What Teams records, and who can see it.
Locufy Teams is a workforce app. Your employer uses it to run the rota, record hours and keep employment records. This page says exactly what it stores, when, and who it is shared with.
Last updated 11 October 2026.
Location — the short version
Your location is read when you clock in and when you clock out, and at no other time. It is not read while you are working, not between shifts, and not when the app is closed. The app holds no background location permission, so it cannot read your location when you are not using it.
It is used for one thing: to record whether you were at the site when you clocked. That reading appears on your own timesheet, so you can see exactly what was recorded, and it is visible to whoever runs your rota.
Saying no is a real option. If you decline the location permission the app still works: you can still clock in, and the record simply notes that no location was available. Clocking in is never refused for being away from a site or for having no signal — it is recorded and flagged for your manager to look at.
Who is responsible for your data
Your employer is the data controller. They decide what is kept about you and for how long, and requests about your employment record go to them first.
Locufy is the data processor. We store and process that information on your employer’s instructions, under a data processing agreement with them. We do not sell it, we do not use it to advertise, and we do not use it to train anything.
Locufy is operated by registered company name and company number.
What the app records
- Who you are — your name, work email address, and the phone number and address your employer holds for you, along with your job title, start date and employment terms.
- When you worked — clock-in and clock-out times, breaks, the shift each belongs to, and the location reading described above.
- What you were asked to do — your shifts, tasks, site checklists and forms you complete.
- Documents and qualifications — contracts and policies you are asked to read or sign, and certificates with their expiry dates.
- Photographs you choose to add — a receipt for an expense, or a photo of a certificate. The camera is only ever opened by you tapping to add one.
- Messages — what you write in team chat and on shift threads. These are workplace messages and are visible to the people in them and to whoever administers the account.
- Absence and leave — time off you request and its outcome, and any sickness records your employer keeps.
- Technical records — the device and browser used, and a log of sign-ins, kept to keep the account secure.
What we never do
- No advertising, and no advertising identifiers.
- No selling or sharing your information with anyone for their own purposes.
- No tracking between shifts, and no location in the background.
- No reading of your personal messages, photos or contacts outside the app.
Who it is shared with
Inside your workplace, what each person can see is set by their role. A colleague can see who is on shift with them; your pay, address and emergency contacts are visible only to people your employer has given those permissions to.
Outside your workplace, your information reaches only the suppliers we use to run the service — hosting, email delivery and error reporting — each under contract and only to the extent they need. Name each sub-processor, its role and its location.
Where it is kept, and for how long
Data is stored on servers in region. If it is ever processed outside the EEA, that transfer is covered by the appropriate safeguard — adequacy decision or standard contractual clauses.
Retention is set by your employer and by the law that applies to employment and pay records. State the default retention periods for attendance records, employment records and messages, and what happens when an employee leaves or an account is closed.
Your rights
Under the GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, object to some uses of it, and complain to a supervisory authority — in Ireland, the Data Protection Commission.
To have your account and your data deleted, the steps are on the deletion page — who to ask, what is deleted, and what your employer may be required to keep.
Because your employer is the controller, start with them. If you cannot reach them, or your request is about how Locufy itself handles the data, write to [email protected] and we will help. Add a DPO or privacy contact if one is appointed.
Keeping it safe
Everything travels over an encrypted connection. Passwords are stored hashed and never in a readable form. Access inside your workplace is controlled by role, and signing out ends the session on the server rather than only on the device — so a lost phone can be cut off. Add the backup, breach-notification and penetration-testing commitments once they are agreed.
Children
Teams is a workplace tool and is not intended for children. Accounts are created by employers for people they employ. State the minimum age, consistent with the employment law that applies.
Changes
If this policy changes in a way that affects what is recorded about you, we will say so in the app rather than only here. The date at the top is always the date of the current version.
Contact
Looking for the app? The staff app.