Privacy Policy

1. What this covers

This policy explains what personal data CrewClock (run by Dynamics Bridge) stores, why, on what legal basis, and what rights you have. It applies to everyone who signs in to a workspace, to people whose records an organisation keeps in it, to the contact details of clients that a Customer enters, and to people who use our public website or request a trial.

For the data inside a Customer's workspace, the Customer is the controller and we are its processor, acting on its instructions. For account security data, our own support and billing records and the public website, we are the controller.

2. Data we store

Account data: name, email address, optional username, password (stored only as a one-way hash), sign-in times, and the browser/IP of active sessions for security.

Work data entered by you or your organisation: timesheet entries, leave requests and balances, designation and joining dates, salary and rate settings, payroll results, invoices and payments, attendance check-ins with the location reported by the phone when attendance is switched on.

Profile data your organisation asks for: phone, address, date of birth, emergency contact, bank details for salary payment, national ID number and uploaded documents (for example an ID copy or a contract).

Technical data: activity log of changes made in the workspace (who changed what and when), email delivery log, push-notification subscriptions you enable, and server logs with IP addresses kept for a short time for security.

Website and trial requests: the name, company, email, phone, team size and message you send through the trial form, and the time zone reported by your browser.

3. Why we store it and on what basis

To run the Service for your organisation (recording hours, approving leave, calculating pay, issuing invoices, sending reminders and reports): this is necessary to perform our contract with the Customer, and the Customer's own basis for the records it keeps about its people is normally its employment or service contract with them.

To keep accounts secure, to prevent misuse, to provide support when your organisation asks for it, and to improve the Service from aggregate usage: our legitimate interests, balanced against yours.

To answer a trial request or an enquiry and to invoice subscriptions: steps you ask us to take before a contract, and the contract itself. Where the law requires it, we keep billing records for as long as tax rules say.

We do not use your data for advertising, profiling or automated decisions with legal effect, nor to train any model, and we never sell it.

4. Who can see it, and our sub-processors

People in your own organisation according to the role your administrator gives them. Sensitive fields (salary, bank details, national ID, documents) are limited to roles with that permission.

Dynamics Bridge staff may access a workspace only to provide support or maintenance, and such access is recorded.

Sub-processors we rely on, each under a written agreement and its own security commitments: Hetzner Online GmbH (Helsinki, Finland; hosting of the application, database, files and backups); Microsoft 365 (email delivery of invites, reminders, slips and reports); Google (optional sign-in with a Google account, only if you choose it); the web-push services of Google, Apple and Mozilla (delivery of push notifications you enable, which carry a short message and a link, not your work data); and the Redis queue and worker that run on the same host as the application (internal background jobs). We give at least 30 days' notice inside the Service before adding a sub-processor that handles workspace data.

We disclose data to authorities only when legally required.

5. Where and how long

Data is stored on servers in the European Union (Helsinki, Finland) and encrypted in transit (HTTPS). Daily backups are kept for 14 days on the server. A copy of the newest daily backup is also kept for up to 30 days at our office outside the EU, on an access-controlled computer, for disaster recovery only; that transfer is covered by the standard contractual clauses in our Data Processing Agreement (/dpa). Email and push notifications leave the EU only to the extent the providers above deliver them to you.

Your data is kept for as long as your organisation subscribes, and for at least 90 days after a subscription ends so it can be exported or resumed. When the owner asks us to delete the workspace, all of its data and files are removed, and backups expire within 30 days. Trial requests that never become a workspace are deleted after 12 months.

6. Your rights

Under the UK GDPR and the EU GDPR you can ask for access to the personal data we hold about you, have it rectified if it is wrong, have it erased, restrict or object to its processing, and receive a copy in a portable format. You can withdraw consent at any time where processing is based on consent, and you can complain to the Information Commissioner's Office (ico.org.uk) in the UK or to your local supervisory authority in the EU.

You can see and correct most of your own data inside the Service (Account and Profile pages). For anything in a Customer's workspace, contact your organisation's owner first, as they control it and we act on their instructions; we help them answer your request. For data we control (website, trial requests, billing, security), write to us directly and we answer within one month.

You can turn email and push notifications on or off in your notification settings, and enable two-factor authentication on your account.

7. Security and breach notification

Passwords are hashed, every connection is encrypted, each workspace is isolated from every other, access by our staff is logged, and the database and files are backed up daily. Two-factor sign-in is available for every account.

If a personal-data breach affects your data, we notify the affected Customers without undue delay and in any case within 72 hours of becoming aware of it, with what happened, what data is involved and what we are doing about it, so that they can meet their own obligations. We report to the supervisory authority where the law requires it.

Found a security issue? Please write to contact@dynamicsbridge.com. We acknowledge reports within two working days and do not take action against good-faith research.

8. Data processing agreement

Our standard data processing agreement (Article 28 GDPR), which includes the sub-processor list above, is published on this site at /dpa and applies to every workspace. Customers that need a signed copy can request a countersigned PDF by email.

9. Cookies

We use only the cookies needed to keep you signed in (session), to complete two-factor sign-in, to protect sign-in forms, and to remember the provider console sign-in. There are no advertising, analytics or tracking cookies, so no cookie banner is shown.

10. Contact

Questions about privacy: contact@dynamicsbridge.com. We may update this policy; the date at the top shows the current version, and material changes are announced inside the Service.