This Privacy Policy explains how HAUZ ENTERPRISE SDN. BHD. (Company No. 1271850-T) ("Hauz", "we", "us") accesses, collects, uses, shares, protects, retains and deletes personal data through the Collarwork mobile app and related services (together, the "Service").
This policy is published at https://www.collarwork.io/privacy-policy.
01Who we are and how to contact us
- Developer
- HAUZ ENTERPRISE SDN. BHD. (Company No. 1271850-T), Malaysia
- Privacy contact
- support@collarwork.io
Please contact us with any question, request or complaint about your personal data.
02How the Service works
Collarwork is a workforce management app. Organisations use it to manage their employees' attendance, shifts, patrols, leave, payslips and related work records. If your employer gave you access to Collarwork, your employer decides much of what is collected about you and how it is used, and we process that data to provide the Service to your employer. Your employer is responsible for its own use of that data, including having a lawful basis to collect it and giving you any notice the law requires. Your employer's own privacy notice may also apply to you. Where the law requires your consent, you will be asked for it by us or by your employer.
03Personal data we collect
Your employer may not use every feature, so we may not hold every type of data listed below.
| Type of data | Examples | Why we use it |
|---|---|---|
| Identity details | Name, date of birth, gender, nationality, citizenship, IC number, passport number, FIN and work permit number, and their expiry dates | Identify you, set up your employee record, and remind your employer about expiring permits and passports |
| Sensitive personal details | Race, religion, marital status, height and weight, where your employer records them | Maintain the employee record your employer requires |
| Contact details | Phone number, email address, home address | Run your account, verify you, and contact you about the Service |
| Emergency contact details | Name, relationship, phone number and address of the person you name | Allow your employer to reach them in an emergency. Please tell that person you have shared their details |
| Work details | Employee ID, department, designation, join date, employment status, working hours, qualifications, experience, reporting manager | Provide workforce management features for your employer |
| Attendance and shift records | Clock-in and clock-out times, shift schedules, attendance photos | Record your attendance and working time |
| Leave and pay records | Leave applications and attachments, leave balances, payslips | Process leave and let you view your payslips |
| Patrol and work submissions | Patrol checkpoint records, reports, and photos, videos and files you submit | Provide patrol, reporting and photo submission features |
| Emergency alerts | Video and audio you record when you raise an emergency alert, and related alert details | Let your employer respond to the emergency |
| Account data | Login credentials, verification codes, profile photo, reasons you give for deleting your account | Sign you in, keep your account secure and process your requests |
| Device and diagnostic data | Device model and name, operating system version, app version and configuration, push notification token, error logs, performance data, date and time of use, IP address | Send notifications, fix errors and improve reliability |
Where we get this data: from you, from your employer and its administrators, from your device, and from our service providers.
Whether you must provide it: some data is needed to run your account and your employer's required features, such as your identity details, contact details and attendance records. If you do not provide it, you or your employer may be unable to use some or all of the Service, and your employer may have its own requirements. Other data is optional, and the app or your employer will indicate this where it applies.
04Device permissions
The app asks for these permissions on your device. We use them for the features described here.
| Permission | How it is used |
|---|---|
| Precise and approximate location | Records your location while the app is in use, for example with your attendance record. The app does not request background location |
| Camera | Takes attendance selfies, and photos and videos for work submissions and emergency alerts |
| Microphone | Records audio as part of video you capture, including emergency alerts |
| Photos, videos, audio and files | Lets you attach files you select. Location information stored in those media files may be accessed with them |
| NFC | Reads patrol checkpoint tags to confirm your patrol. It is not used to read payment cards or identity documents |
| Phone | Starts a call when you tap to call, such as a colleague in the employee directory or an emergency contact. We do not record your calls or collect your call history |
| Biometrics (fingerprint or face unlock) | Provides quick login using your device's own security. This check is handled by your device's operating system, and the app does not send your fingerprint or face data to us |
| Display over other apps and vibration | Displays and signals alerts and notifications |
Attendance selfies are stored as photos. We do not use them to create facial recognition or other biometric templates. You can decline or withdraw a permission in your device settings, but the features that rely on it may stop working.
05How we use personal data
We use personal data to:
- provide, operate and support the Service for you and your employer;
- verify your identity and secure your account;
- send notifications and Service messages;
- diagnose errors and improve the reliability of the Service; and
- meet our legal obligations and protect the rights and safety of users and others.
We do not sell your personal data, and we do not use it for advertising.
07Where data is stored
Our main servers are hosted by Amazon Web Services in Singapore. Our service providers may process data in other countries. Where data leaves Malaysia, we take steps required by applicable law to keep it protected.
08How we protect personal data
We use technical and organisational measures designed to protect personal data, including encrypted connections for data sent between the app and our servers (HTTPS/TLS), managed authentication, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your login details and device secure. Where the law requires it, we will notify the authorities and affected individuals of a personal data breach. If you suspect a security problem, please contact us at support@collarwork.io.
09How long we keep personal data
We keep personal data only as long as needed for the purposes in this policy:
- Account and employee data: while your account is active and you remain linked to an employer's workspace.
- Work records held for your employer (such as attendance, leave and payslips): for as long as your employer instructs us or the law requires.
- Diagnostic data: for a limited period set by our error monitoring settings.
- After account deletion: as described in section 10.
10Deleting your account and data
You can delete your account in the app:
- In the app: go to Profile, Settings, Delete account.
If you are still linked to an employer's workspace, your employer must first remove you from that workspace. The app will tell you if this applies. If your employer does not respond, contact us and we will try to help.
Once we have confirmed your request, we deactivate your account. We aim to delete your account and associated personal data within 30 days, and to remove it from backups within a further 90 days. We may keep limited data where the law requires or permits it, for example tax, employment, security or legal claim records, and only for as long as needed for that purpose. Records your employer must keep remain your employer's responsibility, so please contact your employer about them.
11Your rights
Subject to applicable law, including Malaysia's Personal Data Protection Act 2010, you may ask to access or correct your personal data, withdraw consent, limit its processing, or request a copy of it. Email support@collarwork.io. If your request concerns records your employer controls, we may refer you to your employer or work with them to respond. We may need to verify your identity, may charge any fee the law allows, and may decline a request where the law permits. Withdrawing consent may mean you can no longer use parts of the Service. You may also complain to Malaysia's Personal Data Protection Commissioner. If you are outside Malaysia, you may have additional rights under your local law.
12Children
The Service is for working adults and is not directed at children. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will take steps to delete it.
13Links to other sites
The Service may link to third-party sites that we do not operate. Their own privacy policies apply, and we are not responsible for their content or practices.
14Changes to this policy
We may update this policy from time to time. We will post the new version at https://www.collarwork.io/privacy-policy and update the effective date. Where a change is significant, we will also take reasonable steps to notify you in the app or by another suitable method.
15Emergency alerts
The emergency alert feature sends information to your employer. It is not an emergency service and does not replace one, and it depends on your device, network and your employer's response. In an emergency, contact your local emergency services directly (999 in Malaysia).
16Governing law
This policy is a notice about how we handle personal data and is governed by the laws of Malaysia. Nothing in it limits any right you have under a law that cannot be excluded.