Privacy, in plain language.

Who handles your information

Rollcall is operated by ASMA Consulting Pty Ltd (we, us or our). Contact us at admin@asmaio.com.au.

Your employer or workplace administrator supplies and manages workplace records in Rollcall. They decide matters such as roster assignments, attendance requirements and request approvals. Their own privacy practices also apply to the information they manage. Contact them about employment records, and contact us about your Rollcall account or how the service handles information.

Information we collect

We collect information you provide, information your workplace adds, and information generated as you use the service. Depending on the features you use, this includes:

• Account and workplace details: your name, email address, account identifier, workplace membership, role and work location.
• Work records: shifts, clock and break events, attendance corrections, availability, leave dates and reasons, shift requests, task progress and acknowledgements.
• Team content: announcements, discussions, reports, explanations and manager decision notes.
• Learning and HR records: assigned lessons, quiz answers and results, identified form and checklist responses, employment documents you or your manager upload, expiry dates, review decisions, recognition and workplace reward points. Documents are private to you and authorised workplace managers. Recognition messages are visible to your team; points balances and reward requests are visible to you and managers.
• App and device information: notification preferences, read and block settings, installation identifiers and push notification tokens.
• Technical and support information: messages you send us, and operational information such as authentication events, delivery results and logs processed by our infrastructure providers. These providers may receive IP addresses and device or browser details when handling a connection.

Only include information needed for the work request or discussion. Avoid putting medical details, identity documents or other unnecessary sensitive information in free-text fields or team posts. Discuss any required confidential employment information with your manager through an appropriate channel.

Attendance and location

When you submit a clock action for a work site with a geofence, Rollcall requests foreground access to your precise location. Latitude, longitude and accuracy are sent to the service and stored with the attendance event to check the configured worksite boundary.

The employee app does not continuously monitor your movements or request background location tracking. New clock-ins require a configured workplace boundary and an acceptable location reading. An existing session opened before location setup became mandatory may be finished without a reading if that site remains unconfigured.

You can decline or change location permission in device settings. A geofenced clock action cannot be completed without an acceptable reading. If permission, accuracy or the site boundary prevents clocking, you can report a clock issue with the intended time and a reason. Another authorised manager must approve it before it changes attendance. Approved exceptions are recorded as manually reviewed events with unverified location; they do not create a verified GPS reading. You can also request a correction to a completed work period.

How information is used

We use information to authenticate accounts, connect people to the correct workplace, provide scheduling and attendance features, process work requests, provide training, document collection, forms and workplace recognition, deliver team content and optional notifications, respond to support requests, and protect and maintain the service.

Rollcall applies automated checks to membership, attendance location, overlapping work and request validity. These checks can prevent an action from being submitted. Workplace managers review requests and make approval decisions; you can ask them to investigate an incorrect record or blocked attendance action.

The current employee app does not include advertising SDKs or cross-app advertising tracking.

Sharing and service providers

Authorised workplace owners and administrators can access the work information needed to manage their team. Team members can see content intended for their workplace, such as published team information and discussion posts. Reports are available to authorised managers for moderation.

We use Supabase for authentication, databases and backend services. Optional push delivery uses Expo and the relevant Apple or Google notification service. Push tokens, delivery information and notification content pass through these services. Our website hosting and support email providers also process information needed to deliver their services.

When a manager searches for a workplace address, Rollcall sends the street address to Photon, operated by komoot using OpenStreetMap data. Rollcall caches matching address results for reuse for up to seven days. Shop or unit details are stored separately by Rollcall and are not sent to Photon. Employee attendance coordinates and identity are not sent to this address-lookup service. Photon receives the query and our server's network address. Address data is provided by OpenStreetMap contributors; building matches do not verify individual units or tenancies. See komoot's privacy information for its published privacy practices.

Service providers may process information outside Australia, depending on the service configuration and delivery network. Contact us for information about the providers and processing locations applicable to your use of Rollcall.

Information may also be disclosed where required or authorised by law, or where reasonably necessary to investigate misuse, protect account security or respond to a lawful request.

Security and storage

Rollcall uses encrypted connections, authenticated accounts and workplace access controls. Native sign-in sessions use device secure storage. Web sessions and essential app preferences use browser storage. Sign out on shared devices and protect your device and email account.

The public interactive demo stores sample changes in your browser. Demo records are separate from live workplace records; do not enter real employee or confidential information into the demo.

These measures reduce risk, but no online service can guarantee absolute security. If you suspect unauthorised access, contact us promptly and change your password.

Retention and account deletion

Information is retained for providing the service, managing workplace records, resolving disputes and meeting applicable legal obligations. The period can differ by record, workplace requirements and service-provider backup arrangements. Contact your workplace or us for information about records relevant to you.

In the employee app, open More → Edit profile → Delete my account. Deletion requires your current password and confirmation. An owner with other active team members must transfer ownership first. If you cannot access your account, email us for help.

Account deletion removes the authentication account and workspace access, unlinks the login from employer records, removes personal app preferences and registered push devices, and removes account-linked posts from the team feed. Employer-owned attendance and business history can remain. Deleting the login is not a request to erase every employer-held record or an assurance of immediate removal from all backups.

Access, correction and choices

You can view your available work records in the app, update your display name, request time corrections and change notification preferences. Push notifications are optional and also controlled by your device settings. Turning them off does not remove in-app updates.

To request access to or correction of personal information we hold, email admin@asmaio.com.au. Describe the information and workplace involved. We may need to verify your identity and coordinate with your workplace. Do not send your password. We will explain any applicable limits or reasons if we cannot fulfil a request.

Questions and complaints

Send privacy questions or complaints to admin@asmaio.com.au, addressed to the privacy contact at ASMA Consulting Pty Ltd. Explain what happened, when it happened and the outcome you are seeking. We will review the issue, seek any information needed and communicate our response.

If you are dissatisfied with our response, or have not received one within 30 days, you can check the Office of the Australian Information Commissioner’s complaint process to see whether it can assist.

We may update this policy as the service or its practices change. The date at the top identifies the current version. You can contact us for a copy or help understanding the policy.