App Privacy Notice.

1. Who is responsible for your data

This matters more than anything else on this page, because it decides who you ask when you want something changed.

• Your employer is the data controller. The venue that employs you decides what is recorded about your work — your shifts, your attendance, your leave, your pay. They decide whether facial clock-in is switched on at all.
• Inntally Ltd. is the data processor. We build and run the software and we act on your employer's instructions. We do not decide what is collected about you, and we do not use your work data for our own purposes.

So: to correct a shift, an attendance record, your bank details or your leave, ask your employer. To ask about the software itself, or if your employer does not respond, contact us at dpo@inntally.com.

2. What the app collects, and only when

The app uses scheduled checks for work updates and can retry supported submissions you have queued. Location checks, camera capture and microphone recording are tied to the workflows described below; the app does not track location in the background.

Your account and employment record

Your name, work email, employee and account identifiers, job role, department and venue identify your employee session and the work information you may access. You can also submit changes to your preferred name, telephone number, postal address and emergency-contact name, telephone number and relationship. These changes are sent to your employer's HR record when you save them.

Location during phone clocking and NFC venue checks

When you use a supported phone-clocking method, the app checks your location in the foreground to verify the venue. This includes checking an NFC tag scan and confirming supported attendance actions, rather than only the final clock-in. Coordinates, accuracy and timing are sent with these checks. An NFC scan also sends the tag information needed to identify and verify the clock point. Reading a tag does not by itself record attendance.

There is no background location. The app does not track your movements, does not run location when it is closed, and does not hold the "background location" permission at all. Clocking in at a wall terminal collects no location from your phone.

Facial verification, if your employer uses it

Some venues switch on facial clock-in. If yours has, a live image of your face is checked against a template held by your employer's Inntally system to confirm it is you.

• This is biometric data. Under GDPR it is a special category, and your employer must have a documented lawful basis and a Data Protection Impact Assessment before using it.
• The app shows you an explanation before the camera ever opens, and always offers another way to clock in. You are not required to use your face.
• The app does not keep a face template on your phone. The verification frame is sent for checking and is not retained by the app.
• A face match on its own never records attendance — the venue's system has to confirm the clock-in separately.

Photos you attach

When you report a problem, log maintenance, record lost property or complete a checklist that asks for evidence, the photo you take is attached to that record. The camera is only opened when you start one of those actions.

Messages and workplace posts

Messages, captions and replies you send; comments, survey answers, recognition, check-in or training notes; and work requests, report narratives and checklist evidence are sent to your employer's workspace. Read receipts, acknowledgements and votes are also recorded when those features are used. Visibility depends on conversation membership and authorised workplace roles. These are not public social profiles.

Voice recordings and videos

Where your workplace enables chat media, you can record or choose an audio file or short video. Recording asks for microphone permission and, for video, camera permission. You review the result before choosing Send. Sent media and any caption are uploaded to the conversation and are available to its authorised participants. Declining recording permission does not send a recording.

Unsent captures and previews use private temporary storage. Interrupted captures may remain until cache cleanup. Removing a local preview or signing out does not delete a file already submitted to your employer's system.

Files you upload

You can select a PDF, image or Word document and confirm its upload for HR review. The file, its name and type, and the title you provide are sent with that submission. Files and free-text records may contain identity, financial or health information, depending on what you provide. Only submit information needed for the workplace request.

Recognising your phone

The first time you clock in from your own phone, the server issues that phone an opaque token, which the app stores. On later clock-ins the app sends it back so the system can tell it is a phone you have used before — this is what lets a QR scan know who you are without asking for your PIN again, and it is a fraud check on attendance.

Only a one-way hash of that token is stored on the server, never the token itself. You can remove it at any time by choosing "Not me" on the clock-in screen, or by signing out.

Payroll bank details

Your bank account details, so your employer can pay you. In the app they are shown masked, and revealing or changing them requires you to re-authenticate on your device. A change does not take effect until your employer's payroll team has verified it — the previously approved account stays in use until then.

What the app does not collect

The native app does not read your phone's address book, call log or SMS, and no advertising, analytics or crash-reporting SDK is included in the reviewed native app. This does not exclude the emergency-contact details, uploaded files, work activity or health-related information you choose to include in a workplace submission. There are no ads in the app.

3. Why, and on what legal basis

• Account and employment record — to show you your own work and let you act on it. Basis: contract (your employment).
• Attendance, including clock-in location — to record hours worked accurately and pay them correctly. Basis: contract, and legal obligation (working-time and pay records).
• Facial verification — to confirm identity at clock-in. The basis is set by your employer; as biometric data it also needs an Article 9 condition and a DPIA. An alternative method is always available.
• Photos on reports and checklists — evidence for safety, maintenance and compliance records. Basis: legitimate interests, and legal obligation where a record is required.
• Messages, audio/video and workplace posts — communication and work requests within your employer's workspace. Your employer's notice explains the applicable basis.
• Profile changes and uploaded documents — maintaining and reviewing employee records. Your employer's notice explains the basis and retention that apply to each record.
• Device recognition token — speed at clock-in, and preventing attendance fraud. Basis: legitimate interests.
• Bank details — paying you. Basis: contract, and legal obligation (payroll).
• Notifications — telling you about shift changes and decisions. Basis: consent, opt-in, and you can turn it off.

4. Who else sees it

Your submissions go to the Inntally services used for your employer's workspace. Authorised employer users and the participants in a conversation can access records according to the relevant workflow and permissions. The wider Inntally privacy notice and your employer's notice describe service providers, access and processing arrangements; the absence of an advertising SDK does not describe every recipient of a workplace record.

Inntally uses infrastructure sub-processors to run the service — hosting, email and messaging delivery. They are listed in the Inntally Privacy Notice and are bound by data-processing agreements. Inntally infrastructure runs in AWS eu‑west‑1 (Dublin); your data stays in the EU.

Inside your workplace, what a manager can see is controlled by your employer's own permission settings — for example, your manager can see the shifts and attendance they are responsible for approving.

5. How long it is kept

Retention is your employer's decision as controller, within what Irish and EU law requires. In general: employment and payroll records are kept for the statutory period after your employment ends (attendance and working-time records must be kept for at least three years under the Organisation of Working Time Act); operational records such as checklists and maintenance jobs are kept for the venue's own compliance period.

The device recognition token is removed when you choose "Not me", when you sign out, or when your employer revokes the device.

6. How it is protected

• All traffic is encrypted in transit over HTTPS. Unencrypted connections are disabled in the app.
• Your sign-in tokens are held in Android's encrypted storage on your device.
• Revealing or changing bank details requires re-authentication on the device.
• Only a hash of the device token is stored on the server, so the token cannot be recovered from our records.
• Inntally is certified to ISO/IEC 27001:2022 (information security management) and ISO/IEC 27701 (privacy information management). Certificate details are available to customers under NDA.

7. Your rights

Under GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing, or ask us to restrict it. You can also withdraw consent where consent is the basis — for example by turning notifications off, or by declining facial verification and using another clock-in method.

Ask your employer first, because they are the controller and they hold the decision. In the app: More → Privacy & data. If they do not respond, or you want to raise something about the software itself, contact dpo@inntally.com or privacy@inntally.com.

You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie, or to your own country's supervisory authority.

8. Children

This app is for employed staff and is not directed at children. We do not knowingly collect data from anyone under 16.

9. Changes

If we change what the app collects, we update this notice and its date before the change ships. Material changes are notified in the app.

10. Contact

Inntally Ltd., Limerick, Ireland · Data Protection Officer: dpo@inntally.com · General privacy queries: privacy@inntally.com

See also the Inntally Privacy Notice, which covers the wider platform.