This Privacy Policy explains how ZentryxGT ("we", "our", or "us") collects, uses, shares, and protects personal data when you visit our website or use the Teamstack platform ("Platform"), including the web dashboard, optional installed (PWA) experience, mobile applications, and related sign-in, billing, and support flows.
Teamstack is a workforce operations product. Organisations use it to schedule sessions, record availability, track attendance (including GPS clock-in and clock-out where enabled), prepare payroll summaries, complete onboarding, and communicate within a division.
This policy should be read with our Terms of Use and Cookie Policy. It is written for UK GDPR and the Data Protection Act 2018. Where we process personal data of people in the EEA, we apply equivalent GDPR principles.
1. Who we are
For personal data that we decide how and why to process (for example website enquiries, account authentication, billing, product communications, and security logs), ZentryxGT is the data controller.
For operational data that an Organisation uploads or generates inside its Teamstack workspace (for example team member profiles, schedules, attendance, pay rates, onboarding answers, and division chat), the Organisation is the data controller and ZentryxGT acts as its data processor. We process that data only to provide the Platform and as instructed by the Organisation, as described in our Terms of Use.
Privacy requests: teamstack-support@zentryxgt.com
2. Who this policy covers
This policy covers personal data about:
- website visitors and people who submit a contact or demo enquiry
- people who create a Teamstack account (including Organisation administrators)
- people invited to join an Organisation as administrators or members
- people whose details an Organisation enters, imports, or otherwise stores in the Platform
If your Organisation gave you a Teamstack account, that Organisation is primarily responsible for telling you how it uses your data at work. This policy explains what we do as the provider of the software.
3. The data we collect
We only collect data that is needed to operate Teamstack, support customers, bill for the service, and keep the Platform secure. The categories below reflect what the product actually stores or processes today.
Account and identity data
When an account is created, or a member is invited or imported, we may process:
- full name
- email address
- password (stored by our authentication provider in hashed form; we do not store readable passwords)
- role (for example master, admin, or member)
- organisation / division / workspace name
- profile photo, if one is uploaded
- listed home or work location (address and/or postcode), if provided
- whether the account is active and which profile is selected
Organisation and site data
- division, team, and site names
- site addresses, postcodes, contact emails, and site images
- scheduling, attendance, payroll, and notification settings chosen by the Organisation
Scheduling, availability, and attendance data
- session titles, descriptions, times, duration, sites, and assigned people
- assignment status (for example pending, accepted, declined, or cancelled)
- unavailability / availability windows submitted by members
- clock-in and clock-out times
- precise device location (latitude and longitude) when a user clocks in or out and has granted location permission
- emergency coverage / replacement activity related to cancelled or uncovered sessions
Location is collected only at the moment of clock-in or clock-out (or an equivalent attendance action), and only if the device permission is granted. We do not continuously track a user's location in the background for marketing.
Payroll and pay-rate data
Teamstack is not a payroll bureau or employer of record. Organisations may store pay-related settings so they can review and export operational totals. This may include:
- hourly and per-session pay rates
- session-level pay overrides and cancellation compensation settings
- payroll verification or dismissal flags
- currency and payroll mode chosen by the Organisation
- payroll summaries and CSV exports generated in the product
Onboarding, KPI, and review data
- onboarding groups, questions, guideline PDFs, assignments, and member responses
- KPI group membership and peer-review questions, scores, and completion status
- optional product reviews (name, role, organisation name, star rating, and review text), which we may publish if approved
Onboarding questions are configured by the Organisation. The content of answers therefore depends on what the Organisation asks. Organisations should not use onboarding forms to collect special category data (such as health, ethnicity, or trade-union membership) unless they have a lawful basis and have instructed us accordingly.
Communications data
- in-app notifications and related delivery logs
- division chat / direct messages, including message content, reactions, and referenced sessions
- emails we send (invites, password resets, session or cancellation notices, subscription confirmations, reminders, and support replies)
- contact and demo enquiries submitted on our website (name, work email, company, team size, enquiry type, and message)
Chat messages are visible to other participants in the relevant division conversation. Users should not put confidential or sensitive information in chat.
Billing and subscription data
- selected plan, billing period, trial flags, and subscription status
- Stripe customer and subscription identifiers stored against the account
- payment method and card details handled by Stripe (we do not store full card numbers)
- invoices, receipts, and related billing emails
Device, notification, and technical data
- IP address, browser type, device type, and approximate connection metadata
- authentication session data and security logs
- usage logs needed to operate, debug, and secure the Platform
- web push subscription endpoints and encryption keys, if browser notifications are enabled
- mobile push tokens (for example Expo / FCM / APNs tokens), if the mobile app is used and notifications are enabled
- imported spreadsheet files and the member, site, and session rows they contain, while an import is processed
- cookie and similar-technology data described in our Cookie Policy
Data we do not seek to collect
We do not sell personal data. We do not collect payment card numbers on our own servers. We do not knowingly collect personal data from children under 18. We do not use the Platform to make solely automated decisions that produce legal or similarly significant effects about an individual.
4. How we collect data
We collect personal data:
- directly from you (sign-up, profile settings, contact form, clock-in, chat, reviews, and similar actions)
- from the Organisation that invites you or enters your details (including spreadsheet imports)
- automatically from your browser, app, or device when you use the Platform
- from service providers who support authentication, hosting, payments, email, maps, and push notifications
5. How we use data
We use personal data to:
- create and authenticate accounts, and keep users signed in
- provide scheduling, availability, attendance, payroll views, onboarding, KPI reviews, and notifications
- record clock-in and clock-out, including location where captured, so Organisations can verify attendance
- suggest replacement candidates using listed addresses/postcodes and, where available, clock-in location
- display maps of recorded clock locations to authorised Organisation users
- send transactional email and push notifications that the Organisation or the user has enabled
- process subscriptions, trials, invoices, failed-payment follow-up, and plan changes through Stripe
- respond to enquiries, provide support, and communicate service updates
- maintain security, prevent abuse, diagnose faults, and improve reliability
- comply with law and enforce our Terms of Use
We do not use Organisation operational data to profile individuals for advertising. We do not sell personal data to third parties.
6. Legal bases
Where UK GDPR applies, we rely on the following bases:
- Contract — to provide the Platform, authenticate users, host Organisation data, send service messages, and process subscriptions.
- Legitimate interests— to keep the Platform secure, prevent fraud and misuse, understand reliability issues, improve features, and respond to business enquiries. We balance these interests against the individual's rights.
- Consent — for optional cookies or similar technologies that are not strictly necessary, for device location at clock-in/out (via the device permission), and for push notifications (via the browser or OS permission). Consent can be withdrawn in the cookie banner, browser/app settings, or device settings.
- Legal obligation — where we must keep records for tax, accounting, or to respond to a lawful request.
Where we act as processor, the Organisation is responsible for its own legal basis for asking staff or contractors to use Teamstack, including attendance location and pay-rate data.
7. Who we share data with
We share personal data only where needed to run the Platform, comply with law, or follow the Organisation's instructions. Recipients include:
Inside the Organisation
- masters, admins, and other authorised users in the same Organisation or division, according to role
- other division members who can see shared schedules, attendance status, or chat messages
Service providers (processors or independent controllers of their own systems)
- Supabase — authentication, database, file storage (including profile photos and onboarding PDFs), and related backend services
- Stripe — payment processing, checkout, customer billing portal, invoices, and subscription management
- Microsoft 365 / Exchange Online (smtp.office365.com) — sending transactional email from Teamstack addresses
- OpenStreetMap Nominatim — converting listed addresses or postcodes into map coordinates for proximity features
- OpenStreetMap — map tiles/embeds when an authorised user views a recorded clock location
- Expo, Google Firebase Cloud Messaging, and Apple Push Notification service — delivering mobile push notifications when enabled
- the user's browser push service — delivering web/PWA notifications when enabled
- cloud hosting and content-delivery providers used to serve the website and application
These providers are given only the data needed for their role. They are not permitted to use Teamstack customer data for their own marketing.
Other disclosures
- professional advisers (for example solicitors or accountants) under confidentiality duties
- a buyer or successor if we transfer or reorganise the business, subject to appropriate protections
- law enforcement, regulators, or courts where required by law or to protect rights, safety, or the Platform
We do not sell personal data and we do not share it with advertisers.
8. International transfers
Some providers may process data outside the United Kingdom. Where that happens, we take steps required by UK GDPR, which may include the UK International Data Transfer Agreement / Addendum, the European Commission's Standard Contractual Clauses where recognised, or another lawful transfer mechanism.
9. How long we keep data
We keep personal data only for as long as needed for the purposes above:
- Account and Organisation operational data — for the life of the workspace and a reasonable period after closure, so we can restore service, resolve disputes, or complete an export/deletion request
- Billing and transaction records — for as long as tax and accounting rules require (in the UK this is commonly up to six years)
- Support and enquiry records — for as long as needed to handle the request and keep a reasonable business record
- Security logs — for a limited period appropriate to investigating incidents
- Cookie preferences — until you change them or clear them from your browser
Organisations may request deletion of their workspace data when the account is closed, subject to backups, legal retention, and outstanding billing or dispute needs. Individual users whose data is held by an Organisation should usually contact that Organisation first.
10. Security
We use technical and organisational measures appropriate to the risk, including:
- encrypted connections (HTTPS)
- hashed credentials via our authentication provider
- role-based access inside each Organisation
- database and storage access controls
- monitoring and logging for security and reliability
No online service can guarantee absolute security. Users and Organisations must also keep login details confidential and grant access only to people who need it.
11. Your rights
Where UK GDPR applies, you may have the right to:
- access a copy of your personal data
- correct inaccurate data
- ask us to delete data
- restrict or object to certain processing
- receive data in a portable format
- withdraw consent where processing is based on consent
To exercise these rights, email teamstack-support@zentryxgt.comwith "Privacy request" in the subject line. We may need to verify your identity. If we hold the data only as processor for an Organisation, we will direct you to that Organisation or handle the request on its instructions.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
12. Cookies and similar technologies
We use cookies and similar technologies (including local storage) as described in our Cookie Policy. Essential cookies are required for sign-in and security. Non-essential analytics cookies are used only if you choose them in the cookie banner.
13. Children
The Platform is intended for Organisations and adult users. You must be at least 18 to create an account. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, contact us and we will delete it.
14. Changes
We may update this policy when the product, our providers, or the law changes. The updated version will be published on this page with a new effective date. If a change is material, we may also notify account holders by email or in-product notice.
15. Contact
ZentryxGT
Email: teamstack-support@zentryxgt.com
Related documents: Terms of Use · Cookie Policy