Operative privacy notice
Each organisation is the controller here. The tracking page and Tracker app show this notice filled in with the organisation's name and privacy contact, or link to the organisation's own notice instead.
Draft for legal review. A template that [the organisation] adopts, or adds to its own staff privacy notice.
[the organisation] uses ROCC Tracker to tell customers when you're on the way to them. This notice explains what that involves for you.
[the organisation] is responsible for your information (the "controller"). [ROCC legal entity name] provides Tracker and uses your information only for [the organisation]. For questions, or to use your rights, contact [the organisation's privacy contact].
Your location: only on the way to a visit
- Tracker shares your location only between "Start journey" and arriving at the visit. It doesn't track you before you set off, between visits, on breaks or after work.
- While you're on the way, your position, its accuracy, your direction and speed, and the time are sent to Tracker. They're used to show the customer where you are and when you'll arrive.
- The customer sees your position only for their own visit, and only until you arrive.
- [the organisation]'s staff can see where you are while you're on the way. After arrival they can see how long the journey took and how far it was. If [the organisation] uses visit history, they can also see the route you drove, for 30 days.
- The location trail is deleted 24 hours (or up to 30 days with visit history, or less if the organisation chooses) after the visit ends. The journey's time and distance stay with the visit record, which is deleted the period the organisation sets (6 to 36 months; 24 by default) after the visit.
After you arrive, the journey may be matched to the road map. That gives a tidy route in visit history, and measures how long the journey took against free-flowing traffic. Only an anonymous timing is kept from that, to improve arrival estimates: a roughly 5 km area, the hour of the week, the distance and the times. It has no name, organisation, route or address.
If you tell Tracker you're running late, the customer sees your new time and, for most reasons, why. The reason is also kept with the visit, so stops for parts, fuel or a break are kept out of the traffic estimates. It isn't for judging you.
Privacy zone. You can draw a circle around your home in the Tracker app. While you're inside it, the app sends no location, so neither the customer nor [the organisation] sees where you are. The circle is kept on your phone and isn't sent to Tracker. Customers see your position from where you leave it.
On phones set up with background location, the app keeps sharing during a journey when the phone is locked or you're using another app. The phone shows a notification or indicator while it does. Without background location, it shares only while the Tracker app is open on screen.
Other information
- Your details: your name, which customers see when you set off, your work email and phone number, and which visits you're assigned.
- Your photo, if [the organisation] adds one. Customers see it only while you're on the way to them or have arrived, so they can check who's at the door. This matters most for vulnerable residents. It isn't used for anything else, such as identifying you automatically.
- Your phone: the device name, and when it was paired and last used, so [the organisation] can sign lost or old phones out.
Why, and on what basis
- Why: to tell customers when to expect you, to help plan and share out the day's visits, and to help customers check who is at the door.
- Lawful basis: [the organisation]'s legitimate interests in running visits efficiently, keeping residents informed and keeping residents safe. It's not based on your consent, because as an employer [the organisation] can't rely on consent freely given.
- Balance: [the organisation] has weighed these interests against your privacy. That's why location is limited to journeys to visits, and why the trail is deleted after a short time.
- Not used for: Tracker isn't designed for monitoring performance or disciplinary decisions. If [the organisation] ever used the data that way, it must tell you first.
Who can see it
- [the organisation]'s staff who manage visits.
- The customer you're travelling to: your name, photo and position, during that journey only.
- ROCC and its hosting and email providers, only to run the service.
Your rights
You can ask [the organisation] for a copy of your information, to correct it, or to delete or restrict it. You can also object to it being used, for example to having a photo shown. Contact [the organisation's privacy contact].
If you're unhappy with how your information is handled, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.