Privacy policy

This policy explains how Littlebourne Labs Ltd, trading as WorkWing ("we", "us"), uses personal data for which we are the controller. We are registered in England and Wales (company number 17119449), our registered office is 128 City Road, London, EC1V 2NX, and we are registered with the Information Commissioner's Office (ICO) under reference ZC111876.

Contact: support@workwing.io.

1. Whose data this policy covers, and whose it does not

This policy covers:

• Visitors to our websites (workwing.io and our documentation site)
• Everyone who signs in to WorkWing - administrators, dispatchers, operators and field workers - but only for the narrow set of data described in section 2: your sign-in identity, your session and device records, diagnostic logs, and records of which parts of WorkWing are used in your organisation's workspace. We decide to collect that data, for our own purpose of running and securing the platform, which is what makes us its controller
• Account and billing contacts of organisations that subscribe to WorkWing, for the additional account-administration and billing data in section 2
• People who contact us for support, sales, or anything else

This policy does not cover the rest of what an organisation using WorkWing stores about you. If you are a field worker, that means your worker profile, your skills and certifications, your schedule and job history, your location while you are on an assigned job, and the notes, forms and photos attached to your work. If you are the customer of a business that uses WorkWing, it means your contact details, your address and your job records. For all of that, the WorkWing customer (your employer, or the company servicing your property) is the controller and we are their processor under our Data Processing Agreement.

Please direct requests about that data to them, not to us. If you contact us instead, we will forward your request to them without undue delay and tell you we have done so.

2. What we collect, why, and our lawful basis

We do not use personal data for automated decision-making with legal or similarly significant effects, and we do not sell personal data.

3. Location data collected by the WorkWing mobile app

The WorkWing mobile app is used by field workers, and it collects the device's precise location so that the organisation they work for can run its field operations. We set this out here in full, even though the organisation is the controller of that data and we process it on their behalf (section 1), because it is the most sensitive thing the app does and you should not have to read two documents to find out about it.

When the app collects your location:

• While the app is open, whenever you are signed in to an organisation that has location sharing switched on, you are not on a break, and you are within the working hours your organisation has set for you. Outside those hours the app records your position while it is open only if you are en route to or on site at a job. If your organisation has not set working hours for you, Monday to Friday, 08:00 to 17:00 applies. The app records your position periodically while it is on screen.
• In the background, including when the app is closed or not in use, only between the moment you mark yourself en route to a job and the moment you arrive, complete the job, or sign out. Your phone shows a persistent location indicator for the whole of that period, so you can see that sharing is running.
• Never when you are signed out, when you have set yourself offline in the app (only you can do that or undo it), when your organisation has location sharing switched off, or, on your own device, when you have turned location sharing off in the app's settings or denied the permission in your device settings.

What it is used for. Your organisation's dispatchers and administrators see your current position and your progress towards jobs on their dispatch map, use it to plan routes, and can send the customer an arrival update while you are en route. Positions recorded during a job are kept as a trail that your organisation can refer back to when checking timesheets or resolving a query about a visit.

Who it is shared with. Your location is visible to the dispatchers and administrators of your organisation, and, if your organisation has turned that feature on, a delayed en-route position is shown to the customer whose job you are travelling to on their job-tracking page. It is stored on the hosting providers named in section 5 on our behalf. It is never sold, never used for advertising, and never shared with anyone outside your organisation for any other purpose.

How long it is kept. Your organisation chooses the retention period for location data in its WorkWing settings, and older positions are deleted automatically once it has passed.

Your choices. You can turn location sharing off at any time in the app's settings, unless your organisation has made it a requirement of your role, and you can withdraw the location permission in your device settings at any time. Because your organisation is the controller, questions about why it collects your location and objections to that collection go to them (section 1). If you contact us instead, we will forward your request to them without undue delay.

4. Cookies and similar technologies

This section covers cookies and the other technologies that store or read information on your device, including browser local storage, which UK law (PECR) treats the same way.

Our marketing site uses only strictly necessary cookies (security) and a theme preference stored locally in your browser; our analytics are cookieless. Details are in our cookie policy. The application uses strictly necessary cookies for sign-in sessions and security, first-party storage that remembers preferences you set (language and theme), and, on billing pages, fraud-prevention cookies set by our payment provider. Its product usage analytics are cookieless and store nothing on your device. None are used for advertising or cross-site tracking.

5. Who we share data with

We use a small number of service providers to run WorkWing, under contracts that meet UK GDPR requirements:

• Hosting and infrastructure: Hetzner (Germany/Finland), Neon (database, EU region), Cloudflare (edge network and storage)
• Payments: Stripe
• Transactional email (password resets, invitations, receipts): Resend
• Error monitoring and in-app problem reports: Sentry (EU region)
• Website analytics (marketing and documentation sites, cookieless and aggregate): Cloudflare Web Analytics, Plausible Analytics (EU)
• Product usage analytics (the WorkWing application, cookieless): Plausible Analytics (EU)

Some of these providers also process data on behalf of our customers rather than for us; where they do, they appear on our sub-processor list as well. Our payment provider appears only here, because it is engaged for our own subscription billing and receives no data belonging to a customer's own workers or clients.

WorkWing staff can enter your organisation's workspace only when one of its administrators grants access with a one-time code; the administrator chooses whether staff may make changes, and the organisation's administrators are told by email when a session starts and when it ends.

We may also disclose personal data where required by law, or as part of a business sale or reorganisation (in which case this policy continues to apply to the data).

6. International transfers

Our primary database and compute infrastructure is hosted in the UK/EEA, our error monitoring is ingested in the EU, and our email provider processes data in Ireland. Our payment provider contracts through its UK entity; some processing occurs in the United States within the Stripe group.

Where any provider processes personal data outside the UK/EEA, we rely on a safeguard recognised under UK GDPR - the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses - in that provider's data processing terms, and we carry out a transfer risk assessment where one is required.

7. How long we keep data

• Account identity, session and device data: for as long as your organisation's subscription is active, then deleted 90 days after it ends. This is WorkWing's own retention rule for the data it controls; it happens to run to the same 90 days as the grace period in our customer DPA, but it does not depend on that document
• Billing records: 6 years from the end of the relevant financial year, as required by UK tax law
• Error and diagnostic logs: 90 days
• Correspondence: 24 months after the matter is closed

8. Your rights

You have the right to access your personal data, to have it rectified or erased, to restrict or object to processing, and to data portability, in each case as provided by UK GDPR. To exercise a right, contact support@workwing.io; we will respond within one month.

Because most of the data we hold about the people who use WorkWing is processed on our legitimate interests, you have the right to object to that processing at any time, and we will stop unless we can show compelling legitimate grounds that override your interests. Note that we cannot run an account without its sign-in identity and security records, so an objection to those may mean the account cannot continue.

If your request concerns data your employer or a business you deal with holds in WorkWing rather than the data described in section 1, see section 1: we will forward the request to them.

You also have the right to complain to the ICO (ico.org.uk, or 0303 123 1113). We would appreciate the chance to address your concern first, but you may contact the ICO at any time.

9. Changes to this policy

Each version of this policy is dated and versioned. Material changes will be notified to account holders by email or in-product notice before they take effect; superseded versions are available on request.

WorkWing is a trading name of Littlebourne Labs Ltd, a company registered in England and Wales (company no. 17119449). Registered office: 128 City Road, London, EC1V 2NX. ICO data protection registration ZC111876.

Questions about this document? Email support@workwing.io.