Privacy Policy

1.Who we are & our role in your data

WarnDesk (“WarnDesk”, “we”, “us”, “our”) provides a workforce-monitoring platform (the “Service”) that lets an organisation (“Customer”, “Company”) monitor the company-owned or company-authorised devices it assigns to its workers (“Employees”, “End Users”).

For the personal data processed through monitoring, the Customer is the data controller (or “business”) and WarnDesk acts as a data processor (or “service provider”) acting only on the Customer’s documented instructions. The Customer decides what to monitor, why, and for how long, and is responsible for having a lawful basis and for informing its Employees.

For our own account, billing and website data (e.g. the administrator who signs up), WarnDesk acts as the controller. This Policy explains both roles.

2.Scope of this Policy

This Policy applies to the WarnDesk website, dashboard, APIs and the WarnDesk monitoring agent installed on Customer devices. It does not apply to third-party websites or services that may be linked from the platform.

3.Personal data we process

a) Account & billing data (WarnDesk as controller)

• Administrator name, email address, hashed password and two-factor authentication (TOTP) secrets.
• Company name, time zone, subscription plan, billing status and support correspondence.
• Security and audit logs (sign-ins, IP address, actions taken in the dashboard).

b) Monitoring data (Customer as controller, WarnDesk as processor)

Depending on the features the Customer enables, the agent may collect from the monitored device:

• Device and session information: computer name, local IP address, operating system, agent version, screen on/off, online/idle/away and break state.
• Application & window activity: which applications and windows were active and for how long.
• Website & URL activity: websites and full URLs visited and time spent (including private/incognito windows), captured natively by the agent.
• Screen content: on-demand live screen view and screenshots/recordings, across multiple monitors, when a Customer administrator requests them.
• Audio: on-demand listening to system output and/or microphone audio, and recordings, when a Customer administrator requests them.
• File & folder activity, and files an administrator chooses to send to a device.
• Security signals: VPN/proxy use, connection of USB / removable storage devices, and access to restricted or non-approved websites or applications.
• Time, activity and productivity metrics derived from the above.

WarnDesk does not intentionally collect special-category data (e.g. health, biometric or trade-union data). Because monitoring can incidentally capture content typed or displayed on screen, Customers must configure and use the Service lawfully and proportionately (see Terms & Conditions).

4.Why we process data & legal bases

WarnDesk processes account data to create and secure accounts, provide and bill for the Service, respond to support requests, prevent fraud and abuse, and comply with law. Our legal bases (where the GDPR or similar laws apply) are performance of a contract, our legitimate interests in running and securing the Service, and legal obligation.

Monitoring data is processed solely to provide the monitoring features to the Customer on its instructions. The lawful basis for monitoring Employees is determined and held by the Customer — typically the Customer’s legitimate interests (balanced against Employees’ rights), performance of the employment relationship, or consent where required by local law. WarnDesk does not use monitoring data for its own purposes and never sells personal data.

5.Employee transparency & lawful monitoring

Employee monitoring is regulated differently around the world. The Customer is solely responsible for ensuring its use of the Service is lawful in every jurisdiction where its Employees work, including providing clear prior notice to Employees, obtaining any consent required, limiting monitoring to what is necessary and proportionate, and honouring any restrictions on covert or off-duty monitoring.

To support transparency, WarnDesk offers an optional on-screen “this device is monitored” badge showing the Customer’s name, and features are gated to a monitoring window / working hours so that off-shift personal use is not captured. Enabling these is the Customer’s choice and does not replace the Customer’s own legal obligations.

6.How we share data & sub-processors

We do not sell personal data and do not share it for cross-context behavioural advertising. We share data only:

• With the Customer that controls the data (its authorised administrators and managers).
• With trusted sub-processors that host and operate the Service (e.g. our cloud/hosting provider), under contracts that require them to protect the data and use it only to provide their services to us.
• Where required by law, legal process, or to protect the rights, safety and security of WarnDesk, our Customers or the public.
• In connection with a merger, acquisition or asset sale, subject to this Policy.

7.International data transfers

The Service may be operated from, and data may be processed in, countries other than where the Customer or its Employees are located. Where personal data is transferred internationally, we rely on appropriate safeguards recognised under applicable law (such as Standard Contractual Clauses) to protect it.

8.Data retention

Account data is retained for as long as the account is active and as needed to comply with legal, tax and security obligations. Monitoring telemetry is retained on a rolling basis (recent detailed activity is automatically pruned, with a rolling reporting window and periodic archiving) as configured for the Service; the Customer controls its retention within the options provided. Files shared to a device auto-expire and are permanently deleted shortly after their download window. On termination, monitoring data is deleted or returned in accordance with the Terms and applicable law.

9.How we protect data

Security is built into WarnDesk by design. We apply administrative, technical and organisational measures appropriate to the risk, including:

• Encryption in transit: all connections between the agent, the dashboard and our servers use HTTPS/TLS, and the site is served over HTTPS only with secure, HTTP-only session cookies and HSTS.
• Encryption at rest for sensitive data: credential-vault entries, device enrolment keys and other secrets are encrypted in the database; account passwords are never stored in plain text — they are one-way hashed (bcrypt).
• Mandatory two-factor authentication (TOTP) for every dashboard account, plus a strong password policy (minimum length, upper/lower case, number and symbol).
• Strict multi-tenant isolation: every request is scoped to the signed-in company, so one Customer can never see or reach another Customer’s data.
• Role-based access control (admin / manager / user, and platform roles), enforced on both the interface and the server (API) layer.
• A code-signed monitoring agent with signature and trust verification, and a least-privilege service design.
• Comprehensive audit logging of security-relevant events (sign-ins, IP address, administrative actions) and automatic crash/error monitoring.
• Hosting on a hardened, access-controlled private server, with regular updates, backups and periodic security review.

We restrict internal access to personal data to the people who need it to operate and support the Service, and we keep such access logged. No method of transmission or storage is 100% secure; while we work hard to protect your data using the measures above, we cannot guarantee absolute security. You can read more about our approach on our Security page.

10.Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent or lodge a complaint with a supervisory authority.

For monitoring data, the Customer is the controller: Employees should direct requests to their employer, and WarnDesk will assist the Customer in responding. For account data where WarnDesk is the controller, contact us using the details below. We may need to verify your identity before acting on a request.

California residents: we do not sell or “share” personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

11.Cookies & similar technologies

The dashboard uses strictly necessary cookies to keep you signed in, secure your session (CSRF protection) and remember basic preferences such as light/dark theme. We do not use third-party advertising cookies. You can control cookies through your browser, but disabling necessary cookies may break sign-in.

12.Children

The Service is a business tool intended for use by organisations and their adult workforce. It is not directed to children and we do not knowingly collect data from children.

13.Changes to this Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the “Last updated” date above will change. Continued use of the Service after an update constitutes acceptance of the revised Policy.

14.Contact us

For privacy questions or to exercise your rights, contact WarnDesk through the in-app Support channel or by email at info@warndesk.com. Customers can raise data-protection requests through their account manager or the Support inbox.