Privacy Policy

This policy explains how CheckMade Ltd processes personal data in the CheckMade mobile companion app and on this website. It is written to comply with the UK GDPR and the EU GDPR (relevant because the app is used in Germany and elsewhere in the EU).

1. Who is responsible for your data

The data controller is:

CheckMade Ltd
c/o TC Group, The Granary, Hones Yard
1 Waverley Lane, Farnham GU9 8BB, United Kingdom
Companies House registration: 16187605
Email for privacy enquiries: [email protected]

We have not appointed a Data Protection Officer. Under Article 37 UK/EU GDPR, the appointment is not mandatory at our current scale of processing. We have not yet appointed an EU Article 27 representative; we will do so before launching the app commercially in the EU. If you are an EU/EEA resident and need to exercise your rights in the meantime, please contact us at the address above and we will respond within statutory deadlines.

2. Scope of this policy

This policy covers:

• The CheckMade mobile companion app for iOS and Android, used by event staff during shifts at live events.
• This website, checkmade.co.uk.

The website itself is a static information site. It does not use cookies, analytics, advertising pixels or any other tracking technology. Server access logs are kept by our hosting provider for a short period for security and abuse prevention only.

3. Roles: who controls what

The CheckMade app is provided to event organisers and contractors (the customer-employer) who deploy it to their staff. In most deployments:

• The customer-employer is the controller for personnel and roster data they upload (who works which shift, in which role, for which event).
• CheckMade Ltd is the controller for platform-side data we generate to operate the service (audit logs, security telemetry, the technical handling of submissions).

Where we act as a processor on behalf of the customer-employer, we do so under a written Data Processing Agreement (DPA). Ask your employer for a copy of their CheckMade DPA.

4. What data the app processes, and why

Account & role data

Your name, work email address, and the role and shift assignments your employer has given you. Lawful basis: Article 6(1)(b) GDPR (performance of the contract between us and your employer; necessary for you to use the app) and Article 6(1)(f) (legitimate interest of your employer in coordinating its workforce).

Location data — foreground-only, shift-only

While you are on an active shift and the CheckMade app is open and in the foreground on your device, the app records your approximate position and sends it to the platform so colleagues and your dispatcher can find you on the live event map.

Location collection stops as soon as any of the following happens: your shift ends, you switch to another app or lock your screen (the app moves to the background), you close the CheckMade app, or you revoke the location permission in your operating-system settings.

The app uses iOS "While Using the App" location authorisation and the Android ACCESS_FINE_LOCATION foreground permission. We do not request "Always" / background location access.

We use the location data we collect for two purposes:

• (a) Live coordination — showing your position on the event map to colleagues and dispatchers in real time. Lawful basis: Article 6(1)(b) GDPR (necessary to perform the service) and Article 6(1)(f) (your employer's legitimate interest in coordinating staff during a live event).
• (b) Improving the CheckMade mobile and desktop apps — after an event we analyse location data to understand how the apps are used on real sites (where people gather, how routes are walked, where the map UX works or fails) so we can design the next version. For this purpose we strip direct identifiers (name, email) and work with the data in pseudonymised form — we do not need to know which specific individual moved where in order to learn how the apps are used. Lawful basis: Article 6(1)(f) GDPR (legitimate interest in improving a product that customers depend on); we have carried out a balancing test, taking into account that the data is pseudonymised before analysis and that you would reasonably expect the operator of an event-coordination app to learn from how it is used. You have the right to object to this specific purpose under Article 21 GDPR, by writing to [email protected].

We do not use location data for performance surveillance, productivity scoring or any HR purpose. We do not build long-term movement profiles, and we do not share location data with anyone other than the sub-processor named in Section 6.

Submission and incident data, including photos

When you submit a task update, an issue report or an incident, the content you enter (text, status, structured fields) and any photos you attach are stored in our database and (for photos) in Microsoft Azure Blob Storage. Photos are kept with the parent submission. We do not currently use any AI or LLM service to transcribe, classify or analyse your photos. If we add such a feature in the future, we will update this policy and notify users in advance. Lawful basis: Article 6(1)(b)/(f).

Push notification tokens

If you allow push notifications, your device's APNs (Apple) or FCM (Google) push token is stored so we can send you operational notifications about your shift, tasks and messages. You can revoke notifications at any time in your operating-system settings. Lawful basis: Article 6(1)(b)/(f).

Device and diagnostic data

To operate and debug the app we collect minimal technical data: app version, operating-system version, device model, and crash logs. We do not use advertising identifiers, no third-party analytics SDK is embedded, and we do not fingerprint your device. Lawful basis: Article 6(1)(f) (legitimate interest in keeping the app working and secure).

Audit logs

For security, accountability and compliance, the platform writes append-only audit logs of significant actions (logins, role changes, submission edits). Lawful basis: Article 6(1)(c) (compliance with legal obligations) and 6(1)(f).

5. Permissions the app asks for on your device

Revoking a permission may stop a feature from working but will not delete data already collected.

6. Who we share data with

We do not sell your personal data, and we do not share it with third parties for their own purposes.

To run the service we use a single technical sub-processor:

• Microsoft Azure (Microsoft Ireland Operations Ltd; ultimate parent: Microsoft Corporation, USA) — hosts our application servers, our database, and the Azure Blob Storage account in which uploaded photos are kept. Region: UK South (London). Microsoft processes the data only on our written instructions, under the Microsoft Online Services Data Protection Addendum (DPA) and Standard Contractual Clauses.

Beyond Microsoft Azure, we may disclose personal data when the law requires us to (for example, in response to a valid order from a court or supervisory authority). We will resist over-broad requests and notify affected users where lawful.

7. International transfers

Your data is stored and processed by Microsoft Azure in the UK South (London) region. CheckMade Ltd is established in the United Kingdom. The UK is recognised by the European Commission as providing an adequate level of protection (UK adequacy decision), and the UK ICO recognises the EEA equivalently — so transfers of your data between the EU/EEA and the UK do not require additional safeguards.

Microsoft is a US-headquartered company. In limited support scenarios — for example, when a Microsoft engineer responds to a critical platform incident — data may be accessed by Microsoft personnel outside the UK or EEA. Such transfers are protected by the EU–US Data Privacy Framework (to which Microsoft is certified), the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, as appropriate.

8. How long we keep your data

• Account & role data: for the duration of your assignment to the customer-employer using CheckMade, then deleted or anonymised after 6 months.
• Location data: retained for 6 months to support operational review and the product-improvement purpose described in Section 4; thereafter deleted or aggregated into non-identifying analytics.
• Submission and photo data: retained alongside the parent event record for 12 months after event end, or as required by the customer-employer's retention policy.
• Audit logs: retained for 6 years to meet accountability and legal-defence requirements.

9. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased in the cases set out in Article 17;
• restrict our processing (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on legitimate interests (Article 21); and
• withdraw any consent you have given, with effect for the future.

To exercise any of these rights, email [email protected]. We will respond within one month.

If you believe we have mishandled your data, you may complain to a supervisory authority. The competent authorities include:

• The UK Information Commissioner's Office (ICO) — ico.org.uk.
• In Germany, the supervisory authority of the Land in which you reside or work, or the federal commissioner (BfDI) — bfdi.bund.de. A list of Land authorities is published by the Datenschutzkonferenz.

10. How we keep your data secure

We protect your data using TLS encryption in transit, Azure-managed encryption at rest, role-based access control, network isolation and an append-only audit log of administrative actions. Access to production data is limited to engineers who need it for operating the service and is logged. We test our application against common security risks and patch our infrastructure on a regular schedule.

11. Children

CheckMade is a workplace app used by adult event staff. It is not directed at children under 16 and we do not knowingly collect data from them.

12. Changes to this policy

We will update this policy when our processing changes (for example, if we add a new sub-processor or a new feature). We publish the latest version at www.checkmade.co.uk/homepage/legal/privacy-policy.html with an updated effective date. For material changes we will also notify users in the app and by email.

Note. This policy is provided for transparency and legal compliance, but it is not legal advice. Before commercial launch in Germany or elsewhere in the EU, this text should be reviewed by a data-protection lawyer qualified in the relevant jurisdiction, and an Article 27 EU representative should be appointed.