Privacy Policy

GLP Technologies Limited ("Company", "we", "us") is committed to protecting your privacy in accordance with the Privacy Act 2020 and its associated Information Privacy Principles. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information obtained through our Application.

Dual-Purpose Application:

This Application serves two distinct user groups:

1. Employees who use the Application to track their own work hours, jobs, and employment information; and

2. Employers who use the Application to manage employee information, calculate wages, and maintain employment records.

Your privacy rights and our obligations differ depending on how you use the Application.

Data Controller Relationships:

• For your own account information, we are the data controller/agency.

• For employees using the app for self-tracking, we are the data controller/agency for that personal information.

• For employers managing employee data, the employer is the data controller/agency and we act as a data processor/agent.

By using the Application, you consent to the collection and use of information in accordance with this Privacy Policy.

Information Collected From All Users:

• Account email address

• Device information (device type, operating system, unique device identifiers)

• Application usage data and analytics

• Log data (IP addresses, access times, error reports)

• Performance and diagnostic information

Information Collected From/About Employees:

Self-Tracking Employees:

When you use the Application to track your own employment, we collect:

• Your full name

• Your email address

• Your pay rate information

• Your tax code

• Your work entries (dates, hours worked, job descriptions)

• Job information and classifications

Employees Managed by Employers:

When your employer uses the Application, they may input your name, email address, pay rate, tax code, work entries, job classifications, and any other employment-related information your employer chooses to record.

Additional Information Collected From All Users:

• Subscription status (active, expired, or cancelled)

• Subscription information tied to your Apple ID for verification and entitlement purposes

• Subscription tier and renewal date

• Transaction and billing identifiers from Apple for subscription verification

• Device and account identifiers required for subscription management

For All Users:

• To provide and operate the Application's core functionality;

• To provide customer support and respond to inquiries;

• To maintain, improve, and develop the Application;

• To detect, prevent, and address technical issues and security threats;

• To comply with our legal obligations;

• To enforce our Terms of Use;

• To send administrative communications regarding the Application.

For Employee Self-Tracking:

• To enable you to record and track your work hours and employment information;

• To calculate your earnings based on input data;

• To provide you with employment records and reports;

• To enable export of your employment data.

For Employer Use:

• To enable payroll calculation and record-keeping functionality;

• To assist employers in maintaining employment records as required by law;

• To generate wage calculations, reports, and summaries;

• To facilitate compliance with employment and taxation obligations.

Important Note for Employers:

You, as the employer, determine the purposes for which you collect employee information. You are responsible for ensuring these purposes are lawful, disclosed to employees, and comply with the Privacy Act 2020. We process employee information on your behalf as a service provider only.

We collect subscription information to manage billing, renewal, access control, customer support, expired account restrictions, and compliance records.

We process personal information on the following legal bases:

• Consent: You have provided explicit consent for specific processing activities;

• Contractual Necessity: Processing is necessary to perform our contract with you;

• Legal Obligation: Processing is required to comply with New Zealand law;

• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms.

For employers processing employee information, you must ensure you have a lawful basis under the Privacy Act 2020 for collection and processing.

Storage Infrastructure:

We utilise Firebase, a cloud-based platform operated by Google LLC, for data storage and management. Data may be stored on servers located in multiple jurisdictions, including outside New Zealand. Firebase maintains ISO 27001 certification and implements industry-standard security measures.

Security Measures:

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction, including encryption of data in transit and at rest, secure authentication, access controls, security assessments, and incident response procedures.

However, no method of electronic transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Employer Responsibilities:

Employers are responsible for implementing appropriate organisational security measures, limiting access to authorised personnel, training staff on privacy and security obligations, and reporting suspected privacy breaches to us and affected employees.

Subscription purchase data is processed via Apple's App Store. We do not store or have access to your full payment card details. Apple securely handles all financial transactions in accordance with their own privacy and security policies.

We retain personal information for as long as:

• Your account remains active;

• Necessary to provide the Application's services;

• Required by law, including taxation and employment record retention obligations;

• Necessary to resolve disputes or enforce our Terms and Conditions.

Under New Zealand law, employment and payroll records typically must be retained for a minimum of seven (7) years. Upon account deletion, we will delete or anonymise personal information within ninety (90) days, subject to legal retention requirements and legitimate backup practices.

Employers remain responsible for retaining employment records for statutory periods even after ceasing use of the Application. Subscription-related data is retained for as long as your account remains active and for auditing or legal compliance purposes.

We do not sell, rent, or trade personal information to third parties. We may disclose personal information to service providers, legal authorities, or an acquiring entity in the event of a business transfer.

Service Providers:

• Firebase/Google LLC for data hosting and infrastructure;

• Cloud service providers for application functionality;

• Analytics providers for usage insights;

• Customer support platforms.

Legal Requirements:

We may disclose information when required by law, including court orders, subpoenas, requests from law enforcement or regulatory authorities, protection of our rights or safety, prevention of fraud or security threats, or investigation of suspected Terms violations.

Disclosure by Employers:

If you are an employer, you control access to employee information. You are responsible for determining access, notifying employees, avoiding unauthorised disclosure, and implementing appropriate access controls.

Disclosure to Employees:

Employees have the right to access their personal information. If an employee makes a privacy request regarding information held by their employer through the Application, we will direct the employee to the employer and may provide technical assistance to facilitate legitimate requests.

Rights for All Users:

You may request access to personal information we hold about you, request correction of inaccurate information, object to certain processing, request deletion subject to retention obligations, request data portability, and lodge a complaint with the Privacy Commissioner.

To exercise these rights, contact us using the details in Section 14. We will respond within twenty (20) working days as required by the Privacy Act 2020. We may require verification of your identity before processing requests.

Rights for Employees Managed by Employers:

• Your employer is the primary data controller/agency;

• You should direct privacy requests to your employer first;

• Your employer is obligated to respond within 20 working days;

• You retain the right to complain to the Privacy Commissioner;

• If you are under 16, your parent or guardian may exercise these rights on your behalf.

Rights and Obligations for Employers:

Employers must respond to employee privacy requests within statutory timeframes, provide access, correct inaccurate information, maintain privacy policies and procedures, notify us and affected employees of privacy breaches, and demonstrate compliance when required.

Personal information may be transferred to, stored, and processed in jurisdictions outside New Zealand, including the United States and other countries where Firebase operates data centres. These jurisdictions may not provide the same level of data protection as New Zealand.

By using the Application, you consent to such transfers. We ensure that appropriate safeguards are in place, including contractual protections with service providers, reliance on provider security certifications, and implementation of technical and organisational security measures. Employers must inform employees that their data may be stored outside New Zealand.

Minimum Age Requirements:

• Employers: Must be 18 years or older to use the Application.

• Employees (self-tracking): Must be 15 years or older to use the Application.

Young Workers (Ages 15-17):

Users aged 15-17 may use the Application to track their own employment data. Users under 16 are strongly encouraged to obtain parental or guardian consent before using the Application.

For Employers Managing Young Workers:

If you employ individuals under 18 years of age, you must obtain required parental or guardian consent, provide clear privacy notices, inform parents or guardians that information may be stored outside New Zealand, respond to privacy requests, comply with employment law requirements for young workers, and implement additional safeguards.

Children Under 15:

We do not knowingly collect information from individuals under 15 years of age. The Application is not intended for children under 15. If we become aware that information has been collected from someone under 15, we will delete it promptly.

The Application may use cookies, local storage, and similar technologies to maintain user sessions, store preferences and settings, collect analytics and usage data, and improve functionality and user experience.

In the event of a privacy breach that causes or is likely to cause serious harm:

• We will notify affected individuals as soon as practicable;

• We will notify the Privacy Commissioner as required by law;

• Employers who experience a breach involving employee information must notify affected employees and the Privacy Commissioner;

• We will cooperate with investigations and take remedial action.

From time to time, users may submit suggestions, feature requests, or ideas for improvement through in-app forms, emails, or other communication channels. By providing any Submission, you agree that all Submissions become the exclusive property of GLP Technologies Limited upon receipt, we are not required to acknowledge or implement any Submission, we have no obligation to compensate you, and we may freely use, modify, adapt, or implement any Submission for commercial or non-commercial purposes.

We reserve the right to modify this Privacy Policy at any time. Updates that affect how we handle subscription or billing data will be clearly communicated through in-app notifications or email. Continued use of the Application after changes take effect constitutes acceptance of the revised policy.

For privacy-related inquiries, requests to exercise your rights, or complaints, contact us at:

GLP Technologies Limited

Email: support@glptechnologies.co.nz

If you are dissatisfied with our response, you may lodge a complaint with:

Office of the Privacy Commissioner

PO Box 10094, Wellington 6143

Phone: 0800 803 909

Email: enquiries@privacy.org.nz

Website: www.privacy.org.nz

For All Users:

By using the Application, you acknowledge that you have read and understood this Privacy Policy, consent to the collection, use, and disclosure of your personal information as described, understand your rights under the Privacy Act 2020, and are responsible for maintaining the security of your account.

For Employers:

By using the Application as an employer, you acknowledge that you are acting as a data controller/agency under the Privacy Act 2020, are responsible for obtaining all necessary consents from employees, will provide adequate privacy notices, will comply with Information Privacy Principles, and accept legal responsibility for privacy breaches arising from your data processing activities.

For Employees:

If you use the Application for self-tracking, you are responsible for the accuracy of information you input and can exercise your privacy rights by contacting us directly. If your employer uses the Application, your employer is the primary data controller and you should direct privacy requests to your employer first.