Skip to main content

Privacy Policy

Version 1.0 · Effective 15 June 2026

This Privacy Policy explains how TeamZap collects, uses and protects personal data when you use the TeamZap workforce-management service and this website.

1. Data controller and contact

TeamZap is the data controller for personal data we collect directly from end users (for example when you register an account). For employee data your organisation uploads while using the service, your organisation is the controller and we act as the data processor — see our Data Processing Agreement.

Privacy queries: [email protected]

2. What we collect

  • Account data: name, email, phone, password hash, authentication tokens, role within your organisation.
  • Employee data (as processor): names, contact details, schedules, leave, time entries and payroll-relevant attributes — strictly as your organisation configures.
  • Usage data: page views, clicks, device information, crash reports and performance metrics. On this marketing website, analytics run in a cookieless mode — see the Cookie Policy.
  • Communications: messages you send via our support channels and in-app messaging.

3. Why we process personal data (legal basis)

  • Performance of a contract — to deliver the service you signed up for.
  • Legitimate interests — security, fraud prevention, product improvement.
  • Consent — for non-essential cookies and marketing emails.
  • Legal obligation — to comply with tax, employment or court requirements.

4. Sharing with third parties

We share data only with sub-processors necessary to provide the service. The current list is at app.teamzap.ai/legal/sub-processors. We do not sell personal data.

5. International transfers

Our primary data residency is the European Economic Area. Where sub-processors are outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.

6. Retention

Account data is retained while your account is active and for up to 90 days after deletion to allow recovery and to comply with audit obligations. Audit logs are retained for 2 years. Anonymised aggregate analytics may be retained indefinitely.

7. Your rights (UK / EU GDPR)

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure (“right to be forgotten”)
  • Restrict or object to processing
  • Receive your data in a portable format
  • Lodge a complaint with the UK Information Commissioner’s Office (ICO)

Exercise these rights via the in-app “Data & privacy” settings or by emailing [email protected].

8. Security

We use TLS in transit, encryption at rest for sensitive fields, role-based access controls, rate limiting and continuous monitoring. No service is 100% secure; we will notify you of any data breach affecting your personal data without undue delay. See our Security & trust page.

9. Cookies

This website works without tracking cookies — see the Cookie Policy. The TeamZap application uses strictly necessary cookies for authentication and consented analytics.

10. Children

The service is not intended for users under 16. We do not knowingly collect data from minors.

11. Changes

We will notify you of material changes via email and in-app notice. Continued use after the effective date constitutes acceptance.