Legal / Privacy Policy | Operate360 Core

Operate360 ("we", "us", "our") operates the Operate360 Core platform and its industry applications (TM360, CE360, CO360, UT360, WO360, AT360). This Privacy Policy explains how we collect, use, and protect your personal data when you use our platform.

1. Data We Collect

Account data: name, email address, role, and tenant association.
Workforce data: shift records, timesheets, clock-in/out locations, fatigue assessments, and certifications.
Operational data: site records, audits, incidents, permits, and commercial documents you create.
Device data: approximate location (for geofenced clock-in), device type, and usage logs.

2. How We Use Your Data

To provide and operate the platform features you request.
To schedule work, validate attendance, and manage fatigue risk.
To produce compliance, commercial, and management reports for your organisation.
To send service, safety, and billing communications.

3. Lawful Basis (UK GDPR)

We process personal data under the lawful bases of contract performance, legal obligation (e.g. health & safety, working time regulations), legitimate interests, and consent where applicable.

4. Data Sharing

Data is shared only within your tenant organisation and with subprocessors that support the platform (e.g. hosting, payments, push notifications). Subprocessors are bound by written agreements meeting UK GDPR requirements.

5. Data Retention

We retain records for the duration of your subscription and thereafter as required by law (e.g. health & safety records, financial records). You may request deletion of your personal data subject to legal retention obligations.

6. Your Rights

You have rights to access, rectify, erase, restrict, port, and object to processing, and to withdraw consent. To exercise these rights, contact your tenant administrator or our data protection contact at privacy@operate360.com.

7. International Transfers

Where data is transferred outside the UK, we rely on appropriate safeguards such as UK International Data Transfer Agreements or recognised adequacy decisions.

8. Security

We apply encryption in transit and at rest, role-based access control, and audit logging. No method of transmission is fully secure, but we take reasonable steps to protect your data.

9. Changes

We may update this policy. Material changes will be notified through the platform or by email. Continued use after changes constitutes acceptance.