Data processing

Who decides

The company is responsible for the personal information it puts into SAF Group, including having a reason to hold a guard’s licence or contact details. We process it on the company’s instructions, which are these terms, the product the company switches on, and a written request from an admin.

What we process

Account details, team roles, guard profiles and documents, shifts, hours, sites, patrols, incidents, and files the company or a guard uploads. A location reading is stored only when a guard chooses to check in or out. We do not use a company’s information to advertise to its guards.

Providers

The same providers are listed in the privacy policy: Amazon Web Services in Sydney, Vercel, Expo for push, and Sentry for crash reports. Calendly and OpenSign are used only when the company turns those features on. We do not add a provider that can read customer records without updating this note.

How it is protected

• Customer data is stored in Sydney.
• Each company only sees its own rows. A guard only sees their own shifts, hours and documents.
• Sign-in is through a hosted identity service. Staff access to production data is exceptional and is logged.
• Files are stored in a private bucket. A link to a file expires.

If there is a breach

If we become aware of a breach of a company’s personal information that is likely to result in serious harm, we will tell the company’s admin without undue delay, and we will handle notice to people and to the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

When a company leaves

An admin can ask for an export before the organisation is closed. Thirty days after the close is confirmed, we delete the organisation’s records and files, apart from anything we must keep to meet a legal duty. The periods are the ones in the privacy policy.