Privacy Policy

We collect the following personal data:

a. Personal & Identity Information

• Full name
• Email address
• Phone number (if provided)
• Date of birth
• National Insurance number
• Driving licence number
• Emergency contact name and phone number
• Profile photograph
• Job position, company and start date

Most of this information is already held by the company you work for and is used to create and manage your user account and worker record, and to link activity to your identity.

b. Sign-In & Authentication Data

To let you sign in and clock on/off, we may store and use:

• A personal 4 digit PIN (used for kiosk sign-in)
• A personal QR code (short-lived, single user, securely signed)
• A registered NFC card identifier (where NFC sign-in is used)

‍

c. Health Information

We collect health-related data submitted through questionnaires and assessments, which may include:

• General health questionnaire responses (including GP details, medical conditions, medications, allergies, respiratory/skin conditions, and relevant personal health declarations)
• Drug, alcohol and substance use declarations
• Hand-Arm Vibration Syndrome (HAVS) assessment
• Occupational health data (e.g. HAVS, hearing, skin, respiratory, DSE assessments)
• Health surveillance records (assessment type, examination date, outcome and recall dates)
• Daily "fit to work" pre-site health checks and PPE/medication declarations

This is special category (sensitive) data. It is linked to your identity and collected solely for internal record-keeping, health and safety, and operational purposes, so management can understand your ability to work or carry out certain tasks safely.

d. Location Data

When you use the app to clock on and off and manage your work session, we capture the location of your device at the time of each of the following events:

• Signing into the system / starting your work sessions
• Entering your PIN
• Scanning a QR code
• Starting, pausing, resuming and stopping the timer
• Signing Out

For each event we record the latitude, longitude, and location accuracy, together with the time of the event. This is used to confirm attendance, associate work with the correct site, and maintain accurate time records. We do not track your location continuously or in the background — location is only captured at the specific moments listed above.

d. Time & Attendance Data

• Sign-in / sign-out and timer events (start, pause, resume, stop) with timestamps
• Associated site and session information
• Calculated worked hours
• Any timesheet corrections, including who made the change and why (for audit purposes)

‍d. Diagnostic Data

We may collect technical data to operate, maintain, and improve the app, including:

• Device information (e.g. device/browser type, platform and user agent) recorded with certain check-ins
• A device identifier for shared kiosk devices
• Crash logs
• Performance data (e.g. app launch time, errors, usage performance)
• Other diagnostic data

All collected data is used strictly for app functionality and internal purposes, including:

• User authentication, sign-in and account management
• Recording attendance, work sessions, and worked hours
• Recording and managing questionnaire and health submissions
• Health, safety, and welfare management
• Confirming location of attendance at the correct site
• Maintaining system performance and stability
• Troubleshooting technical issues
• Supporting internal operations

We do not use your data for:

• Advertising or marketing
• Product personalisation
• External analytics or profiling

Access to personal data is strictly limited on a need-to-know basis:

• Only authorised Administrators and HR personnel can view worker personal details, health information, location data, and attendance records
• Staff and workers cannot view other user's data. Each user can only access their own information
• Health and other sensitive information is only accessible to authorised Admin/HR personnel.

• We do not sell, rent, or share your data with third parties for advertising purposes
• We do not track users across other apps or websites
• All data remains within our internal systems and is used only by authorised personnel
• We use trusted providers to host and store data securely on our behalf; they process data only under our instructions and do not use it for their own purposes

We take appropriate technical and organisational measures to protect your data, including:

• Restricted access to authorised staff, based on roles admin or HR
• Secure storage systems
• Secure, short-lived, single-use personal QR codes
• Protection against unauthorised access, disclosure, or alteration

We retain personal and health data and actions carried out within StonePad only for as long as necessary to fulfil internal operational requirements or legal obligations.

You may have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (subject to business requirements)

To exercise your rights, please contact us at:
support@stonepad.co.uk

StonePad is intended for internal use by authorised staff and workers of businesses or organisations only.

We may update this Privacy Policy from time to time. Any updates to the policy will be made on this page.

We take appropriate technical and organisational measures to protect your data, including:

• Restricted access to authorised staff only
• Secure storage systems
• Protection against unauthorised access, disclosure, or alteration

If you have any questions about this Privacy Policy or how your data is handled, please email: Support@stonepad.co.uk