How we collect, use, and protect personal data.
The AttendIQ platform is operated by AttendIQ ("we", "us", "our") from the United Kingdom.
We are registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration reference: ZC108098.
Data controller contact: privacy@attendiq.co.uk
This notice covers three groups of people:
AttendIQ operates in two distinct capacities depending on the data involved:
When you register for and use AttendIQ as an administrator, we process:
Legal basis: Performance of the contract between AttendIQ and your organisation (UK GDPR Article 6(1)(b)). Activity logs are processed on the basis of our legitimate interests in maintaining platform security and detecting fraud (Article 6(1)(f)).
Worker records are created by admin users on behalf of an employing or engaging organisation, or by workers themselves via the AttendIQ mobile app. Data typically includes:
Legal basis (for AttendIQ's own processing as controller): Legitimate interests in operating a secure, compliant platform (Article 6(1)(f)).
Legal basis relied upon by our customers as data controller: Legal obligation (Construction (Design and Management) Regulations 2015, Working Time Regulations 1998, right to work legislation) and legitimate interests in managing their workforce safely and compliantly.
Some platform features involve special category personal data under Article 9 of the UK GDPR. This data is protected by AES-256 encryption at rest, row-level security ensuring strict tenant isolation, and role-gated access controls requiring explicit special category permissions (medical_view, da_view) assigned per-user by your organisation's administrator.
Medical and occupational health data: Where an administrator records health-related information such as fitness-for-work assessments or medical restrictions.
Legal basis: Article 9(2)(b) - processing necessary for employment purposes, subject to Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018. An Appropriate Policy Document is maintained.
Drug and alcohol test results: Where a contractor records D&A testing results as part of their site access policy.
Legal basis: Article 9(2)(b) - processing necessary for employment purposes, subject to Schedule 1 Part 1 paragraph 1 of the Data Protection Act 2018. An Appropriate Policy Document is maintained.
Biometric data: Some sites offer biometric clock-in (face verification and, where enabled, an anti-spoof "liveness" check) as an opt-in alternative to PIN-based clock-in. Workers give separate, explicit consent under Article 9 before any biometric data is captured, and can decline or withdraw consent at any time from their account settings with no disadvantage - a non-biometric alternative (PIN) remains available. Facial data captured for this purpose is used only to verify identity at clock-in and induction attendance, is processed by our biometric processing sub-processor (see Section 4), and is deleted in line with our biometric-specific retention rules (see Section 6) - materially shorter than our general data retention periods, since biometric data is removed once a worker is no longer active on the platform.
When you visit attendiq.co.uk, we may process:
Legal basis: Legitimate interests in understanding how our website is used and responding to enquiries (Article 6(1)(f)). Marketing communications are sent only with your consent (Article 6(1)(a)).
We share personal data only where necessary. We do not sell personal data and do not share it with advertising networks.
We engage sub-processors to help operate the platform. All are engaged under written contracts containing the required Article 28 data processing terms.
A current list of our sub-processors is maintained separately and is available on request by emailing hello@attendiq.co.uk.
Primary data storage is on servers located in the United Kingdom (AWS eu-west-2, London).
Several of our sub-processors are based outside the UK. Where we transfer personal data outside the UK, we rely on one of the following safeguards:
You can request details of the specific safeguard used for any particular transfer by contacting privacy@attendiq.co.uk.
We retain personal data for as long as necessary for the purpose it was collected, and no longer. Our standard retention periods are:
| Data type | Retention period | Reason |
|---|---|---|
| Admin user account data | Subscription duration plus 6 years after termination | Limitation Act 1980 |
| Worker identity and employment records | Duration of employment or engagement plus 6 years | Limitation Act 1980 |
| Right to work documents | Duration of employment plus 2 years | Immigration, Asylum and Nationality Act 2006 |
| Attendance records | Duration of engagement plus 6 years (location data anonymised at that point) | RIDDOR and payroll/HMRC dispute evidence; Working Time Regulations 1998 sets a 2-year minimum, we retain longer for payroll dispute purposes |
| Biometric data (face verification / liveness) | 12 months after a worker becomes inactive on the platform | Data minimisation - biometric data has no ongoing purpose once a worker is no longer active, so it is removed on a shorter cycle than our other retention periods regardless of employment-record retention above |
| Competency and induction records | 6 years after worker's last activity | CDM 2015 and H&S litigation limitation period |
| Site inspection and permit records | 6 years after site closure or project end | CDM 2015 |
| Medical and D&A records | 6 years after last entry (40 years if COSHH hazardous substance exposure is involved) | Limitation Act 1980; COSHH Regulations 2002 |
| Website enquiry submissions | 12 months from submission | Purpose limitation |
| Security and audit logs | 90 days (active logs); 6 years (audit trail) | Security and legal compliance |
Where a customer deletes a worker record, we delete it from active systems within 30 days. Where a customer's subscription ends, their account is deactivated straight away: the customer can ask us for a copy of their data within 30 days, and we hold the account for 12 months so that it can be reactivated, then delete personal data from active systems. We delete it sooner if the customer asks us to. Audit log data is retained for the applicable limitation period before deletion.
Under the UK GDPR, you have the following rights in relation to personal data we hold about you as data controller:
When an erasure request is processed:
Where legal retention obligations apply (for example, HMRC requires employer records for 6 years, and COSHH Regulations require health surveillance records for 40 years), we anonymise your identity while retaining the de-identified operational record for the legally required period. Once the retention period expires, the remaining data is permanently deleted.
If you are employed by multiple organisations through AttendIQ, an erasure request from one employer affects only the data held by that employer. Your worker record and data held by other employers are not affected.
To exercise any of these rights, contact us at privacy@attendiq.co.uk. We will respond within one month. We may need to verify your identity before processing a request.
The AttendIQ platform includes an access rules engine that evaluates whether a worker meets the criteria to access a particular site, based on induction completion, competency validity, right to work status, and any active site bans. This evaluation is carried out automatically.
The access rules themselves are configured by the principal contractor, who is the data controller for that processing. Workers have the right to request human review of any access decision that affects them; this should be directed to the principal contractor.
AttendIQ does not make any purely automated decisions that have legal or significant effects on individuals independently of customer configuration.
We use cookies and similar technologies on attendiq.co.uk. For full details of the cookies we use, how we use them, and how to manage your preferences, please see our Cookie Policy.
If you are unhappy with how we handle your personal data, please contact us at privacy@attendiq.co.uk in the first instance. We aim to resolve all concerns promptly.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office:
We may update this privacy notice from time to time. We will notify admin users of material changes by email or in-platform notification. The "last updated" date at the top of this page will always show the most recent version.
For any questions about this privacy notice or how we handle personal data:
Email: privacy@attendiq.co.uk
Post: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF