Privacy Policy

HBC Group GmbH ("we", "our", "us") operates the HBCField mobile application and web platform. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

1. Information We Collect

Account Information

• Email address
• First and last name
• Organization name
• Role and permissions within your organization

Location Data

• Precise GPS location — collected only during active work activities:
  • When driving to a job site (EN_ROUTE status) — your route is recorded continuously in the background, even when the app is closed or not in use
  • When clocking in or out (single GPS fix for attendance verification)
  • When marking arrival at a job site (geofence verification)
• Cached location — used for presence indicators on the dispatcher's live map. This uses the device's last known position without activating the GPS radio.
• Location data is never collected when you are browsing tasks, viewing your profile, or outside active work — that is, when you are not driving to a job and not clocked in.

Work Activity Data

• Task status updates and timestamps
• Clock in/out times and break durations
• Service reports including text descriptions, photos you take with your device camera or select from your photo library, and digital signatures
• Comments on tasks

Device Information

• Device type and operating system (for push notifications)
• Push notification tokens (Expo Push Token)
• App version

2. How We Use Your Information

• To provide field service management functionality
• To enable real-time location tracking for dispatchers during active work
• To verify attendance via geofencing at company locations
• To verify employee presence at job sites before starting work
• To send push notifications for task assignments, status updates, and comments
• To generate service reports and maintain work history
• To display route tracking on completed tasks
• To improve app performance and fix bugs

3. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation applies, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the HBCField service to your organization and to you as an authorized user, including task assignment, location-based dispatching, attendance verification, and service reporting.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure our platform, prevent fraud and abuse, maintain service reliability, and improve the product. Our legitimate interests are balanced against your rights and freedoms.
• Consent (Art. 6(1)(a) GDPR) — for optional features such as push notifications, which you can disable at any time in your device settings.
• Legal obligation (Art. 6(1)(c) GDPR) — where we are required to retain records for tax, labor, or other statutory obligations applicable to your organization.

4. Data Sharing

• We do not sell your personal data to third parties.
• Your data is shared only within your organization — admin and dispatcher users can see employee locations and work activity.
• We use the following third-party services:
  • Expo — Push notification delivery
  • Firebase Cloud Messaging (FCM) — Android push notification routing
  • Apple Push Notification Service (APNs) — iOS push notification routing
  • Hetzner Cloud — Server hosting (EU-based, Finland/Germany)
  • Hetzner Object Storage — File storage for attachments (EU-based)
  • OpenStreetMap / OSRM — Map tiles and route visualization
  • Nominatim — Address search (geocoding)

5. Data Storage & Security

• All data is stored on servers located in the European Union (Hetzner, Helsinki/Falkenstein)
• Data is encrypted in transit using TLS/HTTPS
• Passwords are hashed using bcrypt with cost factor 12
• Authentication tokens are SHA-256 hashed before storage
• Refresh tokens use rotation with grace periods for concurrent requests
• Access is restricted by role-based permissions (RBAC)
• Rate limiting protects against brute-force attacks (10 req/sec, 200 req/min)
• Account lockout after 5 failed login attempts (15-minute cooldown)
• File uploads are stored in S3-compatible object storage with presigned URLs

6. Data Retention

• Account data is retained while your account is active
• Location history (route tracking) is retained for 90 days
• Service reports are retained according to your organization's record-keeping requirements
• Refresh tokens are automatically cleaned up after expiration
• You can request complete data deletion at any time

7. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access — Request a copy of your personal data
• Right to Rectification — Correct inaccurate or incomplete data
• Right to Erasure — Request deletion of your personal data ("right to be forgotten"). You can delete your account and all associated data yourself, at any time, directly in the app: Profile → Account → Delete Account.
• Right to Data Portability — Receive your data in a structured, machine-readable format
• Right to Object — Object to processing of your personal data
• Right to Restrict Processing — Request limitation of data processing
• Right to Withdraw Consent — Withdraw your consent at any time
• Right to Lodge a Complaint — You have the right to lodge a complaint with your local data protection authority if you believe your rights have been infringed.

To exercise any of these rights, contact us at privacy@hbcfield.com.

8. Location Tracking Disclosure

HBCField uses location data as a core part of its field service management functionality. Here is exactly when and how location is used:

Additional safeguards:

• Only dispatchers and admins within your organization can see your location
• Location data is never shared outside your organization
• Route data from completed tasks is retained for 90 days
• You can see your own location data in the app

9. Push Notifications

HBCField sends push notifications for:

• New task assignments
• Task status changes
• New comments on your tasks
• Join request approvals or rejections
• Attendance reminders

You can disable push notifications in your device settings at any time.

10. Children's Privacy

HBCField is a workplace application designed for professional use. It is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

11. International Data Transfers

Your data is processed and stored within the European Union. Push notification delivery may involve routing through Google (FCM) or Apple (APNs) infrastructure, which may process data outside the EU. These transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of material changes via email or in-app notification. The "Last updated" date at the top of this page indicates when this policy was last revised.

13. Contact Us