Privacy notice

What the LinkSync app records about you, why, who can see it and for how long. It covers staff who use the app and the web admin, and the people who live or work at the places they visit. Our rule is simple: record only what is needed to prove a visit happened.

Drafted for review by a solicitor; not yet in force.

Last updated [date]

At a glance

You clock in and out of a visit by tapping a GeoSync with the LinkSync app on your registered phone. You never type anything about a visit.
While you are clocked in, the app records where your phone is about once a minute. Your managers can see that route. It stops when you tap out. Nothing is recorded when you are not clocked in.
At each tap, the app also notes the wireless networks nearby, in scrambled form, to help confirm the place. It never records their names or what you do on them.
If your organisation uses face checks, the app takes a short live selfie at visits to check it is really you. The selfie is checked straight away and never stored.
A computer flags visits that need a second look. A manager always reviews them. A computer result never decides your pay or discipline on its own.
Visit records can’t be changed by anyone. That protects you as much as your organisation.
Your employer is in charge of your visit records. LinkSync runs the system for them.
Everything is stored in the UK. One step of the face check is processed in the European Economic Area, which UK law treats as equally safe. We never sell your information or use it for advertising.
You can see, correct or object to what is held about you. Ask your organisation’s Data Protection Lead first.

1. Who we are

LinkSync is run by [Company name], a company registered in England and Wales (number [company number]). Our registered address is [registered address].

Organisations use LinkSync to prove their staff’s visits happened. We call them “your organisation” in this notice. We have two different roles.

Information	Who is in charge of it	Who to ask
Your visits: clock-in and clock-out times, location, face checks, reviews, and the places you visit	Your organisation. It decides why and how this is used. LinkSync runs the system for it.	Your organisation’s Data Protection Lead
Your sign-in email, and the one phone registered to you across every organisation you work for	LinkSync	privacy@linksync.co.uk
LinkSync’s own security records, and how well the checks work across all organisations	LinkSync	privacy@linksync.co.uk
Contact details of people at organisations who deal with us as customers	LinkSync	privacy@linksync.co.uk
This website	LinkSync (it collects nothing about you)	privacy@linksync.co.uk

In legal terms, your organisation is the controller of your visit records and LinkSync is its processor. LinkSync is the controller of your sign-in email and registered phone, its own security records, and its monitoring of how the checks perform. LinkSync sets the standard the checks use, and it is the same for every organisation. Your organisation decides how visit records and check results are used. Your organisation has its own privacy notice. It should tell you more about how it uses your visit records.

If you work for more than one organisation that uses LinkSync, each one is in charge of its own visits. None of them can see another’s.

2. What we record, and when

About staff who use the app

What	When	Why
Your name, role, work email and staff reference	When your organisation invites you	To sign you in and show who made each visit
Your registered phone: a security key kept on it, and its model and system version	When you register your phone	To confirm each tap came from your phone. You can register one phone.
The times you clock in and out, and which GeoSync you tapped	Each time you tap a GeoSync	To record the visit and how long it lasted
Where your phone is, and how accurate that is	At each tap, and about once a minute from clock-in until you tap out	To confirm you were at the right place, and so managers can see your route while you are clocked in
Other readings from your phone: the wireless networks nearby, recorded in scrambled form so their identifiers can’t be read, and how the phone is held and moving	Only at the moment you tap	To confirm the GeoSync is where it should be and hasn’t been moved
Checks that your phone and the app are genuine	When you register, and at each tap	To stop anyone faking a visit
An enrolment photo of your face, and a manager’s confirmation that it matches your ID	When you join, if your organisation uses face checks	To compare with the live selfie at visits
The result of a face check. The short live selfie itself is checked straight away and never stored.	At visits, if your organisation uses face checks	To confirm the vetted worker is the person at the visit
Your planned visits	When your organisation plans them	To spot visits that were missed, late or short
Reviews of flagged visits	When a manager looks at a flagged visit	To decide fairly what happened
Requests to change your phone, and their approval	When you ask	To keep one phone per person
A log of who looked at or changed information	Every time anyone does	To keep everyone accountable and to spot misuse

About staff who fit GeoSyncs

When you fit a GeoSync, the app records who fitted it, when, and a location reading and other readings taken while you fit it.

About managers and others who use the web admin

Your name, work email, role and the parts of your organisation you work in; your sign-ins; and what you look at, approve, review or change, which is recorded in the log.

About people at the places visited

Where your organisation records them: their name, the address of the place, where they have lived over time, the visits planned there, and a record of whether they agreed to a GeoSync at the place. See people at the places visited.

3. What we never record

Your location when you are not clocked in.
Anything else on your phone: your photos, messages, contacts or other apps.
Your fingerprint, or the face you use to unlock your phone. Your phone checks those itself. LinkSync only learns “yes” or “no”.
Notes about the visit or the work done. LinkSync is a clock, not a record of the work.
Sound or video from the place visited.

A GeoSync holds no personal information. It has no camera or microphone.

4. Why, and the legal basis

Your organisation uses LinkSync to:

prove the right person was at the right place at the recorded time;
keep people safe, and show that the visits it promised were made;
meet the record-keeping duties of its regulators, clients and funders;
prevent and detect fraud, such as visits that didn’t happen;
protect honest staff when a visit is questioned.

Your organisation decides the legal basis. In most cases it relies on its legitimate interests in doing the things above. For the face check, which uses biometric information, it usually also relies on the substantial public interest in preventing or detecting unlawful acts, such as fraud. If information about the people at a place could reveal something about their health, for example because the visits are to provide care or support, it also relies on a condition that covers this, such as the condition for providing health or social care. Your organisation’s own privacy notice confirms the basis it relies on, and its policy explains the safeguards.

What LinkSync uses information for itself

What	Why	Legal basis
Your sign-in email and registered phone	To sign you in securely, and make sure each person has one phone and each phone one person, so nobody can clock in for someone else at any organisation	Legitimate interests
Security and fraud-prevention records	To protect LinkSync and the people who rely on it, and to detect misuse	Legitimate interests
How the checks perform across all organisations, including how often face checks fail to confirm people	To find and fix inaccuracy or unfairness. We use information that doesn’t identify you wherever we can.	Legitimate interests [solicitor to confirm the condition for any biometric information]
Business contact details	To manage our relationship with customers	Legitimate interests, or contract

We have weighed our interests against yours, and you can ask us for a summary.

We do not rely on your consent. If your organisation relies on consent for anything, you can withdraw it at any time.

Using LinkSync is usually part of your job. If you don’t register a phone or complete the checks, you won’t be able to clock in with the app. Ask your organisation what to do instead. If you have a concern, talk to your manager or Data Protection Lead.

5. Your location while clocked in

This is a form of monitoring at work, so we want to be clear about it.

Recording starts when you clock in.
While you are clocked in, the app records where your phone is about once a minute.
Recording stops only when you tap out. If you forget to tap out, it carries on until you do, so always tap out at the end of a visit.
Your managers can see the route you took while clocked in. Your organisation’s policy explains how it uses it.
Nothing is recorded when you are not clocked in.
Your route while clocked in is deleted automatically 90 days after we received it.
At the moment you tap in or out, the app takes a set of readings from your phone, and these are part of the signed record of that tap, which proves the tap is genuine. They are: where your phone was (and how exact that was, its height and speed); scrambled codes for the wireless network your phone is on or the ones nearby (never their names or real addresses), and how strong each one was; how your phone was moving and angled; the air pressure and magnetic field; and whether the phone was set up to fake its location. The signed record is kept as long as the visit record, usually 6 years. A separate copy of these readings, used for checking, is deleted 90 days after the tap. [Under review: LinkSync is looking at keeping only a scrambled form of these readings in the signed record.]

6. Face checks

Face checks are switched on separately for each organisation, and only after it has completed the legal checks needed first. If your organisation doesn’t use them, this section doesn’t apply to you.

When you join, you take an enrolment photo, and a manager confirms it matches the ID your organisation checked when it hired you. At visits, you take a short live selfie. LinkSync checks it is a live person, not a photo or a recording, and compares it with your enrolment photo to confirm it is you.

Live selfies are never stored. Each one is checked straight away, then discarded. Only the result is kept.
Your enrolment photo is deleted automatically 30 days after you leave your organisation, or 30 days after it is replaced or withdrawn, unless your organisation has to keep your records for a claim or investigation.
Face images are used only for this check. They are never used to rank your performance, or to train systems for anyone else. The companies that run parts of the face check for us are not allowed to use them to improve their own services.
Only people your organisation allows can see your enrolment photo, to confirm it matches your ID. Nobody can see a live selfie, because it isn’t kept.
If the check can’t confirm you after a few tries, the app asks you to speak to your manager. It doesn’t say why, so nobody can learn how to fool it. A failed check is never a finding on its own.

Face checks can be less accurate in poor light, and for some people. LinkSync watches how often checks fail across all organisations, to find and fix unfairness. If a face check is hard for you, for example because of a disability, a facial difference, a religious face covering or a condition affected by flashing light, tell your manager. Your organisation must consider reasonable adjustments.

7. Computer checks and human review

LinkSync checks each visit automatically: the time, the place, the face check where used, and that your phone, the app and the GeoSync are genuine. Visits that pass every check are recorded as confirmed. Visits that don’t are flagged for a second look, for example if the face check didn’t match or the location didn’t fit. A flag is not a finding.

A flagged visit waits for a manager to review it. The manager records a decision and a reason alongside the visit; the visit record itself never changes. A computer result never decides your pay or discipline on its own. You are told the outcome and can see the evidence. You can ask how a decision was made, give your side, and challenge the outcome through your organisation’s procedures.

Automated decision-making

UK law gives you extra protection where a decision with legal or similarly significant effects on you is made by a computer with no meaningful human involvement. LinkSync is designed so that this doesn’t happen: a computer flags, a person decides. The only things LinkSync does automatically are security steps, such as not letting a tap through when the face check can’t confirm you or the phone isn’t genuine. When that happens, you are told to speak to your manager, who can look at what happened. If you think a decision about you was made by a computer alone, you have the right to be told, to give your side, to have a person look again, and to challenge it.

8. People at the places visited

Where a place is somewhere people live or occupy, your organisation may record the name of each person there and the address, where they have lived over time, the visits planned there, and whether they agreed to a GeoSync at the place. That agreement can come from:

the person themselves;
someone with lasting power of attorney for them; or
a best-interests decision under the Mental Capacity Act 2005, if they cannot decide for themselves.

The reason is to deliver the visits and prove they happened. If the visits could show something about a person’s health, for example because they receive care or support, that information is treated as health information and used only for delivering and checking those visits. Your organisation relies on its legitimate interests and, where needed, on a legal condition for health information. Its own privacy notice confirms this.

Agreeing to a GeoSync is permission to fit it there. It is not the legal basis for using their information. A GeoSync holds no personal information. People at the places visited have the same rights as staff. They, or someone acting for them, should contact the organisation that visits them.

9. For people at the places we visit

If you live or work at a place visited by an organisation that uses LinkSync, or you act for someone who does, this section is for you.

What it means for you

A small GeoSync, about the size of a coin, may be fixed at the place, usually near the door. The worker touches their phone to it when they arrive and leave.
This proves the worker really came, and how long they stayed. It helps keep you safe, and helps the organisation show the people it answers to that the visit happened.
The GeoSync has no camera, no microphone and no battery. It doesn’t record anything about you, and it doesn’t track you.
The app records the worker’s location while they are clocked in, which means while they are with you. It records nothing about what happens during the visit.

What is recorded about you

Where the organisation records you: your name and address, where you have lived before if you move, the visits planned for you, the times workers arrived and left, which worker came, and whether you agreed to the GeoSync.

Your choices

If the place is somewhere you live, you can say no to a GeoSync. The visits will still happen.
You can choose where it goes, within reason, and ask for it to be taken away later.
You can ask to see the visit records about you.
If a worker doesn’t come, or leaves early, tell the organisation that visits you.

If someone can’t decide for themselves

If a person can’t make this decision, someone with lasting power of attorney for them can decide, or the organisation can make a best-interests decision under the Mental Capacity Act 2005, after consulting the people close to them. Those people can ask the organisation how a decision was made.

Who to contact

The organisation that makes the visits is in charge of this information. Contact it first; it should tell you who its Data Protection Lead is. People at the places visited don’t use LinkSync themselves. If you can’t reach the organisation, you can email us at privacy@linksync.co.uk and we will pass your message on. A relative or representative can make a request on someone’s behalf where they have the authority to.

10. Children and young people

LinkSync is for staff, who must be at least [16] years old. We don’t knowingly let anyone younger use it.

Some organisations visit places where children or young people live or spend time. Their information is recorded in the same limited way as for anyone else at a place visited, and the organisation is in charge of it. A young person can use their own rights if they understand what they are asking for. Otherwise, someone with parental responsibility can act for them. Organisations should explain the GeoSync to young people in a way they can understand.

11. Where the information comes from

Your name, role and work email come from your organisation when it invites you.
Planned visits come from your organisation, either entered in LinkSync or sent from its own systems.
Information about people at the places visited comes from your organisation.
Flags come from LinkSync’s checks. Reviews come from your managers.
Everything else comes from you and your phone when you use the app.

12. Who can see it

Your managers, for the visits and people they are responsible for.
Your organisation’s Data Protection Lead, to answer requests and look into problems.
Systems your organisation connects, such as its rota, payroll or reporting systems, where it chooses to send visit records to them.
LinkSync staff, only when needed to run, support and secure the service. Access is limited to the staff who need it, and every action is logged. [How your organisation approves support access, once that is built.]
Companies that host or run parts of the service for us, under contract, and only on our instructions. See our Sub-processors page.
Clients, commissioners, funders and regulators, only where they are entitled to see visit records.
The police, courts or other authorities, only where the law requires it.
A buyer of LinkSync’s business, if that ever happens, who would have to protect your information in the same way.

Each organisation’s information is kept separate. One organisation cannot see another’s visits, even if you work for both.

13. Where it is kept

Everything is stored in the UK. One step of the face check is processed in the European Economic Area, and nothing is stored there. That transfer is covered by UK adequacy regulations, which recognise that the European Economic Area protects personal information to the standard UK law requires.

LinkSync doesn’t send notifications to your phone from its servers. Tap-out reminders are set on your phone itself, and nothing about them is sent to LinkSync.

We never sell your information, use it for advertising, or use it to train systems for anyone else.

14. How long it is kept

The usual periods are below. Some information is deleted automatically, by a check that runs every day: your route while clocked in, 90 days after we received it; the phone readings kept for checking a tap, 90 days after the tap; and your enrolment photo, 30 days after you leave or after it is replaced or withdrawn. [Other information is deleted by LinkSync at the end of its period until automatic deletion is built. Organisations will be able to set their own periods, within limits we allow.]

Information	How long
Visit records (who, where, times, result, reviews)	Usually 6 years from the visit
Your route while clocked in, and the phone readings kept for checking a tap	90 days, then deleted
The signed record of each tap, which includes where your phone was, scrambled codes for nearby wireless networks, and its movement, angle, air pressure and magnetic readings at that moment	The same as the visit record, usually 6 years [under review]
Information your organisation has to keep for a claim, dispute or investigation (a legal hold)	Until your organisation releases the hold
Live selfies	Never stored
Enrolment photo	Deleted 30 days after you leave, or after it is replaced or withdrawn
Face check results	The same as the visit record
Your phone’s security key (the public part) and details	While registered, then as long as the visit records it signed, because it proves they came from your phone
Checks that your phone and the app are genuine	Part of the signed record of each tap: the same as the visit record
GeoSync fitting record	While the GeoSync is in use, plus 12 months
Record of agreement to a GeoSync	While the GeoSync is in use, plus 6 years
Information about people at the places visited	Set by the organisation that visits them, in line with its records policy
Log of who looked at or changed information	6 years
Backups	Overwritten after 35 days
Sign-in email and registered phone (LinkSync)	[Retention period to be confirmed]
LinkSync’s security records	[Retention period to be confirmed]

Information can be kept longer if it is under a legal hold, for example because of a court case or investigation. When you leave an organisation, your access ends straight away, but your visit records are kept for the periods above, because they are also records of visits made for other people.

15. Keeping it safe

Information is encrypted when it is stored and when it is sent.
Each organisation’s information is kept separate from every other.
People only see what their role needs.
Every time someone looks at or changes personal information, it is logged.
Visit records can’t be altered.

Our Security page explains more.

16. Your rights

Under UK data protection law you have the rights below. Some depend on the legal basis used, and some have exceptions, which we explain. You don’t have to pay, and you will not be treated less fairly for asking.

Be informed: Know what is collected and why. That is what this notice, and your organisation’s own notice, are for.
Access: Get a copy of the information held about you, and details of how it is used. This includes your visit records, your route while clocked in, your face check results, reviews of your visits, and the log of who has looked at your information. Information about other people, such as people at the places you visit, may be removed from what you get.
Correction: Have wrong or incomplete information put right. Your organisation can correct details such as your name or role. Visit records are evidence of what your phone and the GeoSync reported, so they are kept exactly as recorded and can’t be edited. If you think one is wrong, tell your organisation: it can record its decision about a flagged visit, and keep your explanation with its own records.
Deletion: Ask for information to be deleted, where there is no good reason to keep it. Your organisation may need to keep visit records, for example to meet the rules of its regulators and funders, or for legal claims. If so, it will tell you why.
Restriction: Ask for information to be kept but not used, for example while a mistake is checked, or while your objection is considered.
Objection: Object to your information being used because of legitimate interests. It must then stop unless there is a strong reason to carry on that outweighs your interests, or it is needed for legal claims.
Portability: Get information you provided in a format you can take elsewhere. This right only applies where information is used because of consent or a contract with you, so it usually doesn’t apply to visit records. Ask anyway; your organisation can export your records.
Decisions made by a computer: Be told about them, give your side, have a person look again, and challenge the result. At LinkSync, a manager always reviews. See computer checks and human review.
Withdraw consent: Change your mind at any time, where consent is relied on. This doesn’t affect anything done before.
Complain: Complain to the organisation, and then to the Information Commissioner’s Office. See complaints.

How to use your rights

For your visits: ask your organisation’s Data Protection Lead. We will help them answer.
For your sign-in email or registered phone: email privacy@linksync.co.uk.
For someone at a place you visit: see for people at the places we visit.

You can ask in writing or by speaking to someone. You will normally get an answer within one month. If a request is complicated, or you make several, it can take up to two more months; you will be told why within the first month. We may ask you to prove who you are first, and the time starts when we can confirm it. If you contact us about your visits, we will pass your request to your organisation and tell you we have done so.

17. Complaints

If you are unhappy with how your visit records are used, complain to your organisation first. It must have a way for you to do this.

To complain about your sign-in email or registered phone, email privacy@linksync.co.uk. We will confirm we have your complaint within 30 days, look into it, and tell you what we have done.

If you are still unhappy, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk or 0303 123 1113. The ICO will usually expect you to have complained to the organisation first.

18. Business contacts

If you deal with us on behalf of an organisation, for example as a buyer, administrator or finance contact, we keep your name, work contact details, role and our correspondence with you, to manage our relationship, provide support, send invoices and tell you about changes to LinkSync. We rely on our legitimate interests or our contract with your organisation. We may send you occasional news about LinkSync; you can opt out at any time using the link in each message. We keep this information for as long as your organisation is a customer, plus [6] years.

19. This website and cookies

This website uses no cookies, no analytics and no tracking. It does not collect anything about you. Like any website, our hosting keeps short technical logs, such as the address a request came from, for [period] to keep the site running and secure.

The web admin and the app keep a small amount of information on your device to keep you signed in and remember your display choices. Our cookies notice explains exactly what.

20. Changes to this notice

We will update this notice if what we record or why changes. The date at the top shows the latest version. If a change affects you, we will tell you in the app before it starts. Ask us if you want to see an earlier version.

21. Contact us

[Company name], [registered address]
Email: privacy@linksync.co.uk

Data protection officer: [name and email, once appointed]

We are registered with the Information Commissioner’s Office, registration number [ICO registration number].