control room for your safety, including when the App is in the background or your device is locked (on Android through a persistent notification, which also continues after the App is closed; on iPhone through background location with the system location indicator). It also verifies your presence when you perform book-on, check-in, book-off, panic alert, or certain pre-shift responses, or when your employer's geofence rules require location verification
• Photos and videos: images and videos you capture with the camera or attach from your photo library as duty, welfare, incident, guard-tour, or occurrence-book evidence, and identity selfies taken during guard tours
• Voice calls: audio streamed in real time between you and your office when you place or answer a call in the App
• Voice recordings: voice messages and voice notes you record, and short duress safety audio recorded when a duress alert is raised during a guard tour
• Voice memo transcripts: if you convert a voice memo to text, the recording is transcribed on your device where supported; otherwise it is processed by your device's speech recognition service (on iPhone, Apple's speech recognition service)
• Messages: text, photos, files, voice messages, and locations you share in staff chat with your office
• Motion sensor readings during guard tours, used on your device to detect a possible fall and raise a man-down safety alert
• Files and documents: PDF, Word, or image files you choose to upload as supporting evidence for a job task
• Signatures: images you draw in the App for duty or evidence completion
• Workforce compensation information: pay rates, pay amounts, fees, expenses, and related notes included in shift or job records provided by your employer
• Pre-shift responses: attendance confirmations submitted through secure links opened in the App

Information collected automatically:

• Device and app data: device identifier generated by the App, device platform, operating system, app version, and optional device name when you register for notifications
• Push notification token: Expo push token used to deliver alerts to your device
• Session and security data: OAuth access and refresh tokens stored in your device's secure storage; organisation slug and cached profile or roster data stored locally to support offline viewing
• Technical connection data: IP address, request timestamps, and client headers sent to our servers when the App communicates with Timax (standard for secure API access)
• Realtime connection metadata: short-lived tokens and event subscriptions when the App connects to Timax realtime services to refresh shift status

Information we do not collect through the App:

• Biometric templates such as Face ID or fingerprint data — these remain on your device only and are never transmitted to Timax
• Location when you are not booked on to a shift, or after you book off (sharing starts when you book on and stops when you book off; it never runs outside a booked-on shift)
• Contacts, calendars, SMS, call logs, browsing history, or advertising identifiers
• Health data, payment card details, bank account details, purchase history, or payment-processing data

The App may request the following device permissions. You can decline non-essential permissions, although some features will not work without them:

• Location (while using the App, and — while you are booked on — in the background, so your control room can see your live position even when the App is in the background or your device is locked): to share live welfare position during an active booked-on shift, and to verify site presence when booking on, checking in, booking off, triggering a panic alert, or responding to certain pre-shift requests. Live shift tracking stops when you book off or sign out. On Android this runs behind a persistent on-shift notification; on iPhone the system shows a status indicator whenever background location is in use.
• Camera: to capture photo and video evidence, take guard-tour identity selfies, and scan checkpoint and staff badge QR codes
• Microphone: for voice calls with your office and to record voice messages, voice notes, duress safety audio, and video evidence (asked for when you first use one of these features)
• Speech recognition (optional): to turn a voice memo into a draft text transcript
• Motion (iPhone shows no prompt for this): accelerometer readings during guard tours to detect a possible fall for man-down alerts
• Photos / photo library: to attach existing images as evidence
• Notifications: to send operational alerts such as check-in reminders, book-on prompts, pre-shift confirmations, and open-shift availability (optional; you can turn these off in Profile or your device settings)
• Face ID / Touch ID / device biometrics (optional): to unlock an existing session on this device without re-entering your password; biometric data never leaves your device

On first use of a sensitive feature, the App or your operating system will show a permission prompt explaining why the permission is needed. You can change permissions at any time in your device settings.

• Authenticating you and keeping your session secure
• Showing your shifts, jobs, notifications, and organisation context
• Recording attendance, welfare check-ins, panic alerts, and configured evidence
• Verifying geofence and site-presence rules set by your employer
• Delivering push notifications about operational events you or your employer have enabled
• Syncing shift status in near real time while you are using the App
• Caching recent data on your device so you can view key information when offline
• Operating, maintaining, securing, and improving the Timax platform
• Complying with legal obligations and responding to lawful requests

Where Timax or your employer processes your personal data, the legal bases may include:

• Performance of a contract — to provide the App and workforce services to you and your employer
• Legitimate interests — to operate, secure, and improve the platform, verify attendance, and protect lone workers, balanced against your rights
• Legal obligation — where UK employment, health and safety, or record-keeping laws require processing
• Consent — where required, for example push notifications or location where your employer or applicable law requires explicit consent (you may withdraw consent through device settings or in-app controls)

We do not sell your personal information. We share data only as needed to provide the service:

• Your employer organisation and its authorised administrators, who configure shifts, welfare rules, and reporting in Timax
• Infrastructure and communications providers that help us host the platform, deliver email or SMS where configured by your employer, and send push notifications
• Expo and device push services (including Apple Push Notification service and Firebase Cloud Messaging) to deliver alerts to your device
• Network services used to connect voice calls (STUN/TURN relay servers, which see your device's IP address while a call is set up)
• Apple or Google speech recognition services, only when you convert a voice memo to text and on-device recognition is not available
• Professional advisers or authorities when required by law, regulation, court order, or to protect rights, safety, and security

Where we share personal data with service providers who process it on our behalf, we require them to provide the same or equal protection of that data as described in this policy and required by applicable law.

The App does not contain advertising SDKs and does not use your data for cross-app or cross-website advertising tracking.

Timax is operated from the United Kingdom. Your data is primarily processed in the UK or European Economic Area. Some service providers used for push delivery, cloud hosting, or operational tooling may process limited data in other countries. Where required, we use appropriate safeguards such as UK-approved contractual protections.

• Shift, welfare, and evidence records are retained according to your employer's Timax configuration and applicable legal requirements
• Precise location collected during booked-on shifts (the live tracking trail) is retained for 90 days by default, then deleted, unless your employer's Timax configuration or applicable legal requirements require otherwise
• Account, device, and push registration data are kept while your account is active and for a limited period afterwards for security and audit purposes
• Cached data on your device remains until you sign out, clear app data, or uninstall the App
• Server logs and security records are kept for a limited period, then deleted or anonymised

We protect personal data using HTTPS/TLS encryption in transit, secure password hashing, access controls, tenant separation between organisations, and device secure storage for session tokens. Optional biometric unlock adds an extra device-level gate to your refresh token. Contact us immediately at hello@timax.uk if you believe your account has been compromised.

• Push notifications: toggle off in Profile → Push notifications or in your device notification settings
• Location, camera, microphone, and photos: manage in your device settings; without these permissions, location-verified actions, photo or video evidence, voice recordings, and calls cannot be used
• Biometric sign-in: optional; disable in Profile → Security
• Sign out: clears in-app session state; cached local data may remain until removed by the system
• Account deletion: Profile → Delete account (deletes your Timax login immediately)

Staff records are provisioned and managed by your employer. You can create your login in the App (Sign up) only if your employer has already registered your email address. To deactivate App access or request deletion of employment-related records controlled by your employer, contact your employer or Timax administrator as well.

You can delete your Timax user account from inside the App:

• In the App: Profile → Delete account (two-step confirmation; deletion runs immediately while you are signed in)
• This removes your login credentials, org memberships, device bindings, and push tokens, and soft-deletes linked staff profiles
• If you cannot access the App, email hello@timax.uk from your registered email address with the subject line "Timax mobile account deletion request"

Signing out only ends the session on this device and does not delete your account. Account deletion is processed immediately in the App. Some information may be retained where required by law or where your employer must keep employment, welfare, or audit records. Deleting your account does not automatically purge records your employer must keep for legal or contractual reasons.

Under UK GDPR you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability where applicable. Contact your employer for employment and shift records they control. Contact hello@timax.uk for platform account matters. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

To help you understand our practices, the App collects data linked to your identity, including:

• Contact info: name and email address
• Location: precise location while booked on (and for welfare actions such as book-on and check-in); not collected outside active booked-on shifts except for configured pre-shift confirms
• Photos and videos: user-generated photos and videos submitted as evidence
• Audio data: voice calls, voice messages, voice notes, and duress safety audio
• Messages: staff chat messages with your office
• Files and documents: PDF, Word, or image files submitted as job-task evidence
• User content: signatures, notes, evidence answers, and shift responses
• Workforce compensation information: pay rates, pay amounts, fees, and expenses included in employer-provided work records
• Identifiers: device ID and push notification token
• App info: app interactions related to shifts, welfare actions, and notifications

This data is used for app functionality, account management, fraud prevention, security, and compliance. It is not used for third-party advertising or cross-app tracking. Our store privacy declarations are intended to match this policy.

The Timax website and web platform (admin dashboard, scheduling in a browser, billing, and cookies) has its own privacy policy. That policy does not cover mobile device permissions, push notifications, or on-device biometrics. Read it at https://timax.uk/privacy.

We may update this policy from time to time. The latest version is always available in the App under Profile → Privacy Policy and at https://timax.uk/mobile/privacy-policy. Material changes may be communicated by email or in-app notice where appropriate.

Questions about this policy or the Timax mobile App:

• Email: hello@timax.uk
• Website: https://timax.uk
• In-app: Profile → Privacy Policy, Help & support, or Delete account