PSH Worker Privacy Policy

1. Who is who

Service provider: PSH Usługi Sp. z o.o., ul. Przemysłowa 47, 22-100 Chełm, tax ID (NIP) 9223067313, e-mail: support@pshu.pl (“we”, “PSH Usługi”). We have not appointed a data protection officer – please write to the above address on all data-related matters.

• Data of website visitors, people submitting the contact form, registration and billing data of customer companies and the record of acceptance of the Terms of Service and the data processing agreement – we (PSH Usługi) are the controller.
• Data of employees recording working time, panel users, tasks and clients entered into the system – the controller is the customer company (employer or principal) that created the accounts in the system. In this respect PSH Usługi is a processor (Art. 28 of the General Data Protection Regulation – GDPR, in Polish: RODO): it processes the data solely on the customer company's instructions, under a data processing agreement, and does not use it for its own purposes.

If you are an employee of a company using PSH Worker, you will receive information about the purposes and legal bases of processing and about your rights from your employer (information notice). Your employer may prepare the notice in the panel and make it available in the app – in that case, before starting work, you acknowledge in the app that you have read its current version (without this acknowledgement you cannot record the start of work in the app – a start of work saved offline then goes to your supervisor for acceptance with a flag; ending work and breaks always work). The acknowledgement documents that the information has been provided and is not a legal basis for processing the data – the legal bases are set out in the notice. Below we describe how the system works and what data is generated in it.

2. The website worker.pshu.pl

The website does not use analytics or advertising tools or tracking cookies. We only store strictly necessary information in the browser (selected language, acknowledgement of the cookie notice) – details in the Cookie Policy. We select the website language automatically based on your browser settings (the Accept-Language header) – no data is stored in the process.

The website, the company panel and the client portal are hosted on Cloudflare infrastructure, which processes technical connection data (IP address, request time, page address, browser) to ensure security and protect against attacks, for as long as necessary for those purposes – on the basis of Art. 6(1)(f) GDPR (our legitimate interest: security of the service).

Contact form

We process the data you provide (company name, full name, e-mail, phone, number of employees, plan, message content) in order to respond to your enquiry and prepare an offer – on the basis of Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) (communication with interested parties). The message is delivered by e-mail via the Resend service. We keep the data until the discussions end and, if a contract is concluded, for its duration and the limitation period for claims.

Company registration and payments

During registration (“Sign up”) we process company data (name, company code, tax ID, address) and the boss's data (first name, last name, e-mail, phone, username) in order to conclude and perform the contract (Art. 6(1)(b) GDPR), issue invoices and keep accounts (Art. 6(1)(c) GDPR) and pursue claims (Art. 6(1)(f) GDPR). The password is passed directly to the authentication service and stored only as a hash. We also record the IP address from which the registration form was sent, in order to limit the number of registrations from a single address and protect the service against abuse (Art. 6(1)(f) GDPR – our legitimate interest: security of the service). The IP address is not part of the billing data – we delete it together with the company account data (after the contract ends – within 30 days; after cancellation within 14 days – without undue delay once 30 days have elapsed since the account's closure).

Online payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland) – you enter your card or other payment instrument details directly on Stripe's website and we have no access to them. We provide Stripe with the buyer's e-mail address, the company name and the order number and amount, and we receive information from Stripe about the status of the payment and of any refund. In the event of cancellation within 14 days of the conclusion of the agreement (Terms of Service, § 4), we instruct Stripe to refund online payments, and we refund payments made by bank transfer to the account from which we received them – in which case we process the details of that account (Art. 6(1)(b) and (c) GDPR). We do not store that account number in the system – it is kept only in the banking records.

We keep accounting documents and data on orders (number, plan, period, amounts, invoicing details: name, tax ID, address), payments and refunds (amounts, dates, Stripe transaction identifiers) and the record of the cancellation (dates, method of submission, refund amounts) for 5 years from the end of the calendar year in which the tax payment deadline expired – also after cancellation or termination of the contract (Art. 6(1)(c) GDPR in conjunction with accounting and tax laws). After a cancellation within 14 days, we delete the IP address from which the registration was submitted and the notes on the cancellation and refunds (including the reason for cancellation, if the company boss gave one) from the system together with the company account data, and the buyer's e-mail address and the contact address from the order – 30 days after the last refund has been completed (correspondence regarding the refund and the corrective invoice – Art. 6(1)(b) and (f) GDPR). After the contract ends without a cancellation, we delete the buyer's e-mail address and the contact address from the order together with the company account data. If we refund a payment after the contract ends (e.g. a duplicate or late payment), we delete the buyer's e-mail address and the contact address from that order 30 days after the last refund has been completed. We keep the record of the end of the contract (dates, reason, company name, identifier and tax ID) for as long as the billing data – as proof of the end of the contract and of the deletion of data in accordance with the data processing agreement (Art. 6(1)(f) GDPR). We keep messages about cancellations and refunds that reach our mailbox support@pshu.pl in the same way as other correspondence with customers – for the duration of the contract and the limitation period for claims.

Acceptance of the Terms of Service and the data processing agreement

We record the acceptance of the Terms of Service and the data processing agreement by the customer company – at registration (“Sign up”) and, if the company ordered the service via the contact form, at the company boss's first login to the panel or the app: the name of the accepting person, the link to their account in the system, the company name, the date and time (server time), the versions of the Terms of Service and the data processing agreement, the version of the privacy policy made available at the time of acceptance and the method of acceptance (registration or first login). The purpose is to demonstrate the conclusion of the contract and its terms (Art. 6(1)(b) GDPR) and to establish, pursue or defend claims (Art. 6(1)(f) GDPR – our legitimate interest). We keep the record for the duration of the contract and, after it ends, for as long as billing data (5 years from the end of the calendar year in which the tax payment deadline expired). When we delete the company account data, we remove the name of the accepting person and the link to their account from the record – the company name, date and time, document versions and method of acceptance remain.

Login page

The company login form passes the login details directly to the authentication service (Supabase Auth) and, after a successful login, redirects to the company panel. Accounts with panel permissions confirm the login in the panel with a code from an authenticator app (two-factor authentication, 2FA). The website does not store the session in the browser – the session is passed only to the panel.

3. Employee app and company panel – what data is generated

4. Location – rules

• The customer company decides whether location is collected at all (the “Location on punches” switch in Configuration). When it is off, only the server time is recorded.
• Location is read only at the moment the punch button is pressed, a task is marked as done (if the task requires it), a work site is declared or a location check request is confirmed (sent by a supervisor manually, on a schedule or – if the company enables this – at random moments within set hours; the request only goes to people who are at work). A punch correction request does not read the location.
• For an offline punch (a module enabled by the company, Android app), the position is read from GPS without internet access – also only at the moment of punching – and sent once the connection is restored. Marking a task as done without signal works in the same way.
• The app does not run in the background and does not track routes. It does not ask for “always allow” location permission.
• Every reading taken when punching is visible to the employee in their punch history (time, address, accuracy).
• The supervisor sees punch points on the map, an assessment of the reliability of the measurement and whether the punch took place at the designated work site.

5. Photos in tasks

Photos added to tasks (reference photos – by the supervisor; completion photos – by the employee) are stored in private file storage in the EU and are accessible only via time-limited signed links for authorised persons within the company and – in the case of completion photos – for the client to whom the company has provided the portal or sent a report. Employees should photograph only the subject of the task and avoid capturing images of third parties.

The app saves photos taken without signal in its private directory on the phone (not in the gallery) and deletes them from the phone once the server has confirmed receipt.

6. Client portal

The client opens the portal using a link received from the customer company and a password set by that company. They see only the tasks assigned to them and their status – without employees' location data. A portal session lasts up to 12 hours and is remembered only in the given browser tab. To protect against password guessing, we process the IP address (attempt limit) – Art. 6(1)(f) GDPR.

7. Scanning of installed apps (Android)

To detect software that simulates GPS position, the Android app checks whether apps from a list of known “fake GPS” tools and root tools are installed on the device. We do not transmit the full list of apps – only the package names matching that list are sent to the server.

The app also checks whether a mock location app has been selected in the phone's settings and whether developer options are enabled. The information about developer options is only supplementary and does not by itself block a punch.

8. Data recipients and place of processing

• Supabase, Inc. – database, authentication, storage of task photos and files, server-side functions; data stored in the European Union (Frankfurt) region.
• Cloudflare, Inc. – hosting of the website, the company panel and the client portal, DNS, content delivery network and attack protection, storage of the app installation file and update information (IP address and technical request data).
• 650 Industries, Inc. (Expo) – intermediation in sending push notifications (device token and notification content, e.g. the employee's full name, task title) and making the app available on iPhones via Expo Go (device IP address).
• Google LLC (Firebase Cloud Messaging) – delivery of push notifications to Android phones (device token and notification content).
• Apple Inc. (Apple Push Notification service, Apple Maps) – delivery of push notifications to iPhones (device token and notification content) and displaying maps in the iPhone app (device IP address and the map area viewed).
• OpenStreetMap Foundation (Nominatim, map tile servers) – converting punch coordinates to an address (the request is sent by the system's server and contains only the coordinates); searching for an address entered in the panel or in the supervisor's app (the entered text and the device IP address); displaying maps in the panel, the client portal and the Android app (device IP address and the map area viewed); map tiles are delivered by the Fastly, Inc. network.
• Resend, Inc. – sending system e-mails to the company boss and panel users (panel username, notifications of two-factor authentication being enabled, changed or reset, orders, payments, refunds, cancellation), including to persons ordering the service, and delivering messages from the contact form; sent from the EU region (Ireland).
• Stripe Payments Europe, Ltd. – processing online subscription payments and their refunds; with regard to payment data, Stripe also acts as a separate controller (among other things, for fraud prevention and compliance with legal obligations).
• E-mail hosting provider – operation of the support@pshu.pl mailbox (contact form messages, notifications of registrations, payments and cancellations, correspondence with customers).

The entities listed from Supabase to Resend are sub-processors within the meaning of the data processing agreement (§ 6) – they process data from the system on the customer company's instructions, and data for which we are the controller (website, contact form, registration and billing) on our instructions. Stripe and the e-mail hosting provider have no access to the system – they process billing data and correspondence (Stripe, with regard to payment data, also as a separate controller).

Some of these entities (Supabase, Cloudflare, Expo, Google, Apple, Resend and Stripe, as well as Fastly, Inc., through which map tiles are delivered) have their registered office in the USA or also process data outside the European Economic Area, and the OpenStreetMap Foundation has its registered office in the United Kingdom. Data is transferred outside the EEA on the basis of a European Commission adequacy decision (Art. 45 GDPR) – in the case of the United Kingdom and US entities certified under the EU-US Data Privacy Framework – and in other cases on the basis of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses used for the transfer by writing to support@pshu.pl; their text is also available on the European Commission's website (Commission Implementing Decision (EU) 2021/914). The database containing working-time records, as well as task photos and files, is stored in the EU (Frankfurt).

Buttons that open a location or navigation in Google Maps send the coordinates to Google only when clicked – from that moment on, the data is processed by Google as a separate controller. The customer company sends the report for the client from its own mailbox (the panel only prepares the message), so the report does not pass through our mail servers. Export files (reports, the export to HR and payroll software, the export of company data) are created in the browser of a person authorised by the customer company and are not stored in the system; passing them on (e.g. to an accounting office) is the responsibility of the customer company.

We do not sell data or use it for marketing purposes. Access to a customer company's data is limited to persons authorised by that company and – for the purpose of maintaining the service and providing technical support, on the customer's instructions – authorised PSH Usługi staff. Every time the platform administrator enters a company panel, this is recorded in the audit log visible to the company boss.

9. How long we keep data

• Data from the system – working-time records (punches, corrections and correction requests, calibrations, offline punches together with supervisors' decisions), location data, failed punch attempts, security events, the audit log, leave requests, reminders about work that has not been ended, acknowledgements of the information notice, and payroll export identifiers and settings – until the end of the contract with the customer company, unless the customer company instructs that it be deleted earlier.
• Tasks, photos and files – until deleted by the customer company, at the latest until the contract with the customer company ends.
• After the contract with the customer company ends, we close its company account, and data from the system is returned or deleted in accordance with its instructions and the data processing agreement – no later than 30 days after the contract ends. Working-time records are kept by the employer itself for the period required by labour law (as a rule, 10 years from the end of the calendar year in which the employment relationship ended) – before the contract ends, it can download a data export. A data export that we hand over at the customer company's request after its company account has been closed is prepared by the platform administrator solely for the purpose of handing it over; we delete our copy without undue delay after handing it over, no later than on the day the data is deleted from the system. In the event of cancellation within 14 days, the company account is closed immediately and the data from the system is permanently deleted without undue delay once 30 days have elapsed since the account's closure.
• Backups: the Supabase plan we use does not include automatic backups available to us. The only copies at our disposal are database copies made manually by the platform administrator before system updates – stored on the administrator's computer and deleted no later than 30 days after they were made. Data deleted from the system may therefore remain in such a copy for no longer than 30 days after its deletion.
• Readings of the phone's clock (time anchors) not used by any operation saved without signal – 35 days; one-time device key attestation challenges – 1 day. Data saved on the phone without signal – until the server confirms receipt (after logging out it waits for the same person to log in again), after which it is deleted from the phone (information on operations rejected by the server – 7 days). Copies for working without signal – up to 50 assigned tasks with reference photo thumbnails, the profile and the current day's punches – until logging out of the app or until the app learns that the company account has been closed; files the app cannot read – 30 days.
• Two-factor authentication data – until it is reset or the account is deleted; entries on its events – as for the audit log.
• Push tokens – until logout from the device.
• Billing data (orders, payments, refunds, cancellations, records of the end of the contract) – 5 years from the end of the calendar year in which the tax payment deadline expired, also after cancellation or termination of the contract (the registration IP address and e-mail addresses – as set out in section 2); the record of acceptance of the Terms of Service and the data processing agreement – for the duration of the contract and, after it ends, for as long as billing data (the name of the accepting person – until the company account data is deleted, as set out in section 2); contact form data – as set out in section 2.

10. Security

• Passwords stored only as hashes on the server side; transmission encrypted with TLS.
• Accounts with panel permissions and platform administrator accounts log in with a password and a code from an authenticator app (TOTP) – without the code the server does not make panel data available. Notifications containing other persons' data are delivered only to supervisors' devices after two-factor authentication.
• The session on the phone is stored in the system's secure storage (Android Keystore / iOS Keychain).
• Punches are recorded only by the server after validation – the app has no direct write access. The punch time comes from the server. The exception is an offline punch (a module enabled by the company): its time is calculated by the server from the time anchor and the phone's system clock, which is independent of the date and time settings, and the punch itself awaits acceptance by a supervisor and until then is not included in reports or exports.
• Operations saved without signal are stored on the phone in an encrypted queue (key in the Android Keystore; on an iPhone – in the iOS Keychain) and signed with a non-exportable device key; the server verifies the signature and the key attestation. Photos waiting to be sent are stored in the app's private directory. Copies for working without signal (tasks, profile, the current day's punches) are encrypted with the same key; reference photo thumbnails are stored in the app's private directory.
• Row Level Security in the database: each company sees only its own data, and each employee only their own.
• Original punches are immutable. Additions by a supervisor, corrections requested by employees, calibrations and decisions on offline punches are separate, flagged entries recorded in the audit log. No one decides on their own correction requests.
• An employee account is bound to a single device; changing it requires the company's approval. Client portal passwords are stored as hashes, and after 5 failed attempts access is temporarily blocked.

11. Rights of data subjects

You have the right to access your data, to have it rectified, erased or its processing restricted, the right to data portability, the right to object (to processing based on legitimate interest) and the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

• For matters concerning the website, forms and billing – write to us: support@pshu.pl.
• For matters concerning data from the app, the panel or the client portal – contact your employer or the company that gave you access to the portal (it is the controller of that data). If you write to us, we will forward your request to the relevant company and help to fulfil it.

Providing data in the forms is voluntary, but necessary to respond to an enquiry or conclude a contract. We do not make decisions based solely on automated processing that would produce legal effects concerning you – blocking a punch when GPS manipulation is detected concerns only the entry in the records and can always be supplemented by a supervisor (e.g. following the employee's correction request). The system checks offline punches automatically, but the decision to accept each of them is made by a supervisor; rejections for technical reasons are visible to the supervisor.

12. Changes to this policy

We will announce significant changes on this page and – as regards the app – in the app or the panel before they take effect. The Polish version of this document is binding.