Privacy NoticeHow your personal data is handled in the Melita Engineer mobile app

1Who is responsible for your data

Melita POS Ltd, Company Number 05581715 ("Melita", "we", "us") is the data controller for the personal data processed in the Melita Engineer app. This means we decide why and how your data is used.

Engineer accounts are created and managed by Melita Head Office; the app does not offer public sign-up. Some of your account and profile information — for example your name, contact details, coverage area or home postcode — may be entered by Head Office when your account is set up, rather than provided by you directly in the app. You can review and correct this information (see Section 7).

Tick9 Ltd provides and operates the app and its supporting systems on our behalf, as our data processor. Tick9 acts only on Melita's documented instructions under a written data processing agreement, and does not use your data for its own purposes.

You exercise your data protection rights with Melita as the controller. For convenience you may also contact Tick9 (details in Section 8); Tick9 will pass any request it receives to Melita so that it is dealt with (see Section 7).

The app is intended for adult field engineers and subcontractors. It is not directed at children.

2What the app collects

If you do not provide certain information

Some information is necessary for the app to work. Without basic account and profile details — such as your name and contact details — we cannot create your account or assign jobs to you, and you will not be able to use the app. Other information is optional (for example, location and photo geotagging); if you choose not to provide it, some features such as check-in confirmation or photo evidence will be limited or unavailable.

3How we use your data

The table below sets out each purpose, the data involved, and the lawful basis we rely on.

Our legitimate interests

Where we rely on legitimate interests, those interests are: managing and allocating field work efficiently; maintaining the quality of the work carried out for our clients; keeping the app, and the data in it, secure; and providing support to engineers. We have weighed these interests against your rights and freedoms in a Legitimate Interests Assessment, which we can make available on request. You have the right to object to processing based on our legitimate interests — see Section 7.

How job matching works

We use your coverage area and home postcode to identify work near you and to estimate travel distance. This supports job-allocation decisions made by our team; it does not make automated decisions about you that produce legal or similarly significant effects, and a person is always involved in assigning work.

4Permissions and your choices

The app requests device permissions only when they are needed, and you can turn each one off at any time in your device settings. Each permission is used as follows:

The app continues to work if you decline a permission, although some features (for example photo capture or check-in location) will be limited or unavailable.

Location consent and withdrawal

Precise location and photo geotagging are optional and are used only with your consent. You can withdraw your consent at any time by turning off location access for the app in your device settings. Withdrawing consent does not affect the lawfulness of any processing that took place before you withdrew it.

5Who we share it with

We do not sell your data, and we do not use it to track you across other companies' apps or websites. We use the service providers below, acting on our instructions under written agreements that require them to keep your data secure and to protect it to the same standard we do:

• Tick9 Ltd — provides and operates the app and supporting systems, as our processor.
• Microsoft Azure — secure hosting and storage of app data and photos (UK / European data centres).
• Apple Push Notification service and Google Firebase Cloud Messaging — to deliver notifications to your device.
• postcodes.io — a UK postcode lookup service. Your postcode, including your home postcode, is sent to convert it into approximate coordinates for distance matching. No name, account identifier or other directly identifying account details are sent. A postcode can, in some circumstances, still be personal data.

We may also disclose data where required by law.

International transfers

Most of your data is held in the UK or European Economic Area (EEA). Some limited data is processed outside the UK or EEA — in particular, the device notification token sent to Apple and Google to deliver notifications. Where we transfer personal data internationally, we rely on an appropriate safeguard recognised under UK data protection law, which for these transfers is the UK's adequacy regulations where the destination is covered, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses where required. You can ask us for more information about the safeguards that apply, or for a copy of them, using the contact details in Section 8. We do not otherwise routinely transfer your personal data outside the UK or EEA.

6How long we keep it

We keep personal data only as long as necessary for the purposes described above. Our retention periods are set out below. When data is no longer needed, it is securely deleted.

7Your rights

You have the following rights over your personal data:

• Access — to the data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your data ("the right to be forgotten").
• Restriction — to limit how we use your data.
• Objection — to processing based on our legitimate interests (see below).
• Data portability — to receive certain data in a portable format.
• Withdraw consent — at any time where we rely on it (for example, for location — see Section 4).

Your right to object

Where we use your data on the basis of our legitimate interests, you have the right to object to that use at any time. If you object, we will stop unless we have compelling legitimate grounds to continue, or we need to keep processing to establish, exercise or defend legal claims. To object, contact us using the details in Section 8.

Some rights are not absolute

Rights such as erasure and data portability do not apply in every situation and may depend on the circumstances and on the lawful basis for the processing. If we cannot fully action a request — for example, because we must keep certain records to meet a legal or contractual obligation — we will explain why.

How to make a request

Data protection rights requests should be made to Melita as the data controller, using the contact details in Section 8. For convenience you may also contact Tick9; Tick9 will pass any request it receives to Melita so that it is actioned. Requests are handled by Melita, not by Tick9.

Deleting your account

To request deletion of your account and personal data, use Profile → Account Settings → Request Account Deletion in the app, or contact us at info@melitagroup.co.uk.

Complaints

You can raise a concern with the UK Information Commissioner's Office (ICO) at any time — see Section 8.

8Contact us

If you are unhappy with how your data has been handled, you can complain to the UK Information Commissioner's Office (ICO) at www.ico.org.uk.

9Changes to this notice

We may update this notice from time to time. The version and date below show when it was last changed. Where changes are significant, we will tell you in the app and/or via email before or when they take effect.