Timesheet Privacy Policy

1-OAK Timesheet — Privacy Policy

Last updated: 17 June 2026

This Privacy Policy explains how 1-OAK (“we”, “us”, “our”) collects and uses personal data through the 1-OAK Timesheet mobile application (the “app”).

The app is an internal workforce time-tracking tool for 1-OAK staff only. It is not a consumer product and is not intended for use by members of the public. Accounts are created and issued by 1-OAK; there is no public sign-up.

1-OAK is the data controller for personal data processed through the app. We are based in the United Kingdom and process personal data in accordance with UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. Information we collect

Data	Details
Account & identity	Name, work email address, employee reference, and (optionally) phone number. Created by 1-OAK when your account is set up.
Location	Your device’s GPS location is captured at the moment you clock in and clock out (and when you add a progress photo), to confirm you were at the job site. The app does nottrack your location continuously or in the background.
Photos	A photo is taken with the camera when you clock in; you may add further progress photos during a shift. These are taken live in the app (not chosen from your photo library).
Work records	Clock-in/out times, break and travel time, the job worked, and calculated payable hours.
Device & integrity data	A device identifier and basic anti-fraud flags (e.g. whether a clock event was outside the job’s location, or a photo was not a live capture) used to verify the accuracy of recorded time.

The app does not collect data for advertising, and does not include third-party advertising or analytics trackers.

2. Why we use it & our lawful basis

We use this information only to operate the app for its stated purpose:

To record and verify hours worked so staff are paid accurately for time on the job.
To confirm attendance at the correct job site.
To prevent and detect inaccurate or fraudulent time records.
To maintain payroll and employment records.

Our lawful bases under the UK GDPR are performance of your contract of employment / engagement and our legitimate interests in running an accurate and fair payroll and protecting the business from time-record fraud. Where required, we ask for your consent within the app (on first sign-in) before collecting location and photos.

3. How your data is stored and protected

Records and photos are stored in our secure cloud database and file storage (provided by Supabase, hosted in the EU/UK region), encrypted in transit and at rest.
Clock-in/progress photos may also be copied into 1-OAK’s private Microsoft 365 (OneDrive/SharePoint) storage for record-keeping.
Access is restricted to authorised 1-OAK office and management staff.

4. Who we share it with

We do not sell your personal data or share it for advertising. We share it only with service providers (“processors”) who host the app’s data on our behalf — currently Supabase (database & file storage) and Microsoft (Microsoft 365 storage) — under contracts that require them to protect it. We may disclose data where required by law.

5. How long we keep it

Timesheet / pay records are kept for as long as required for payroll, tax and employment-record purposes.
Raw location data and photos are kept only as long as needed to verify a shift and are deleted on a shorter schedule.

6. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
request erasure of your data (subject to our legal obligation to retain payroll records);
restrict or object to certain processing; and
complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us using the details below.

6a. Account & data deletion

Accounts are created and managed by your employer (there is no public sign-up). To delete your account and the personal data associated with it, contact your employer or email us at stuart@1-oak.co.uk with the subject “Delete my data”. We will remove your account and raw data (location, photos) and confirm once done — except where we are legally required to retain payroll and employment records for a defined period.

7. Children

The app is for 1-OAK staff and is not directed at or intended for children.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to staff, and the “last updated” date above will change.

9. Contact us

For any privacy question or to exercise your rights, contact:
1-OAK
Email: stuart@1-oak.co.uk