1. Who we are and what this policy covers
Tylup, registered with the Dutch Chamber of Commerce under number 72266295, operates Tylup. Our contact details appear below. This policy covers the marketing website, web platform, employee mobile app, enquiries and support.
We are the controller for our business contacts, account administration, service security and product-improvement processing. An employer or customer organisation normally determines why its employee and workforce data is processed; for those activities we act as its processor under its instructions and an applicable data-processing agreement.
Your employer must provide its own employee privacy information and identify its legal grounds. This policy does not replace that notice or the controller-processor agreement required for workplace processing.
2. Information the service processes
The information used depends on your role, the features enabled and what your organisation provides. It can include:
- Accounts and identity: names, email addresses, usernames, password hashes, roles, permissions, organisation links, authentication tokens and account activity.
- Employee profiles: contact details, date of birth, employee and badge identifiers, employment dates/type, skills, roles, locations, contracts, agreed hours and wage information.
- Planning and business data: revenue history, demand, staffing rules, budgets, availability, forecasts, draft/published shifts, shift offers, swaps and manual adjustments.
- Attendance and payroll preparation: clock-ins/outs, breaks, corrections, approval states, payable hours, premiums, attendance comparisons and export records.
- Leave and learning: absence/sickness status, leave dates and reasons, balances, training/certification records, completion/expiry dates and uploaded training documents.
- Communication and support: notes, tasks, messages, replies, read/reaction status, support tickets, attachments and information included in a contact enquiry.
- Device and technical data: push-notification tokens, device identifiers used for access, connection metadata and service/security logs. Location information may be submitted during a workplace QR scan.
- Connected services: integration settings, access credentials and export information when an organisation enables an accounting or other supported connection.
3. Where information comes from
We receive information from you, your employer or its authorised administrators, imported files, enabled integrations and your use of the service. An employer may create or invite an employee account and enter workforce records before the employee signs in.
Please provide only necessary, accurate information. Do not upload medical diagnoses, identity documents or other sensitive material unless there is a specific lawful need and the feature is suitable for it.
4. Why information is used and the legal grounds
We use information to provide accounts, manage access, generate and review schedules, support attendance and payroll preparation, deliver requested communications, respond to enquiries, maintain security and improve usability.
For processing we control, the relevant GDPR grounds are performance of a contract or requested pre-contract steps, legitimate interests in running a secure and usable service and answering business enquiries, and compliance with legal obligations. Where we rely on consent for a specific optional activity, that consent can be withdrawn without affecting earlier lawful processing.
Our legitimate interests are balanced against people's rights and reasonable expectations. Workplace processing follows the employer's instructions and legal grounds, rather than assuming that every employee has a contract with us or freely consents to employment-related processing.
Sickness and some leave information may reveal health data. The employer must identify both an Article 6 GDPR ground and an applicable Article 9 condition, such as a relevant employment or social-protection obligation under applicable law, and limit access accordingly.
5. Aggregate click and screen analytics
To improve the user experience, Tylup automatically counts visits and named control interactions on Dashboard, Forecast, Employees, Availability, Performance, Training & Certifications, Communication and Hours for signed-in vendor users. Child dialogs and editors can also be measured. Employee, support and administrator sessions do not contribute these UX events.
The browser combines interactions into counters before transmission. The backend merges them into shared totals identified only by UTC day, screen, control and action. The analytics table does not store individual click records, event times, account/company IDs, IP addresses, visitor/session IDs, URLs, input values or arbitrary metadata.
These counts show use of controls, not who clicked, unique users, linked browsing journeys, employee performance or whether an operation succeeded. They are not sold, sent to a third-party analytics provider or used to make advertising profiles.
Analytics requests are authenticated to check access. Authentication and network/hosting logs may still involve personal data outside the aggregate table; we do not describe the entire service as anonymous. Where personal data is involved in this service-improvement or security processing, we rely on the relevant legitimate interests described above, not on treating app use as consent.
Collection is automatic, with no in-app allow/stop-sharing switch. Leaving a measured screen stops new collection there; queued counts can finish sending while the same account remains signed in. Signing out or changing accounts cancels pending delivery and clears browser counters.
Shared counters expire after 90 UTC calendar days through scheduled cleanup. Once merged, a person's contribution cannot be isolated or erased separately. You may contact us to object to processing based on legitimate interests; an objection is assessed under the GDPR, not treated as an automatic technical opt-out that the app does not provide.
6. Cookies, local storage and device permissions
The marketing website stores your appearance preference in local storage. The current marketing implementation does not install advertising trackers or the signed-in application's click-analytics instrumentation.
The web app uses browser storage for authentication state and functional preferences such as language, appearance, notification-read state and saved interface choices. The mobile app uses device storage for login and feature settings. Clearing storage may sign you out or reset preferences; it does not delete server records.
Camera access supports QR scanning. Location is requested for a workplace scan and shared with your employer as scan-location information, not continuous background tracking. Push notifications require device permission and use a delivery token. You can manage these permissions in device settings; disabling them can affect the relevant feature.
7. Forecasting, scheduling and learning
The scheduling service uses business demand, contracts, availability, staffing rules and related workforce information to propose schedules. Where enabled, location-specific learning uses eligible historical schedules and manager adjustments to improve ranking between otherwise feasible options.
Current shared learning statistics use reusable workforce characteristics and location context rather than employee identity as their statistic keys, and are not pooled across unrelated employers. The supporting operational records can still contain personal data. This learning is separate from UX click analytics.
Managers must review proposals and remain responsible for employment decisions, legal working-time rules and published schedules. Tylup is designed to support that review, not replace it with a solely automated employment decision. Contact your employer to challenge a schedule or ask for human review, and contact us about the technology.
9. Hosting and international transfers
Core hosting in Amsterdam is not a promise that every provider, support operation or delivery network processes data only in the Netherlands or EEA. Firebase/Google, Resend, Expo and their delivery infrastructure may involve processing outside the EEA.
International transfers are subject to applicable GDPR requirements, including an adequacy decision or appropriate safeguards such as standard contractual clauses and additional measures where required. Contact us for the current provider locations and applicable transfer arrangements.
10. Retention and deletion
We keep personal data only while needed for the service, the purpose for which it was collected, the employer's lawful instructions, applicable retention duties or the establishment and defence of legal claims. Enquiries, support records, technical logs, uploads and provider copies can have different lifecycles; the analytics period is not a universal retention period for all app data.
Account settings provides the self-service route for available account-deletion controls. You can also contact support to request deletion of your account and associated personal data, including records or files that a login-account deletion does not remove. We may need to verify your identity and, for employer-controlled data, coordinate with the employer.
Deleting a login, uninstalling the app or signing out is not itself proof that every shared employer record, attachment, email-provider copy or backup has been erased. Data that must lawfully be retained is restricted to that purpose; backup and provider-copy removal follows the applicable lifecycle and cannot be represented as instant deletion everywhere.
Employer records may need to remain when an employee account closes, for example to meet payroll or employment obligations. Shared UX counters contain no account identifier and cannot be removed per person; they expire after 90 UTC calendar days. Scheduling-learning history uses a separate rolling eligibility window, not the UX-retention rule.
11. Security and confidentiality
The service uses measures such as authenticated access, role/organisation-based permissions, hashed passwords and validation to protect information. Access is limited according to responsibilities and the relevant service feature. No online service can guarantee absolute security, including during beta.
Keep credentials private, use appropriate device protections and report suspected unauthorised access to support. We handle personal-data incidents and applicable notifications in accordance with the GDPR and our contractual responsibilities.
12. Your GDPR rights
Contact support@tylup.com to exercise your rights. Depending on the circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where consent is the legal ground.
You can also ask about automated processing and request human involvement where the applicable GDPR protections apply. Rights have conditions and exceptions; we may request proportionate information to verify identity and protect other people's data.
For employer-controlled records, contact your employer first or ask us to help route the request. We respond without undue delay and normally within one month; a permitted extension for a complex request will be explained within that first month.
You may complain to the Dutch supervisory authority, Autoriteit Persoonsgegevens, or the supervisory authority in your country of habitual residence, workplace or the alleged infringement. You do not have to contact us first to complain.
13. Changes and privacy questions
We may update this policy as the beta, providers or legal requirements change. The updated date identifies the current version; material changes will be brought to affected users' attention through an appropriate channel. A policy update does not make an otherwise unlawful processing activity lawful.
Use support@tylup.com for questions, provider/transfer details or rights requests. The company details below identify the operator responsible for this policy.