Tandem Privacy Notice Version 2026-09-05-draft.1
Draft for product-owner and UK specialist review. This revision does not authorise paid launch or replace a signed customer agreement.
For customer operational records, the customer Company generally determines the purposes of processing and acts as controller. Tandem's service provider acts as processor where it processes those records on the Company's documented instructions. The provider may act as controller for its own account administration, billing, support and security. The provider's legal identity and privacy contact must be confirmed in the customer agreement before customer launch.
Data may include account and contact details, Company membership and permissions, customers and sites, jobs and assignments, clock and break events, forms, photos, signatures, materials, expenses, communications and audit events. Optional functions may process location or safety information when enabled and within the agreed scope. Use is limited to providing, administering, securing and supporting the agreed service and meeting applicable obligations.
The Company must identify and document its lawful basis for workforce processing, explain the purpose and scope to workers, and assess whether monitoring is necessary and proportionate. Acknowledging this notice is a record of receipt, not consent to processing and not a waiver of privacy rights. The provider's own processing purposes and lawful bases require confirmation in the final privacy notice.
Access depends on Company membership, role, organisational scope and explicit grants. Support access must have approval, purpose, scope, expiry, visibility and audit, with a separately controlled emergency process. Information is not available to every colleague merely because they share a Company.
Base clocking does not include continuous location tracking. Optional location monitoring must remain off outside work. Device permission does not by itself make monitoring lawful. Records derived from location can be inaccurate and must not automatically decide pay or discipline. Workers need a practical route to challenge errors.
The final subprocessor register must identify each contracted vendor, processing purpose, data categories and locations. International transfers require a valid applicable transfer mechanism and assessment. A software dependency alone does not establish that a vendor is an active subprocessor for a particular environment.
Retention must follow the Company's documented purposes, legal holds and applicable duties. The final schedule must cover operational records, location, safety, audit, logs and backups, including deletion and recovery periods. No universal retention period is asserted by this draft. Removing account access does not erase valid historical records.
Workers should raise access, correction, objection, restriction, deletion or portability requests with the Company responsible for their operational records. For the provider's own records, use the privacy contact identified in the customer agreement. Rights depend on the processing and applicable law. You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
Tandem is for authorised business use. Non-essential advertising, analytics or session-replay tracking requires separate assessment and any required consent. Acknowledging this notice does not enable such tracking. Material notice changes receive a new revision and a new acknowledgement.