Privacy Policy

MyCRM is a workplace application used by staff of Gettico and its group companies to carry out their jobs — logging customer visits, recording equipment installations, clocking in and out, submitting expenses, and communicating with colleagues.

It is not a consumer app and it has no public sign-up. Accounts are created and issued by Gettico. If you are using MyCRM, you are doing so as an employee, contractor or authorised representative of an organisation that has given you an account.

Gettico decides why and how the information described here is used, and is responsible for it. This policy covers the MyCRM mobile app on Android and iOS, and the MyCRM web application.

We collect only what the app needs to do its job. Each item below is tied to a specific feature — nothing is gathered speculatively or “just in case”.

This deserves to be stated plainly, because it is the permission people most reasonably worry about.

MyCRM does not track your location in the background and does not follow your movements. The app never requests background-location access. It reads your position once, at the instant you tap a button that needs it — a clock-in, a visit check-in or check-out, a job start, an installation record, or sharing a place in chat — and stores that single point with that record.

When you are not performing one of those actions, the app is not reading your location. If you deny the location permission, those specific features will record no position; the rest of the app continues to work.

Where your employer has configured work locations, a clock-in may be marked as inside or outside a known site. That mark is a flag for your HR team to review — it does not block you from clocking in.

• Location — while you are using the app only, for the actions above.
• Camera — to photograph attendance, installations, receipts and job sites.
• Photo library — to attach an existing image to a record or a message.
• Microphone — to record a voice note, only while you hold the record button.
• Notifications — to alert you about messages, approvals and assigned work.
• Face ID, Touch ID or fingerprint — to unlock the app. This check happens entirely on your device. Your biometric data is never sent to us and we never receive or store it.

You can withdraw any of these permissions in your device settings at any time.

• We do not sell your personal information, to anyone, ever.
• We do not use your information for advertising, and we show no ads.
• We do not track you across other apps or websites, and the app contains no advertising or tracking software.
• We include no third-party analytics or behavioural profiling tools.
• We do not read your location in the background, your microphone outside a recording you started, or your camera without you opening it.

We do not share your information with third parties for their own purposes. A small number of service providers process it strictly on our instructions so the app can work:

• Supabase — hosts the database and file storage behind MyCRM.
• Expo — delivers push notifications and app updates.
• Google (Firebase Cloud Messaging) and Apple (APNs) — carry push notifications to your device.

Inside your organisation, what colleagues can see is governed by their role and permissions. Attendance records, expenses and personnel information are restricted to authorised HR, finance and management staff.

We may also disclose information where the law requires it, or to establish or defend legal claims.

Attendance photos, installation photos, visit check-in photos, expense receipts, proof-of-payment images, chat attachments, task attachments and personnel documents are held in private storage. They are not reachable by a public web address; the app issues a short-lived link each time an authorised user opens one.

Two categories are an exception, and we would rather say so than leave it implied: job photographs and captured customer signatures are stored without that restriction, so anyone who obtains the file’s web address can open it. The addresses are long, random and not listed anywhere public, but they do not expire. We are in the process of moving both categories to the same private, time-limited storage as everything else.

Business records — visits, jobs, installations, invoices, payments and support history — are kept for as long as Gettico needs them to run and account for the business, and for any period accounting and tax law requires.

Attendance records, including clock-in photographs and their location points, are kept for as long as employment records must be retained under applicable employment law.

When a record is no longer needed for either purpose, it is deleted or anonymised.

Depending on where you live, you may have the right to:

• ask what information we hold about you, and get a copy;
• have inaccurate information corrected;
• ask us to delete information we no longer need;
• object to or restrict certain uses;
• complain to your local data protection authority.

To exercise any of these, contact us at privacy@gettytech.com. Some records — an issued invoice, or an audit trail entry — cannot be deleted on request, because the business is legally required to keep them. Where that applies we will tell you which records and why.

Accounts are issued and closed by Gettico, so there is no self-service delete inside the app. To have your account closed and your personal information deleted, email privacy@gettytech.com from your work address, or ask your administrator.

We will close the account and delete the personal information associated with it, except records we are required to retain as described above. We aim to complete this within 30 days.

Information is encrypted in transit. Access is controlled per account by role, and enforced by the database itself rather than only by the app. Files that need protecting are held in private storage and opened through short-lived links. The app can be locked with your device passcode or biometrics.

No system is perfectly secure, but we treat any suspected breach as an incident and will notify affected people and regulators where the law requires it.

MyCRM is a workplace tool intended for adults in employment. It is not directed at children, and we do not knowingly collect information from anyone under 16.

If we change what the app collects or how it is used, we update this page and change the date at the top. Material changes will also be announced inside the app.

Questions about this policy, or about information we hold, go to privacy@gettytech.com.