Privacy Policy

1. Introduction

OLC Check-In ("the App") is an internal mobile application available on iOS and Android, provided by Our Learning Cloud ("OLC", "we", "us", or "our") exclusively for use by OLC employees in the United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the App.

2. Information We Collect

We collect the following types of information when you use the App:

2.1 Account Information

• Name and email address (via Microsoft Azure AD authentication)
• Job title and region
• Manager assignment
• Profile photo (optional, if you choose to upload one using the camera)

2.2 Location Data

• Your device location when you check in at academy locations
• Location data attached to emergency safety alerts (flares) that you manually send

Location data is used solely to identify the nearest academy for check-ins and to provide location context for emergency alerts. We do not track your location continuously.

2.3 Check-In and Activity Data

• Academy check-in and check-out times
• Travel status updates
• Team activity (visible to colleagues and managers)
• Sickness and absence reports

2.4 Communications

• In-app notifications
• Emergency alerts (flares)
• Broadcast messages from administrators

2.5 Staff Leave Data

We access your staff leave information from an external Staff Leave Calendar API to display accurate absence data and calculate return dates.

3. Permissions We Request

The App requests the following device permissions:

3.1 Camera

We request camera access to allow you to take a profile photo for your account avatar. Use of the camera is entirely optional and only occurs when you actively choose to update your profile picture. Photos are stored securely on our server. You can grant or revoke camera access at any time through your device settings.

3.2 Location

We request location access to:

• Automatically suggest the nearest academy when you check in
• Attach location data to emergency safety alerts (flares) that you manually send

Location is only accessed when you actively use these features. You can grant or revoke location access at any time through your device settings.

3.3 Notifications

We may request permission to send you push notifications for check-in reminders, emergency alerts, broadcast messages, and sickness report updates. You can manage notification preferences through your device settings at any time.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and operate the check-in service
• To display team activity and facilitate collaboration
• To manage sickness, absence, and leave reporting
• To send emergency alerts and notifications
• To generate attendance reports for management
• To provide manager daily team summaries
• To maintain and improve the App's functionality

5. How We Store and Protect Your Information

5.1 Data Storage

Your data is stored in a PostgreSQL database hosted on secure, third-party cloud infrastructure located in the United States, operated by providers that maintain industry-standard security certifications including SOC 2 Type 2 and ISO 27001. Data is retained for the duration of your employment with OLC and for a reasonable period thereafter to comply with legal and business requirements.

5.2 Security Measures

We implement appropriate technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. This includes:

• Secure authentication via Microsoft Azure AD
• Encrypted data transmission (HTTPS/TLS)
• Access controls and authentication tokens
• Regular security reviews and updates

6. Third-Party Services

We share your information with the following third-party service providers to operate the App:

6.1 Microsoft Azure AD

We use Microsoft Azure Active Directory for authentication and to retrieve your name, email, and profile photo from your Microsoft account.

6.2 Twilio

We use Twilio to send SMS messages for critical notifications, including emergency alerts (flares), sickness reports to managers, and broadcast messages. Your mobile phone number is used solely for this purpose.

6.3 Staff Leave Calendar API

We access an external Staff Leave Calendar API to retrieve your scheduled leave and return dates for accurate absence tracking.

6.4 Replit

The App's backend and database are hosted on Replit's infrastructure in the United States.

7. Data Sharing Within OLC

Your check-in activity, team status, and profile information are visible to:

• Your assigned manager
• Other OLC employees within the App (team activity feed)
• OLC administrators (for attendance reporting and system management)

Emergency alerts (flares) are broadcast to all users. Sickness and absence reports are sent to your assigned manager and relevant administrators.

8. Your Data Protection Rights

Under UK data protection law (UK GDPR), you have the following rights:

• Right of access: You can request a copy of the personal information we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete information.
• Right to erasure: You can request deletion of your personal data in certain circumstances.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a portable format.
• Right to object: You can object to certain types of processing.

To exercise any of these rights, please contact us using the details below.

9. Data Retention

We retain your personal information for as long as you are an employee of OLC and for a reasonable period afterwards to meet legal, accounting, or reporting requirements. Check-in history and activity data are retained to maintain accurate attendance records.

10. Children's Privacy

The App is intended for use by OLC employees aged 18 and over. We do not knowingly collect information from children under 18.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by updating the "Effective Date" at the top of this policy and, where appropriate, by sending an in-app notification.

12. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Legitimate interests: To operate the check-in system, manage attendance, and facilitate team collaboration.
• Employment contract: To fulfil our obligations as your employer, including managing sickness, absence, and emergency situations.
• Legal obligation: To comply with employment law and health and safety requirements.
• Consent: For optional features such as uploading a profile photo using the camera.