Teamwell Privacy Policy

1. Introduction

Welcome to Teamwell! This Privacy Policy is intended to inform you about how Teamwell SRL, a company established under Belgian law (« We », « Us », « Our »), collects, uses, and protects personal data in connection with the use of our mobile application, Teamwell (the « Application »).

In the context of the GDPR (General Data Protection Regulation), it is important to distinguish between two key roles:

• The Data Controller: This is your employer. They determine why and how your personal data is processed through the Application.
• The Data Processor: This is Teamwell SRL. We process your data on behalf of and according to the instructions of your employer.

For any questions about the management of your data, your first point of contact is your employer (usually the Human Resources department).

2. The Data We Collect

We collect different categories of data to provide and improve the services of the Application.

1. Data Provided by Your Employer or by You Your employer creates your account and enters basic information. You may be asked to complete or modify this information.

• Identification Information: First name, last name, professional email address, phone number.
• Professional Information: Job title, department, manager, hiring date, contract type.
• Profile Picture: If you or your employer decide to add one.
• Documents: Employment contracts, addendums, leave justifications (including medical certificates), and other documents related to your professional life that you or your employer upload.
• Vehicle Management: Information related to your company car.
• Feedback and Interactions: Your daily « mood » if you choose to share it, as well as « likes », comments, and responses to polls published on the company’s news feed.

1. Data We Collect Automatically When you use the Application, we collect technical information essential for its proper functioning and security:

• Device Information: Device model, operating system version (iOS/Android).
• Usage Data: Connection logs, crash reports, and information about the features you use to help us improve the application.
• IP Address: For security and diagnostic purposes.

1. Data Collected via Device Permissions The Application may request the following permissions, which you can manage in your phone’s settings:

• Camera & Photo Library: Solely to allow you to take or select a photo for your profile or to upload a document (e.g., a leave justification).
• Calendar: Solely to allow you to add company events (e.g., training sessions, social events) to your personal calendar. The Application does not access or read your existing calendar events.
• Notifications: To send you push notifications related to company activity (e.g., a new post, leave approval).

3. How We Use Your Data (Purposes of Processing)

We process your data on your employer’s instruction for the following purposes:

• To Provide the Application’s Core Features: Managing your profile, your documents, and information related to your vehicle.
• To Manage Time and Absences: Enabling the submission, approval, and tracking of leave requests and other absences.
• To Facilitate Internal Communication: Powering the company news feed, polls, events, and social interactions (likes, comments).
• To Gather Wellbeing Feedback: The « mood » feature allows your employer to track general team morale, based on your voluntary participation.
• To Ensure Maintenance and Security: Monitoring the Application’s performance, fixing bugs, and protecting our systems.

4. Data Sharing and Disclosure

1. Your Employer As the Data Controller, your employer has access to all professional data concerning you within the Application.
2. Our Sub-processors and Service Providers We use third-party providers to help us operate the Application. These partners are contractually obligated to protect your data and only use it for the services we request from them:

• Hosting and Database: Amazon Web Services (AWS) and Supabase, to host the application and store data.
• Email Delivery: SendGrid, for sending transactional emails (e.g., password resets).
• Push Notifications: Firebase Cloud Messaging (FCM) from Google, for sending notifications.
• Analytics: Google Analytics, to understand how the Application is used and improve it. Data is processed in an aggregated form.

1. Legal Obligations We may disclose your information if required by law or if we believe in good faith that such action is necessary to comply with a legal proceeding.

5. International Data Transfers

Our main servers (AWS, Supabase) are located in the European Union. However, some of our service providers (such as Google and SendGrid) are based in the United States. Any transfer of data outside the European Economic Area (EEA) is governed by protection mechanisms compliant with the GDPR, such as the European Commission’s Standard Contractual Clauses (SCCs), to ensure an adequate level of protection for your data equivalent to that in force in Europe.

6. Data Security

The security of your data is a priority. We implement technical and organizational security measures to protect it, including:

• Encryption: All communication between the Application and our servers is encrypted using the SSL/TLS protocol.
• Access Controls: Access to personal data is strictly limited to authorized personnel and systems that require it.

7. Data Retention

We retain your personal data as long as your account is active in the Application. When an employee leaves the company, it is the responsibility of the Data Controller (your employer) to instruct us to archive or delete the data. Data necessary to comply with their legal obligations (e.g., payslips, contracts for accounting purposes) will be archived for the minimum legal retention period in force in Belgium before being permanently deleted.

8. Your Rights as a User

In accordance with the GDPR, you have the following rights over your data:

• Right of Access: The right to know what data is held about you.
• Right to Rectification: The right to correct inaccurate data.
• Right to Erasure (Right to be Forgotten): The right to request the deletion of your data.
• Right to Restrict Processing: The right to « freeze » the use of your data.
• Right to Data Portability: The right to receive your data in a structured format.

How to exercise your rights? To exercise these rights, please contact your employer (the HR department) directly. As a data processor, we will assist your employer in responding to your request as quickly as possible.

9. Children’s Policy

The Teamwell Application is intended for professional use and is not directed at individuals under the age of 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy. We will notify you of any substantial changes by email or through a notification within the Application.

11. Contact Us

If you have specific questions about how Teamwell SRL processes data as a data processor, you can contact us at: info@teamwell.co.

For all other questions regarding your data, please contact your employer.