Privacy Policy

This policy applies to all individuals whose personal data is processed through the Supreme Staff platform, including:

• Employees — staff members who clock in/out and receive payroll
• Brand Administrators — managers who oversee one or more store brands
• System Administrators — platform operators with full access
• Visitors — anyone who browses our public pages

We collect only the data necessary to operate the platform:

Category	Examples
Identity	Full name, employee system ID, role
Contact	Email address, phone number
Employment	Department, position, hourly rate, start date
Attendance	Check-in/out timestamps, shift assignments, GPS coordinates at clock-in
Payroll	Hours worked, pay calculations, payment status
Technical	IP address, browser user-agent, session tokens, audit log events
Profile media	Profile photo, clock-in selfie (if enabled)

• Authenticating users and securing access to the platform
• Recording and displaying attendance, shift, and payroll records
• Verifying employee location against store geofences during clock-in
• Generating payroll summaries and facilitating payment
• Sending transactional notifications (approvals, rejections, shift changes)
• Maintaining audit logs for compliance and dispute resolution
• Improving platform reliability and security

• Contract performance — processing necessary to fulfil the employment management service
• Legitimate interests — platform security, fraud prevention, audit logging
• Legal obligation — retaining payroll records as required by applicable labor law
• Consent — for optional data such as profile photos and clock-in selfies

When an employee clocks in via the mobile or web app, the platform may capture GPS coordinates to verify proximity to the assigned store geofence. Location data is used solely for attendance verification and is not shared with third parties for advertising. Coordinates are stored alongside the attendance record and subject to the same retention rules.

We do not sell personal data. We share data only in these limited circumstances:

• Within your organisation — brand admins see data for their own brand's employees; system admins have full access
• Service providers — hosting, email delivery, and storage providers acting as data processors under written agreements
• Legal requirements — when compelled by law, court order, or to protect rights and safety

We retain personal data for as long as the associated account is active or as needed to comply with legal obligations. Payroll records are retained for a minimum of 7 years in accordance with standard accounting requirements. Audit logs are retained for 2 years. Soft-deleted employee records are purged after 90 days unless a legal hold applies.

We implement industry-standard safeguards including HTTPS/TLS in transit, hashed passwords (bcrypt), bearer-token API authentication (Laravel Sanctum), role-based access control, and tamper-evident audit logging. No method of transmission or storage is 100% secure; we encourage users to use strong, unique passwords and report suspected security issues promptly.

Depending on your jurisdiction you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your account and associated data (subject to legal retention obligations)
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests

To request account and data deletion, visit our dedicated Account Deletion page for step-by-step instructions and a full breakdown of what data is deleted or retained. For all other rights, contact us at the address in section 11.

The platform uses a single session cookie for authenticated web sessions and CSRF protection tokens. We do not use third-party advertising or tracking cookies. API clients authenticate via bearer tokens rather than cookies.

If you have questions about this policy or wish to exercise your data rights, please contact:

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify account holders via email. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.