1. Scope and operator

HR Flow is operated by BITBANG L.L.C-FZ (“BitBang”, “we”, “us”, or “our”). This policy covers the HR Flow mobile application and the systems used to provide it. Access is limited to people whose company account has been authorised by BitBang.

2. Data we collect and how we collect it

Depending on your role and use of HR Flow, we may collect:

• Identity and employment data such as your name, company email, Microsoft account identifier, employee number, job title, employment type, department, manager, office, country, join date, and profile image. We receive this from your company account and BitBang’s authorised HR systems.
• HR and request data such as leave balances, leave and permission requests, dates, durations, reasons or notes, delegates, attachments, approval decisions, cancellation details, office-day information, holidays, and team availability. You, managers, approvers, and authorised HR staff provide this data through HR Flow and its supporting systems.
• Notification data such as notification content, delivery and read status, notification preferences, a device registration identifier, and an Expo push token. HR Flow and your device create this data when notifications are enabled.
• Technical and security data such as device name, operating system, app version, session information, timestamps, and limited diagnostics needed to authenticate users, secure the service, and diagnose errors. This is generated when you access or use the app.

Attachments and free-text fields may contain additional information you choose to provide. Only include information needed for the relevant workplace request.

3. How we use personal data

We use personal data to:

• authenticate authorised employees and protect company access;
• display employee profiles, balances, requests, and team schedules;
• submit, review, approve, reject, update, and cancel HR requests;
• send workplace notifications and reminders that users or the company enable;
• provide support, diagnose errors, prevent misuse, and maintain security;
• maintain business records and meet employment, audit, and legal obligations.

Access is limited according to workplace responsibilities. Relevant information may be visible to the employee, assigned managers or approvers, and authorised HR, support, or system administrators.

4. Sharing and service providers

We use the following providers and systems to operate HR Flow:

• Microsoft Entra ID authenticates company accounts and processes the information required to complete sign-in.
• Expo Push Service may route push tokens and notification payloads used to deliver HR Flow notifications.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) deliver notifications to iOS and Android devices respectively.
• BitBang-hosted systems store and process the HR records and app data required to provide the service.

Providers may receive only the information reasonably needed to perform their services. We require providers that process personal data for HR Flow to use it only for the agreed service and to apply the same or equivalent level of protection described in this policy and required by applicable agreements and law.

We may also disclose information when required by law, to respond to a lawful request, or when reasonably necessary to protect people, BitBang, its systems, or legal rights. We do not sell personal data and do not share it with advertising networks or data brokers.

5. Device storage and security

HR Flow stores authentication credentials using secure storage provided by iOS or Android. Limited app data may be cached on the device to support reliable operation and is cleared when you sign out. We use HTTPS, access controls, session protections, and organisational and technical safeguards designed to prevent unauthorised access, use, alteration, or disclosure.

No method of storage or transmission is completely risk-free. Contact us promptly if you believe your account or device has been compromised.

6. Retention and deletion

We retain identity and HR records while needed to administer employment, provide HR Flow, resolve workplace requests or disputes, and meet payroll, audit, tax, security, or other legal obligations. Retention periods vary by record type and the requirements that apply to it. When data is no longer required, we delete it or make it anonymous.

Device registrations, push tokens, cached information, and active-session data are kept only while needed to operate the app and may be removed after sign-out, invalidation, inactivity, or termination of authorised access. Security and support records are kept only as long as reasonably needed to investigate issues, protect the service, and meet applicable recordkeeping requirements.

Requesting account or data deletion

HR Flow does not offer self-service account creation. Accounts and access are managed through BitBang’s company identity and HR systems. To request deletion of your HR Flow account data, email tech@getbitbang.com from your company email and identify the data or account involved. We may verify your identity before acting on the request. We will delete or anonymise data that is no longer required and will explain if employment, payroll, audit, security, or legal obligations require us to retain particular records.

7. Your choices and privacy requests

You can:

• turn push notifications off in HR Flow or in your device settings;
• review available profile and HR information in the app;
• ask us to access, correct, or delete personal data, where applicable;
• ask questions about a workplace record or how your data is handled;
• withdraw consent for optional processing by changing the relevant setting or contacting us. This does not affect processing already completed before withdrawal.

Company authentication and core HR processing are necessary to provide HR Flow. If you do not want that required processing, contact us to disable your app access. Some rights may be limited where BitBang must retain or process records for employment or legal reasons.

8. International processing

Service providers may process data in countries other than the country where you work. Where required, BitBang uses contractual, technical, or organisational safeguards for those transfers.

9. Children

HR Flow is a workplace application for authorised employees and is not directed to children.

10. Changes to this policy

We may update this policy when HR Flow, our providers, or relevant requirements change. The date at the top identifies the current version. Material changes will be communicated through an appropriate company or in-app channel.