Privacy Policy for NightWarden

1. Who We Are

NightWarden is operated from the United Kingdom.

We act as a data controller for information we collect for our own business purposes, such as enquiries, accounts, billing, support, security, analytics and administration.

Where a partner organisation uses NightWarden to manage its own clients, sites, staff, shifts, reports or operational records, NightWarden will usually act as a data processor on behalf of that partner organisation. The partner organisation remains responsible for the data it enters into the platform and for telling its own clients, staff and contractors how their data is used.

2. Data We Collect

Depending on how NightWarden is used, we may process:

• Names and contact details
• Business and account details
• Staff and contractor details
• Client and site information
• Shift, patrol, inspection and report records
• Training and toolbox talk records
• Lone worker and safety check-in records
• GPS location data where required for patrols, safety checks or service verification
• Uploaded photos, documents or report evidence
• Login, device, technical and security information
• Website enquiry and analytics data
• Cookies and similar technologies: See our Cookie Policy.

2a. Mobile Application Data

When you use the NightWarden mobile application (available on Android and iOS), we collect additional information to provide our field staff management and lone worker safety services:

Location Data

• GPS coordinates: Collected during shift check-ins, lone worker monitoring, LoneProtect monitoring, and checkpoint verification to ensure staff safety and service delivery compliance.
• Location accuracy: We record location precision to validate checkpoint scans and patrol verification.
• Location data is primarily collected when you actively use these features. Background location is used only briefly if a lone worker check-in is missed — see section 2b for full details.

Push Notifications

• We use push notifications to alert field staff about shift reminders, safety check-ins, overdue tasks, and weather warnings.
• You can disable push notifications in your device settings at any time.

Biometric Data

• If you choose to enable biometric login (fingerprint, Touch ID, or Face ID), authentication is handled entirely on your device by the operating system.
• We do not store or transmit your biometric data — only a confirmation that authentication was successful is sent to our servers.
• On iOS, Face ID usage is governed by Apple's on-device biometrics framework. No facial data leaves your device.

Photos and Camera

• Photos taken during form submissions, risk assessments, and site inspections are uploaded to our secure servers.
• Photos may include metadata such as timestamp and location for audit purposes.

Offline Data Storage

• The app stores form data locally on your device when offline, which syncs automatically when connectivity is restored.
• This data is encrypted and deleted from your device after successful synchronisation.

NFC Data

• If using NFC checkpoint verification, we record the tag ID and timestamp to confirm patrol completion.
• No personal data is read from or written to NFC tags.

2b. Location Data (Mobile App)

The NightWarden Field mobile app collects precise GPS location data from your device. This section explains exactly what we collect, why, and how it is used.

What location data we collect

• Precise GPS coordinates (latitude and longitude) — not approximate location.
• Location accuracy reading (in metres) to validate checkpoint scans.
• Timestamp of each location capture.

When location is collected

• Shift check-in: GPS is captured when a field staff member starts a shift.
• Shift check-out: GPS is captured when a field staff member ends a shift.
• Lone worker monitoring: Location is captured at each safety check-in during a monitored lone worker shift.
• LoneProtect (ad-hoc safety checks): Location is captured at the start and end of short-duration dangerous tasks.
• Checkpoint and patrol verification: GPS is used to confirm the staff member is physically present at a designated checkpoint location.
• On-demand employer ping: Your employer (the security company managing your account) may request your current location via the platform dashboard.
• Background safety ping: If a lone worker check-in is missed while the app is in the background, the app briefly captures your GPS to provide emergency responders with your last known location.

Background location use

The app holds background location permission (ACCESS_BACKGROUND_LOCATION on Android; Always Allow on iOS) for one specific safety-critical purpose: if a lone worker check-in becomes overdue while the app is in the background, the app briefly captures the staff member's last known GPS position. This location is used solely to assist emergency response.

Background location is not used for continuous tracking. It is only triggered by a missed safety check-in. At all other times, location is collected only while the app is actively in use (foreground).

Purpose and legal basis

• Staff safety: Lone worker and LoneProtect location data is essential for emergency response if a staff member fails to check in.
• Operational compliance: Shift and checkpoint location data provides an audit trail for service delivery verification.
• Legal basis: Contract performance (your employment or contractor agreement) and legitimate interests (safety monitoring).

Who location data is shared with

• Your employer or the security company that manages your NightWarden account (the "partner organisation").
• Emergency services, only in the event of a lone worker safety incident.
• Location data is never sold or shared with advertisers or unrelated third parties.

Retention

Location records are retained for the duration of the partner organisation's contract with NightWarden and deleted within 30 days of account closure, unless retention is required by law.

Your choices

You may deny location permissions via your device settings. However, safety-critical features (lone worker monitoring, LoneProtect) require location to function and will be unavailable if permission is denied. Non-safety features such as checkpoint GPS verification may be disabled independently in the app.

3. How We Use Data

We use personal data to:

• Provide and operate the NightWarden platform
• Manage user accounts and permissions
• Support partner organisations
• Record patrols, inspections, shifts, reports and operational activity
• Support lone worker safety and emergency response
• Provide customer support and fix technical issues
• Protect the security of the platform
• Send service messages and important updates
• Manage billing, administration and legal obligations
• Improve the platform and user experience

We do not sell personal data.

4. Partner, Client and Staff Data

Partner organisations may enter client, site, staff and contractor data into NightWarden.

NightWarden does not use partner client, site or staff data for its own marketing or unrelated purposes.

Access to partner data by NightWarden personnel is limited to what is necessary to provide the service, maintain the platform, investigate technical issues, support users, ensure security, comply with legal obligations, or act on the partner organisation's instructions.

5. Lawful Basis

Where NightWarden acts as a data controller, we rely on one or more lawful bases under UK data protection law, including:

• Contract, where processing is needed to provide the service
• Legitimate interests, such as security, support, service improvement and business administration
• Legal obligation, where we must keep or provide records
• Consent, where required
• Vital interests, where data is needed in an emergency or safety incident

Where a partner organisation controls the data entered into NightWarden, that partner organisation is responsible for its own lawful basis.

6. Sharing Data

We may share personal data with:

• The relevant partner organisation
• Authorised users within that organisation
• Hosting and cloud service providers
• Email, notification and communication providers
• Payment and billing providers
• IT, security and support providers
• Professional advisers
• Regulators, law enforcement or emergency services where required

We only share data where necessary for providing the service, complying with the law, protecting security, supporting users, or acting on the instructions of a partner organisation.

We do not sell personal data.

7. Hosting and International Transfers

NightWarden is operated from the UK, but some systems used to host, secure, support and maintain the platform may process data outside the UK or European Economic Area, including in the United States.

We process personal data in accordance with applicable UK data protection law, including the UK GDPR and Data Protection Act 2018.

Where personal data is transferred or processed outside the UK or EEA, we take steps designed to ensure that appropriate safeguards are in place. These may include data processing agreements, contractual safeguards, access controls, security measures and approved transfer mechanisms where required.

8. Security

We use reasonable technical and organisational measures to protect personal data, including access controls, authentication, encryption in transit, audit logs, role-based permissions, secure hosting and monitoring.

No online system can be guaranteed to be completely secure. Users and partner organisations are responsible for keeping login details safe and ensuring that only authorised users are given access.

9. Retention

We keep personal data only for as long as needed for the purpose it was collected, including service delivery, account management, legal, tax, accounting, audit, security and dispute purposes.

Where NightWarden acts as a processor, partner-entered data is retained, deleted or returned in accordance with the partner organisation's instructions, the service agreement and any legal requirements.

10. Cookies and Analytics

Our website and platform may use cookies or similar technologies to operate the service, understand usage, improve performance and support security.

Optional cookies or marketing analytics will be used only where permitted by law. See our Cookie Policy for details.

11. Your Rights under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you may have rights to:

• Right of access: You can request a copy of the personal data we hold about you (a "Subject Access Request"). We will respond within one calendar month.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You can ask us to delete your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent. Field staff can request account deletion directly in the app (Settings → Delete My Account) or by emailing info@nightwarden.co.uk. Note: some data (such as anonymised shift records) may be retained for our partners' legal audit obligations.
• Right to restriction of processing: You can ask us to restrict processing of your data in certain circumstances (for example, while a dispute is being resolved).
• Right to data portability: Where processing is based on consent or a contract and carried out by automated means, you can ask for your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where we rely on your consent to process data, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO).

To make a request, contact us at info@nightwarden.co.uk. We will respond within one month.

Where your data is controlled by a partner organisation, we may need to refer your request to that organisation.

12. Children's Privacy

Our platform is not intended for use by children under 16. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will be published on our website with an updated effective date.

14. Contact

For questions about this Privacy Policy, contact:

NightWarden
Email: info@nightwarden.co.uk
Website: nightwarden.co.uk

You can also contact us via our website.