DutyFlow Privacy Policy

DRAFT for legal review, not in force. Last updated 13 October 2026.

DutyFlow is a scheduling and attendance service for shift-based businesses. It is operated by Valour Group (Pty) Ltd, a company registered in South Africa (registration number 2026/448581/07), of 16 Brindy Road, Hilton, 3245, South Africa ("DutyFlow", "we"). This policy explains what personal data DutyFlow holds, why, who it is shared with, how long it is kept and what rights people have.

Who is responsible for your data

• If you work for a business that uses DutyFlow, that business decides what is recorded about you and why. It is the controller of your data (the "responsible party" under POPIA). DutyFlow processes it on the business's behalf as a processor (an "operator"). Questions about your shifts or attendance records should go to your employer first.
• If you run a business account (owner, admin or manager), DutyFlow is the controller of your account details (name, email, password, sign-in records).

What DutyFlow collects

About people who manage a business:

• Name, email address and a password, stored only as a one-way hash.
• Sign-in records: the time, IP address and browser of each session.
• What they do in DutyFlow, in an activity log that cannot be edited: for example who published a schedule, approved time off or corrected an attendance record.
• For the owner of a paying business: the plan and subscription status. Card and payment details are collected and held by Paddle (see below), not by DutyFlow.

About staff:

• Name, employee code, roles and workplaces, set by their employer.
• Optionally a mobile number and an email address, if the employer adds them.
• A clock-in PIN, stored only as a one-way hash. The manager who sets the first PIN knows it; staff are asked to change it at first sign-in.
• Sign-in records for the staff app: the time, IP address and browser.
• Shifts, availability, time-off requests, shift swaps, open shifts they claim, and shift checklist items they tick.
• Clock-ins and clock-outs: the time, the method (phone location, a QR or screen code at the workplace, or a shared computer) and, when location is used, one location reading at the moment of the punch, together with whether it was inside the workplace's area.
• A device marker for the phone or browser used to clock in: a random number kept in a cookie on that device, stored by DutyFlow only in scrambled (hashed) form. It is used for one thing: to show a manager when the same phone clocked in two different people within 12 hours, so they can ask about it. It is not a fingerprint of the device and never decides on its own whether a punch is accepted.
• Phone alerts, only if the member of staff turns them on: the address their phone's browser gives DutyFlow for delivering notifications, and the keys that encrypt them. It identifies nothing beyond that phone. It is removed when they sign out, when their phone stops accepting alerts, or when they are erased.

What DutyFlow does not collect: continuous or background location, any location between clock-ins, fingerprints, face scans or other biometric data, or any payroll, bank or salary information.

Why it is used

• To build and share schedules, record who worked and when, and show managers who is working now (performance of the contract with the business).
• To send the messages the service exists for: invitations, new, changed and cancelled shifts, time-off decisions, password resets, and a missed clock-in alert 15 minutes after a shift starts with nobody clocked in (performance of the contract; the employer's legitimate interest in knowing whether a shift is covered).
• To bill a business for its subscription (performance of the contract).
• To keep the service secure and to investigate misuse (legitimate interest).
• To meet legal obligations, such as keeping records the law requires.

DutyFlow does not sell personal data, does not use it for advertising, and does not use it to train artificial-intelligence models.

Nothing in DutyFlow makes a decision about a person automatically. Flags on a clock-in (outside the workplace's area, poor location accuracy, a shared phone) are for a manager to review, and our terms forbid a business from penalising anyone on a flag alone.

Cookies and storage on your device

DutyFlow uses only the cookies it needs to work: one that keeps you signed in, and, in the staff app, the device marker described above. There are no advertising or analytics cookies. Phone alerts are only switched on when a member of staff taps to allow them, and can be switched off in their Profile or the phone's settings. The staff app also keeps a copy of your schedule and any clock-ins waiting to be sent on your phone, so it works without a signal. A clock-in saved on the phone is kept there until DutyFlow has received it, even after signing out, so that no hours are lost. When a business owner chooses to pay, Paddle's checkout is loaded at that moment and sets its own cookies under Paddle's privacy policy.

Who it is shared with

Only the companies DutyFlow needs in order to run, each under a contract that limits them to providing that service:

Data is also shared within a business: managers see the staff and workplaces they are responsible for, and staff see their own shifts and records. One business can never see another business's data.

Because these providers are outside the UAE and South Africa, personal data is transferred abroad. Each transfer is made under a written agreement with the provider that requires it to protect the data to a standard comparable to POPIA and the UAE's data protection law.

How long it is kept

• Account and staff details, shifts, attendance records and the activity log: for as long as the business uses DutyFlow. Attendance records and the activity log cannot be edited, so that records can be trusted: a correction is added as a new entry alongside the original. The business can download everything at any time, and decides how long it must keep its own records.
• Precise clock-in locations: for the number of days the business chooses in its settings (180 days unless it chooses otherwise). After that the location is deleted automatically; the record of whether the punch was inside the workplace's area is kept.
• Messages sent (email, WhatsApp and phone alerts): kept with the business's records, so managers can see what was sent and whether it was delivered.
• When a business leaves, its owner can ask in writing for everything to be deleted; we do so 14 days after the request. A business with no active plan for 12 months may be deleted after we email its owner 30 days before.
• When a member of staff is erased at their employer's instruction, their name, contact details, employee code, sign-in records, precise locations and free-text notes and phones signed up for alerts are removed, messages that name them are cleared, and the activity log is changed to no longer name them. Clock-in times remain against a record that no longer identifies anybody, because the business's hours must still add up. A manager's written reason for a decision about them (for example on a time-off request) is kept, as part of the record of that decision.
• Deleted data remains in our database provider's backups until they expire (no more than 30 days), and in our email and messaging providers' delivery logs under their own retention.

Your rights

Depending on where you are, you can ask to see the data held about you, have it corrected, have it deleted, object to or restrict its use, and receive a copy in a portable format. Because attendance records cannot be edited, a correction is recorded as a new entry rather than by changing the original.

• Staff: ask your employer first; DutyFlow will help them respond.
• Anyone else, or if your employer does not respond: write to garyflintops@gmail.com.

You can also complain to the data protection authority where you live: in the UAE, the UAE Data Office; in South Africa, the Information Regulator (inforegulator.org.za).

Security

Passwords and PINs are stored as one-way hashes. Every business's data is kept separate at the database level. Connections are encrypted. Access to production systems is limited to the people who operate DutyFlow. If a breach affects personal data, we will tell the businesses affected without undue delay, so they can tell their staff and the authorities as the law requires.

Changes

If this policy changes in a way that matters, DutyFlow will tell business owners by email before it takes effect.

Contact

Valour Group (Pty) Ltd, trading as DutyFlow, 16 Brindy Road, Hilton, 3245, South Africa. Privacy questions: garyflintops@gmail.com. Information officer under POPIA: Gary Flint, director.

Optional work logs

Where an employer enables work logs, supervisors can record team participation, activity times, work quantities, before/after work photos, ratings and problems. These are work records, separate from clock-in verification. Photos are not used for facial recognition. Authorized managers review them; the employer may authorize a reporting integration to read work-log records. Work photos should show the work, avoiding identifiable people where possible.