HomeGDPR Compliance

GDPR Compliance

Your privacy is our priority, always. TeamTrackin is proudly GDPR-compliant, ensuring your data remains safe, secure, and transparent. Our dedicated Data Protection Officer, James Mitchell, oversees all privacy operations.

Privacy & Data Protection • Your Rights • Security

Table of Contents

Protecting Your Privacy with ...Your Rights Under GDPR How TeamTrackin Collects and ...Trusted Sub-Processors Deleting Your Data Made Si...Built-In Security at TeamTrackin International Data Transfers Cookies & Tracking Have Questions About GDPR?

Data Protection Officer

Reach our DPO for any privacy or GDPR inquiries.

Contact DPO →

HomeGDPR Compliance

Last updated: 1 October 2026

Data Controller Information
Company Name	BUGDEV Ltd, trading as TeamTrackin
Registered Address	Suite 12, Regency House, 45 Promenade, Cheltenham GL50 1PJ, United Kingdom
Company Registration	Companies House No. 14827365 (England & Wales)
ICO Registration	ZB648291
Data Protection Officer	James Mitchell — dpo@teamtrackin.com
Supervisory Authority	Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, UK

Protecting Your Privacy with TeamTrackin

At TeamTrackin, we understand how vital data protection is to your organisation. Since the GDPR enforcement date (May 25, 2018), our team has worked tirelessly to maintain compliance and uphold the highest standards of privacy protection.

Our Commitment to Data Protection

State-of-the-Art Encryption

Your data is encrypted in transit with TLS 1.3 and HSTS, and password-vault entries are encrypted with AES-256.

Secure Servers

Hosted on secure cloud servers behind Cloudflare network protection, with access limited to authorised staff.

Regular Audits

Continuous internal and third-party security assessments to ensure ongoing compliance with GDPR standards and industry best practices.

Data Minimisation

We only collect what's strictly necessary for the service to function, ensuring we never retain your information longer than needed.

Privacy Shield Certified

TeamTrackin meets the highest standards in international data transfer protocols, including EU-UK adequacy decisions and Standard Contractual Clauses (SCCs).

Transparent Processing

Clear, plain-language privacy notices so you always know exactly what data we collect, why we collect it, and how long we keep it.

GDPR Article 5 Compliant: TeamTrackin adheres to all six principles of data processing — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity & confidentiality.

Your Rights Under GDPR

The General Data Protection Regulation grants you powerful rights over your personal data. At TeamTrackin, we make it easy for you to exercise every one of these rights.

Right to Access

Download a copy of all personal data held about you at any time from Settings → Your data in TeamTrackin (or the mobile app). Can't sign in? Email us and we'll respond within 30 days.

Right to Rectification

If any of your personal data is inaccurate or incomplete, you can request corrections and we'll update your records promptly.

Right to Erasure

Also known as the "Right to be Forgotten". Request deletion of your personal data when it's no longer needed for its original purpose.

Right to Restrict Processing

You can request that we limit how we process your data in specific situations, such as while we verify the accuracy of disputed data.

Right to Data Portability

Receive your personal data in a structured, commonly used, machine-readable format (JSON/CSV) for easy transfer to another service.

Right to Object

Object to certain types of processing, including direct marketing and profiling. We will cease processing unless we have compelling legitimate grounds.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) — ico.org.uk.

To exercise any of your GDPR rights, email our Data Protection Officer, James Mitchell, at dpo@teamtrackin.com with the subject line "GDPR Request — [Your Right]". We will acknowledge your request within 72 hours and fulfil it within 30 days.

How TeamTrackin Collects and Processes Your Data

We prioritise transparency at every step. TeamTrackin collects data such as usage logs, time records, screenshots, application usage data, and IP addresses to enhance productivity, improve security, and provide you with actionable insights.

What Data We Collect

Data Category	Examples	Legal Basis	Retention
Identity Data	Full name, email address, job title, employee ID	Contract	Duration of account + 30 days
Activity Data	Keystroke/mouse activity levels, active/idle time, app usage logs	Legitimate Interest	Set by plan: 2 years (Basic, trial or no plan), 4 years (Standard), 6 years (Shift plan), 7 years (Premium & Enterprise). App & website details: 6 months default (employer can choose 3–12 months)
Screenshot Data	Periodic screen captures (configurable frequency)	Legitimate Interest	6 months default (employer can choose 3–12 months)
Time Records	Clock-in/out times, timesheet entries, break durations	Contract	8 years
Technical Data	IP address, browser type, device OS, timezone	Consent	6 months
Communication Data	Support tickets, feedback forms, contact requests	Contract	24 months

How We Process Your Data

Collection

Data is collected only when you or your organisation's admin actively uses TeamTrackin. We never collect data outside of tracked working hours unless explicitly configured.

Encryption & Transfer

All data is encrypted with TLS 1.3 in transit, and password-vault entries are encrypted with AES-256.

Processing & Analytics

Data is processed to generate productivity reports, timesheets, attendance records, and performance insights. We never use your data for advertising or profiling for third parties.

Storage & Retention

Data is stored in secure data centres in the United States with strict access controls. Retention periods are clearly defined and data is automatically purged after the retention window.

Deletion

When retention expires or you request erasure, data is permanently and irreversibly deleted from all systems, including backups, within 30 days.

Automated Decision-Making & Profiling

TeamTrackin does not engage in any automated decision-making or profiling that produces legal effects. Productivity scores are provided as informational tools for managers and are never used as the sole basis for any employment decisions.

No automated hiring or firing: TeamTrackin productivity metrics are advisory only. We explicitly prohibit the use of our analytics as the sole basis for employment decisions without human review.

For more details, check our Privacy Policy.

Trusted Sub-Processors

We work with a carefully vetted set of third-party sub-processors, all of whom adhere to GDPR standards and have signed Data Processing Agreements (DPAs) with TeamTrackin.

Sub-Processor	Purpose	Data Location	Compliance
Vultr	Application servers & managed database	US (Atlanta)	SOC 2 Type II, ISO 27001
Amazon Web Services (AWS)	File storage (screenshots, attachments)	US (Ohio)	SOC 2, ISO 27001
Cloudflare	CDN, DDoS protection & DNS management	Global edge network	SOC 2, ISO 27001
Stripe	Subscription billing & payment processing	US / EU	PCI DSS Level 1
SendGrid (Twilio)	Transactional & notification email delivery	US	SOC 2 Type II
Expo	Push notifications for the mobile app	US	SOC 2 Type II
AI model provider	Powers TeamTrackin AI features (no training on your data)	US	SOC 2 Type II, ISO 27001
Google Analytics 4	Website analytics (IP anonymisation enabled)	US / EU	GDPR DPA
Microsoft Clarity	Website usage analytics (marketing site only)	US	GDPR DPA

Deleting Your Data Made Simple

Want to delete your data? We've got you covered with an easy, step-by-step process for individual users and organisations. Once the deletion begins, it cannot be reversed.

For Individual Users

Submit a Request

In TeamTrackin, go to Settings → Profile → Your data & privacy (or Profile → My data & privacy in the mobile app) and choose Request deletion. Client portal users use Settings → Your data. If you can no longer sign in, email dpo@teamtrackin.com with the subject "Data Deletion Request — Individual", your full name and your account email.

Employer Review

Your employer (the data controller) reviews the request and approves it, or declines it with a reason you can see in the app. They must respond within one month.

Deletion Processing

Once approved, your account is closed and your personal data — profile, photos and screenshots, location, activity details and devices — is deleted straight away. Pay and working-time records the law requires are kept without your name until the retention period ends.

Backup Purge

Backup copies are automatically purged within an additional 30 days. You'll receive a final confirmation email once the process is complete.

For Organisations

Admin Initiates Request

The organisation's account admin submits a deletion request via the TeamTrackin admin panel or by emailing our DPO.

Scope Confirmation

We confirm whether the request covers the entire organisation's data or specific user accounts. A written acknowledgement is sent within 72 hours.

Complete Erasure

All associated data — user profiles, activity data, screenshots, timesheets, invoices, and configuration settings — is permanently deleted within 30 days.

Built-In Security at TeamTrackin

Security is not an afterthought at TeamTrackin — it's built into every layer of our platform.

AES-256 Vault Encryption

Password-vault entries are encrypted with AES-256, the same standard used by financial institutions worldwide.

TLS 1.3 in Transit

Every data transfer uses TLS 1.3 — the latest and most secure transport layer protocol.

Role-Based Access Control

Granular RBAC ensures only authorised personnel can access specific data at user, team, and organisation levels.

Two-Factor Authentication

2FA is available for all accounts and mandatory for admin roles. Supports authenticator apps and SMS-based verification.

Continuous Monitoring

24/7 automated monitoring and anomaly detection across our infrastructure.

Penetration Testing

Regular third-party penetration testing and vulnerability assessments ensure our defences stay ahead of evolving threats.

Incident Response: In the unlikely event of a data breach, TeamTrackin will notify affected users and the relevant supervisory authority within 72 hours as required by GDPR Article 33.

International Data Transfers

TeamTrackin stores and processes data in the United States. For customers in the UK and the EEA, we protect these transfers with the safeguards below.

Transfer Mechanisms We Use

Standard Contractual Clauses (SCCs): Approved by the European Commission, signed with every sub-processor outside the EEA/UK.

UK International Data Transfer Agreement (IDTA): Used in conjunction with SCCs where data originates from the UK.

Adequacy Decisions: Where available, we rely on formal adequacy decisions issued by the European Commission or the UK Secretary of State.

Transfer Impact Assessments (TIAs): Conducted for each sub-processor to evaluate the legal framework of the destination country.

Cookies & Tracking Technologies

TeamTrackin uses cookies and similar technologies to ensure the proper functioning of our website, improve user experience, and analyse usage patterns.

Cookie Type	Purpose	Duration	Required?
Strictly Necessary	Session management, authentication, CSRF protection	Session / 24 hours	Required
Functional	Language preferences, timezone settings, dark mode	12 months	Optional
Analytics	Anonymised usage statistics via GA4 (IP anonymisation)	13 months	Optional
Marketing	Attribution tracking for advertising campaigns	6 months	Optional

Have Questions About GDPR?

We're here to help. Whether you have a question about your rights, want to understand how we process your data, or need to submit a formal request, our team is ready to assist you.

Contact Method	Details	Response Time
Email (DPO)	dpo@teamtrackin.com	Within 72 hours
Phone	+44 20 7946 0958 / +44 20 7946 0959	Business hours
Post	Data Protection Officer, TeamTrackin, Suite 12, Regency House, 45 Promenade, Cheltenham GL50 1PJ, UK	5–7 business days
Contact Form	teamtrackin.com/contact	Within 24 hours

Back toHome

NextPrivacy Policy

Your Data, Your Control

TeamTrackin is committed to GDPR compliance and transparent data handling. Start your free trial today and experience privacy-first workforce management.

Try the demo

Contact DPO

Cookies on TeamTrackin