Privacy Policy

This policy applies to the TIRO360 website, Control workspace, Worker app, Client portal and related field-work support services.

When TIRO360 processes an organisation’s worker, customer and field-work information on the organisation’s instructions, the organisation is generally the responsible party and TIRO360 acts as its operator. The organisation remains responsible for its own privacy notices, lawful customer communications, and instructions to TIRO360. TIRO360 is the responsible party for account, website, billing, support, and security information that it determines how to process.

Depending on how you use TIRO360, we may process:

• Account and organisation information: name, email address, authentication details, organisation or workspace information, team invitations, roles, and organisation settings.
• Worker and client information: names, contact details, team roles, assigned sites, customer contacts and service addresses.
• Field-work records: jobs, shift rosters, clock-in and clock-out times, breaks, attendance reviews, incidents, messages, service requests and completion records.
• Location and work evidence: GPS coordinates and timestamps captured by enabled attendance or location features, site details, photos, uploaded files and notes submitted as work evidence.
• Technical and usage information: browser or device information, IP address, timestamps, service logs, diagnostic information, and security events.
• Support communications: information sent when you ask for help, report a problem, or make a privacy request.

Location, camera and photo access depend on the feature you use and your device permissions. Where enabled and permitted, work location features may collect location while the app is in the background. You can manage permissions in device settings; refusing access may limit the relevant feature. Offline reports may be stored on the device and sent when connectivity returns. Do not upload unnecessary sensitive information or unrelated personal photos.

We may receive personal information:

• directly from you when you create an account, complete a form, or send a message;
• from an organisation and its authorised team members;
• through the Worker app, Client portal and enabled field-work integrations; and
• from service providers or integrations that the organisation authorises.

We process information to:

• provide, operate, secure, and improve TIRO360;
• assign jobs, plan shifts and coordinate workers at service sites;
• record attendance, review work evidence and manage incidents;
• support service requests, client updates and approved completion records;
• send service notices, team invitations, and support responses;
• prevent misuse, investigate faults, and protect users and the platform;
• comply with legal obligations and enforce applicable terms; and
• create aggregated or de-identified insights that do not identify an individual.

Where AI-assisted tools are enabled, they may help authorised users summarise field-work information or draft responses. People remain responsible for reviewing the output and making employment, attendance, safety and other significant decisions. A GPS record or self-reported clock-in is not, by itself, verified attendance.

We process personal information only where a lawful justification applies. Depending on the situation, this may include consent; taking steps at your request before entering into a contract; performing a contract; complying with law; protecting a legitimate interest of you, TIRO360, an organisation, or another person; or acting on the lawful instructions of an organisation.

Where consent is the basis, you may withdraw it. Withdrawal does not affect processing that was lawful before the withdrawal or processing justified on another lawful ground.

We may share relevant information with:

• your organisation and its authorised team members, according to their access permissions;
• carefully selected service providers supporting cloud hosting, authentication, databases, artificial intelligence, email, messaging, security, and technical operations;
• authorised client contacts receiving permitted service records and, where the organisation enables sharing, site-level coverage summaries;
• professional advisers where reasonably necessary;
• authorities or other parties when required by law or needed to protect legal rights and safety; and
• a successor in a genuine merger, financing, sale, or restructuring, subject to appropriate safeguards.

TIRO360 does not sell personal information. Service providers may process information only for authorised purposes and subject to applicable contractual and confidentiality obligations.

Some technology and messaging providers may process or store information outside South Africa. Where personal information is transferred internationally, TIRO360 and participating organisations must use a lawful transfer basis and appropriate safeguards consistent with section 72 of the Protection of Personal Information Act 4 of 2013 (POPIA).

Information is retained only for as long as reasonably necessary for the purpose for which it was collected, while an account or organisation relationship is active, or as required for legal, security, dispute, and record-keeping purposes. Retention can vary by record type and organisation instruction.

When TIRO360 is no longer authorised to retain personal information, it will be deleted, destroyed, or de-identified as soon as reasonably practicable. Limited copies may remain temporarily in protected backups or where retention is required by law.

TIRO360 uses reasonable technical and organisational safeguards designed to protect personal information. These include access controls, authentication, restricted operational access, service monitoring, and security features supplied by reputable technology providers. No internet service is completely secure, and users must protect their sign-in details and devices.

Electronic direct marketing must be sent only where permitted by POPIA and other applicable law. You may opt out using the unsubscribe method in a message, by telling the organisation that contacted you, or by emailing TIRO360. Service messages that are necessary to operate an account may still be sent.

Subject to applicable law and appropriate identity verification, you may ask to:

• confirm whether personal information about you is held and request access to it;
• correct information that is inaccurate, incomplete, misleading, or out of date;
• delete or destroy information that is no longer authorised to be retained;
• object to certain processing, including direct marketing;
• withdraw consent where processing relies on consent; or
• request restriction of processing in circumstances recognised by law.

Send requests to fanqazee@gmail.com. If your information belongs to an organisation workspace, we may refer the request to that organisation or assist it with the response. See the Data Deletion Instructions for the deletion process.

TIRO360 is intended for adult users managing or carrying out field work and accessing related client services. The service is not directed to children under 18, and we do not knowingly collect a child’s personal information without the authorisation required by law.

Connected services and device platform providers have their own privacy terms. Their independent processing is governed by those terms.

We may update this policy when the service, law, or our processing practices change. The revised version will be posted here with a new “Last updated” date. Material changes may also be communicated through the service where reasonably practicable.

Please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Information Regulator (South Africa) through its official complaints page.