Privacy Policy

DutyStack is a product and trading name of Digital Solutions Hub Limited. The verified company and contact details available for publication are shown on this website.

A customer organisation is generally the data controller for workforce, safety, asset and compliance records that it or its users enter into DutyStack. Digital Solutions Hub Limited generally acts as that customer's data processor and handles the information on the customer's documented instructions.

Digital Solutions Hub Limited may act as data controller for website visitors, account administration, billing, security, support requests and its direct customer relationships.

• Names, email addresses, telephone numbers, account identifiers, organisation memberships, roles and optional contact preferences.
• Worker and operative records, clock-in and clock-out records, location or geofence evidence, and project assignments.
• Photos, uploaded files, signatures, inspections, compliance records, asset records, training and competence evidence.
• Support messages, subscription and billing information, and technical, diagnostic, security and audit information.

Information may be provided by the individual, an organisation owner or administrator, an invited user, a connected service, the mobile or web application, or automatically through necessary security and diagnostic events.

Where Digital Solutions Hub Limited is controller, information may be used to provide and administer the service, perform a contract, respond before entering a contract, meet legal obligations, protect the service and users, prevent misuse, improve reliability and answer support requests.

The lawful basis will depend on the activity. It may be contractual necessity, legal obligation, legitimate interests, or consent where consent is appropriate and can be withdrawn. We do not rely on consent where another lawful basis is more suitable.

Where Digital Solutions Hub Limited acts as processor, it processes customer data to deliver DutyStack and related support in accordance with the customer agreement, the customer's configured use of the service and lawful documented instructions.

DutyStack can record location or geofence evidence when enabled. The mobile timekeeping flow requests foreground location when a worker deliberately clocks in or out; it is not designed to create continuous route history.

Photos, signatures and uploaded evidence can contain personal or sensitive operational information. Customer organisations decide what should be collected and are responsible for giving appropriate notices and having a lawful basis.

Customers may use DutyStack to maintain worker profiles, qualifications, certificates, expiry information, role requirements and competence evidence. Customers control why those records are created, who may access them and how long they are required.

We use account and organisation details to authenticate users, manage access and communicate service information. An organisation owner may separately choose whether DutyStack may use their telephone number for optional onboarding, account-help or product-feedback contact, and can change that preference in their profile. Payment and billing providers may process customer contact, payment and transaction details. Support information is used to investigate and respond to requests.

A payment provider may act as our processor for some services and as an independent controller for activities such as its own legal compliance, fraud prevention and payment-network obligations. Its own privacy information explains those activities.

DutyStack records technical and audit information to operate the service, investigate errors, enforce permissions, maintain evidence of important actions and protect customer data. Audit records are not silently rewritten merely because a user's access ends.

The public marketing application currently contains no non-essential analytics, advertising or tracking scripts. Essential platform cookies or local storage may be used by authenticated DutyStack services for sign-in, security and requested functionality. See the Cookie Policy for current details.

Information may be available to authorised customer users and to suppliers that provide cloud hosting, secure storage, database infrastructure, mobile synchronisation, transactional communications, payment and billing, application delivery, support, monitoring or diagnostic services. We limit disclosures to what is reasonably required for the service.

Where a supplier processes personal data on our behalf, the public Subprocessors register identifies the relevant provider and its general service purpose. Further contractual information is available on request.

Some providers may process information outside the United Kingdom. Transfer locations and contractual mechanisms depend on the provider and service configuration. Where UK data-protection law requires a safeguard, the relevant contractual and transfer arrangements must be assessed and put in place. Customers may request current subprocessor information before contracting.

We retain information only for as long as necessary for the purposes described, to provide the service, to meet contractual requirements, and to comply with legal obligations. Different records may need different periods because of customer instructions, audit integrity, billing, disputes, fraud prevention, legal holds or statutory requirements.

An organisation owner can request a complete organisation data export in the web application. DutyStack prepares an export pack for download and review. The owner can then schedule organisation deletion.

Scheduling deletion locks normal organisation access and places the organisation in a 30-day pending-deletion period. The owner can cancel during that period. Permanent purge is scheduled after the period, subject to legal holds and limited records that must be retained for billing, fraud prevention, disputes or legal obligations.

Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, objection and data portability, and rights relating to consent or automated decisions. For customer-controlled workforce records, requests should normally be made to the relevant customer organisation first. We assist customers where required by our processor obligations.

Please contact us first so we can investigate. Individuals may also complain to the UK Information Commissioner's Office at ico.org.uk.

DutyStack is a business service and is not directed to children. Customers must not create accounts for children or enter children's information unless they have a lawful, necessary and appropriately safeguarded reason.

We may update this policy when the service, suppliers or legal requirements change. The maintained date at the top identifies the current version. Material changes will be communicated where appropriate.