Draft for review by our legal adviser before launch. This page describes how the service works; it is not a substitute for your own data protection advice.
Who is responsible
When a company uses SafetyEvo for its staff, that company is the controller of its staff data. SafetyEvo processes the data on the company's behalf, under a written data processing agreement.
What is processed
- Account details: name, work email, mobile number, role and team.
- During a shift only: location, battery level, signal type and app status.
- Alerts: when raised, where, who was notified, who responded, notes and outcome.
- An audit log of console actions, including every view of a location.
Limits built into the system
- Location is collected only while a shift is open, and the app always shows when tracking is on.
- Responders see a location only during a shift or an open alert. Older history needs a supervisor or admin.
- Each company's data is kept separate, and every request is checked against the user's role.
- No facial recognition or biometric data is used.
Retention
Location trails are deleted after the period the customer sets (90 days by default). Incident records and audit logs are kept for longer, in line with the customer's policy, because they may be needed for insurance or legal claims.
Security
Data is stored on servers in the European Union (Germany), sent over encrypted connections, and backed up daily. Console sign in requires two-step verification. See security and compliance for more.
Staff rights
Staff can ask their employer for a copy of their data or to correct it. Employers can export and delete a person's data when they leave, apart from records they must keep.
Data protection impact assessment
Tracking employees is systematic monitoring. We recommend, and will help with, a data protection impact assessment before your team starts.