Privacy Policy

PRIVACY POLICY

Last updated: 13 November 2026

This Privacy Policy explains how Vyce Group Limited and the companies it licenses to operate the Vyce software and brand (together "Vyce", "we", "us", "our") collect, use, share and protect personal data when you use our websites, apps and services (together, the "Services"), and explains your rights.

Company details
Vyce Group Limited (registered in England & Wales)
Company number: 09875720
Email: hello@vyce.io

1) Controller vs Processor (very important)

Our Services are used by businesses to manage their workforce. Depending on the context, Vyce acts as:

A) Processor for "Customer Workspace Data"

Where a business customer (your employer/engager/agency) uses Vyce to manage workforce operations, that business usually decides what workforce data is collected and why. In that case:

• the business customer is the Controller; and
• Vyce is the Processor (we process the data on the customer's instructions to provide the Services).

This includes, for example, workforce records, timesheets, site assignments, forms, messages, identity and right-to-work records, clock-in/clock-out selfies and match results, health & safety declarations, and contractor payment instructions within that customer's workspace.

B) Controller for "Vyce Platform Account/Profile Data"

Vyce may also act as a Controller for certain data needed to run and secure the platform, and to enable individuals to keep a Vyce account even if a particular customer stops using Vyce. This can include:

• your Vyce account identifiers (e.g., email/phone, user ID);
• your profile details stored at platform level (as applicable);
• security and audit logs; and
• reference selfie(s) used to verify your identity for time & attendance (where enabled) (see Section 6).

If your account/profile remains on Vyce after a customer stops being a client, Vyce is acting as a Controller for that retained platform account/profile data (unless and until it is deleted in accordance with this Policy or your request).

Health & safety declarations are never Platform Account/Profile Data. They stay inside each employer's workspace and do not move with your Vyce account (see Section 5).

If you are unsure which applies, contact us at hello@vyce.io.

2) Personal data we collect

Depending on your role and how the Services are configured, we may collect:

A) Data you provide

• name, email, phone number, date of birth and address;
• work details (e.g., employer/engager, role, site, trade, qualifications, cards and certificates, and their expiry dates);
• identity and right-to-work information (see H below);
• contractor details and related information required for contractor payment and CIS workflows (where enabled), such as National Insurance number, Unique Taxpayer Reference (UTR), company and VAT details, and bank account details;
• time and attendance records (clock-in and clock-out times, timesheets, site attendance, and work measurement records);
• content you or your employer add to the Services, such as forms, inspections, messages, documents and photos.

Some of this information is required by law or needed for you to work through Vyce (for example, right-to-work and tax details). If you don't provide it, your employer may not be able to engage or pay you through Vyce.

B) Data collected automatically

• device and app information (device type, OS, app version);
• logs and identifiers (IP address, timestamps, audit/security logs);
• usage and diagnostics events (error logs, performance). Health information is excluded from these.

C) Selfies (identity verification for time & attendance)

If enabled by the customer:

• we collect and store selfie images captured at clock-in/clock-out; and
• we store reference selfie image(s) used to match likeness.

Comparing selfies to confirm who you are uses biometric data, which is special category data under UK data protection law. Section 6 explains why we do this and how we protect it.

D) Location verification

If enabled by the customer:

• we collect location at the point in time of clock-in or clock-out only to verify presence at an approved site.

We do not track continuous/background location for this feature.

E) HMRC verification (CIS / tax status)

Where enabled and supported, we integrate with HMRC to verify workforce tax status. This involves sending relevant identifiers to HMRC and storing the verification result/status returned by HMRC.

F) Website cookies

We may collect cookie and analytics data when you use our websites (see Section 11).

G) Health information (special category data)

If your employer uses health & safety declarations, we collect the health information you give in that employer's health & safety questionnaire. This is special category data under UK data protection law. Section 5 explains how we handle it.

H) Identity and right-to-work checks

Where your employer uses Vyce for onboarding and right-to-work checks, we collect and store:

• images of identity documents, such as your passport;
• right-to-work evidence, such as a Home Office share code and the result of the check, which can include your nationality and immigration status; and
• a selfie, used to confirm the documents belong to you (see Section 6).

Your employer uses this to meet its legal duty to prevent illegal working. To check a share code, the relevant details are checked with the Home Office.

I) Customer and business contact data

If you are a customer, or work for a business that is or may become a customer, we collect your business contact details, account and billing information, and records of our dealings with you. We get this from you, from your organisation, and sometimes from public sources and business data providers.

Card payments are handled by our payment provider. We do not store full card details.

We may send you marketing about Vyce by email. You can opt out at any time using the unsubscribe link or by emailing hello@vyce.io.

3) How we use personal data

We use personal data to:

• provide and operate the Services (accounts, authentication, access control);
• deliver workforce management functions as configured by customers;
• verify identity for time & attendance (selfie matching and point-in-time location checks where enabled) (see Section 6);
• provide Contractor Payments software, which customers use to manage CIS contractor payments (contractor payments only, not PAYE). Payments are made on the customer's instructions and approvals;
• perform HMRC tax status verification where enabled;
• support onboarding, identity and right-to-work checks, and track document expiry dates, so employers can meet their legal duties;
• provide AI features, including our assistant, Laila;
• manage customer accounts and billing, and send marketing to business contacts (you can opt out at any time);
• let employers collect and review health & safety declarations, so they can meet their health & safety duties (see Section 5);
• provide support and service communications;
• maintain security, prevent fraud, and protect users and the platform;
• comply with legal obligations and enforce our terms; and
• improve the Services (debugging, analytics, performance, product improvement). Health information is excluded from analytics and error logs.

4) Legal bases (UK GDPR)

Where Vyce is Controller (Platform Account/Profile Data, security, support, billing)

We process personal data based on one or more of:

• Contract (to provide the Services and manage accounts);
• Legitimate interests (security, fraud prevention, service improvement, responding to requests, and marketing to business contacts);
• Legal obligation (compliance and record-keeping); and
• Consent (where required, e.g., certain cookies/marketing preferences).

For reference selfies, see Section 6D.

Where Vyce is Processor (Customer Workspace Data)

The customer determines the lawful basis and purposes, and Vyce processes on the customer's instructions. For health & safety declarations, see Section 5C. For clock-in/clock-out selfies, see Section 6D.

5) Health & safety declarations

Some employers use Vyce to collect health & safety declarations from the people who work for them. Health information is special category data, so it gets extra protection. In this section, "employer" means any business you work for or are engaged by through Vyce.

A) Who is responsible

Your employer is the Controller. Vyce is the Processor and acts on your employer's instructions.

Your employer decides which questions to ask, why, and what it does with your answers. We provide a default set of questions, but your employer chooses which to use.

If you have a question about your answers or how they are used, contact your employer first. We'll help them respond.

B) What we collect and when

When you join an employer on Vyce, you may be asked to complete that employer's health & safety questionnaire. Questions may cover, for example:

• fitness for work;
• seizures, heart conditions or breathing conditions;
• medication that could affect your work; and
• recent injuries.

You can add free-text details, and you can update your answers at any time in the app.

Health questions are only asked after you have been engaged to work. They are never asked at the application or hiring stage.

C) Why it is used and the legal basis

Your employer uses your answers to meet its health & safety duties to you.

Your employer is responsible for its legal basis. We expect employers to rely on:

• legal obligation and/or legitimate interests (UK GDPR Article 6); and
• for health information, the employment condition (UK GDPR Article 9(2)(b) and Data Protection Act 2018, Schedule 1, paragraph 1).

Health & safety declarations are not based on your consent. Answering is part of how your employer meets its workplace safety duties. Some questions may be optional and offer "Prefer not to say".

D) Who can see your answers

• Your employer: only people your employer authorises for health & safety. Every view is logged.
• Not other employers: answers are kept separately for each employer. If you work for more than one employer on Vyce, one employer never sees the answers you gave another.
• Vyce support staff: only when needed to provide support. Each access is logged with a reason.
• Our hosting providers: as our sub-processors, under contract.

E) Notifications

If an answer indicates a possible risk, your employer's nominated managers get an in-app notification. The notification never contains any health information. Managers must open Vyce to see the answer. They then record what they did (for example, "risk assessment completed").

F) No automated decisions

Flags are triggered by simple rules your employer sets. A person always reviews every flag. No decision with a legal or similarly significant effect is made about you automatically.

G) AI and translation

Employers can use AI to suggest questions. Your answers are never sent to AI.

Question text, but not answers, is machine-translated into Polish, Russian, Romanian and Lithuanian.

H) How long we keep it

We keep your answers while you work for that employer, plus 12 months after you leave. Then we delete them.

We keep logs of who accessed answers for 6 years.

I) How we protect it

• Health details are encrypted.
• Access is role-based, and every access is logged.
• Health information is excluded from analytics and error logs.

J) Your rights

You have the right to:

• access your answers;
• correct them (you can edit your answers in the app at any time);
• ask for them to be erased (subject to your employer's legal duties);
• ask for their use to be restricted;
• object to their use (where this right applies); and
• complain to us or to the Information Commission (see Section 13).

To use these rights, contact your employer. You can also email us at hello@vyce.io. Because your employer is the Controller, we'll pass your request to your employer and help them respond.

6) Selfie identity verification (biometric data)

Vyce is compliance software. A compliance record is only worth something if it belongs to the right person. Selfie verification confirms that the person using a Vyce account is the person whose identity has been checked.

Comparing facial images to confirm who someone is uses biometric data. This is special category data under UK data protection law, so we give it extra protection.

A) Why we use it

Where your employer turns it on, selfie verification:

• confirms that the person clocking in or out is you, and not someone else using your account;
• prevents identity substitution and "buddy clocking" on site; and
• helps your employer keep accurate, reliable attendance and site records, and meet its legal duties, including preventing illegal working.

B) How it works

• We store one or more reference selfies of you, taken when you are onboarded.
• When you clock in or out, you take a selfie.
• We compare that selfie with your own reference selfie(s) to confirm the likeness.

We use selfies only to validate likeness in this way. Selfies are not used for any other purpose, and we do not sell them.

C) Who is responsible

• Clock-in/clock-out selfies and match results are Customer Workspace Data. Your employer is the Controller and Vyce is the Processor (see Section 1A).
• Reference selfies are held at platform level, so your verified profile can stay with you if you work for other employers on Vyce. For these, Vyce is the Controller (see Section 1B).

D) Legal basis

For clock-in/clock-out checks, your employer is responsible for its legal basis. We expect employers to rely on legitimate interests and/or legal obligation (UK GDPR Article 6). For the biometric data, we expect them to rely on the employment condition (Article 9(2)(b); Data Protection Act 2018, Schedule 1, paragraph 1) or the substantial public interest condition for preventing or detecting unlawful acts (Article 9(2)(g); Data Protection Act 2018, Schedule 1, paragraph 10).

For reference selfies we hold as Controller, Vyce relies on:

• legitimate interests (UK GDPR Article 6(1)(f)): keeping the platform secure and making sure compliance records belong to the right person; and
• for the biometric data, the substantial public interest condition for preventing or detecting unlawful acts, such as identity fraud and illegal working (UK GDPR Article 9(2)(g); Data Protection Act 2018, Schedule 1, paragraph 10).

E) How we protect it

• Selfies and reference images are encrypted and stored securely.
• Access is restricted and controlled.
• We use them only for identity verification, as described above.

F) How long we keep it

• Clock-in/clock-out selfies and match results are kept in line with your employer's retention arrangements (see Section 9A).
• Reference selfies are kept as part of your Vyce platform account/profile. You can ask us to delete them (see Section 9B).

G) Your choices and rights

You can ask to access your selfies, ask us to delete your reference selfies, object to our use of them, and complain to us or to the Information Commission (see Section 13). Email hello@vyce.io, or contact your employer about clock-in/clock-out records.

If you have concerns about selfie verification, speak to your employer. They may be able to offer another way to verify your attendance.

7) Who we share personal data with

We may share personal data with:

• business customers and their authorised admins (for workforce data in their workspace);
• service providers/sub-processors (e.g., hosting, monitoring, communications, AI and machine translation) bound by contract to protect data. Our AI features, including Laila, connect to third-party AI providers through secure APIs and do not read workers' personal data. For health & safety declarations, AI and translation providers receive question text only, never workers' answers;
• HMRC where HMRC verification is enabled;
• the Home Office, where a right-to-work share code is checked;
• our payment provider, for customer billing;
• professional advisers (legal/accounting/audit) where necessary;
• authorities where required by law or to protect rights/safety/security; and
• buyers/investors in a corporate transaction (with safeguards).

Health information is only shared as described in Section 5D.

You can ask for our current list of sub-processors at hello@vyce.io.

We do not sell personal data.

8) International transfers

Some of our service providers, including our AI providers, are based outside the UK. Our AI features do not read workers' personal data (see Section 7).

If personal data is transferred outside the UK, we use appropriate safeguards required by law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum.

9) Retention (how long we keep data)

We keep personal data only as long as necessary for the purposes described above.

A) Customer Workspace Data (Vyce as Processor)

Retention is primarily determined by the customer (Controller) and contractual arrangements. Health & safety declarations follow the fixed period in C below.

The law sets minimum periods for some records. For example, employers keep right-to-work check records for the length of the engagement plus two years, and tax and payment records for at least three years after the end of the tax year.

When a customer relationship ends, workspace data is handled in accordance with the customer contract and deletion/backup processes, subject to legal requirements.

B) Vyce Platform Account/Profile Data (Vyce as Controller)

We may retain your platform account/profile data, including reference selfies, to operate the platform, maintain security and auditability, prevent fraud, and allow you to use Vyce with other customers.

You can request deletion of your platform account/profile data (see Section 12). We may retain limited records where required by law or for the establishment, exercise or defence of legal claims.

C) Health & safety declarations

We keep your answers while you work for that employer, plus 12 months after you leave. Then we delete them. We keep logs of who accessed answers for 6 years.

Important: If you are a Workforce User and want your data removed from a specific employer/engager workspace, you should contact that employer/engager. If you want your Vyce platform account/profile deleted, contact hello@vyce.io.

10) Security

We use appropriate technical and organisational measures designed to protect personal data (access controls, encryption in transit, monitoring, and incident response). Special category data gets extra protection:

• health information is encrypted, access is role-based and logged, and it is excluded from analytics and error logs; and
• selfies and reference images are encrypted, stored securely, and access is restricted and controlled.

No method of transmission or storage is 100% secure.

11) Cookies

We use cookies and similar technologies to:

• enable core website functionality;
• remember preferences;
• measure and improve performance; and
• (where enabled) support marketing analytics.

With your consent to marketing cookies, Google Ads, Meta (Facebook and Instagram), HubSpot and RB2B measure how our advertising performs and recognise returning visitors. RB2B identifies the company a visitor is browsing from, so our sales team can follow up with businesses that showed interest. Our Cookie Policy lists each cookie.

You can manage cookies through your browser settings and (where available) cookie preference tools.

12) Your rights and how to exercise them

Your rights depend on who is the Controller:

If your employer/engager is the Controller (most workforce data in a workspace, including health & safety declarations and clock-in/clock-out selfies)

For requests about workplace data (e.g., timesheets, job/site records, approvals, workplace policies, health & safety declarations, clock-in/clock-out records), contact your employer/engager first. We will assist them where required. Section 5J explains your rights over health & safety declarations.

If Vyce is the Controller (platform account/profile, reference selfies, security logs, support, billing)

You may have rights including access, correction, deletion, restriction, objection, portability (in some cases), and withdrawal of consent (where applicable). Section 6G explains your rights over selfies.

To exercise rights, email hello@vyce.io. We may need to verify your identity.

13) Complaints

If you are unhappy with how we have handled your personal data, email hello@vyce.io with the subject "Data protection complaint". We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the UK regulator, the Information Commission (formerly the Information Commissioner's Office, ICO), at ico.org.uk.

14) Children

Our Services are not intended for children and users must be at least 16.

15) Changes to this Policy

We may update this Policy from time to time. We will post the updated version and update the "Last updated" date. Material changes may be notified via the Services or email where appropriate.

On 13 November 2026 we added Section 5 (Health & safety declarations) and Section 6 (Selfie identity verification), and updated related sections, including the data we collect, right-to-work checks and complaints.

16) Contact

Email: hello@vyce.io
Vyce Group Limited (company number 09875720)