Privacy

1. Who provides S4

S4 is provided by Vesoft Services Limited (company number 08707130), registered at 241 Manningham Lane, Office 1a, Bradford, England, BD8 7ER.

For help with your account, privacy questions and requests, account deletion and any other enquiry about S4, email info@vesoft.co.uk.

2. Who uses S4

S4 is a workforce and operations service for UK private security companies. The people who use it are:

• Guards (security officers), who see their shifts, Book On and Book Off, and keep operational records;
• company owners and staff, who manage clients, sites, rotas, Guards and operational records for their company;
• client users, where a security company gives one of its clients access to selected records;
• S4 administrators at Vesoft Services Limited, who operate and support the service.

3. Our role and your company's role

S4 is a business service. Security companies use it to run their own operations. For information about their Guards, staff, clients and sites — such as shifts, attendance, Welfare Checks, Log Book entries, incidents, compliance and payroll information — the company will usually decide why and how that information is used. In those circumstances Vesoft Services Limited acts as a service provider (a processor) for that company: we handle the information on the company's behalf and in line with its instructions, and the company is responsible for its own use of it.

We act on our own account (as a controller) when we use information for our own purposes: administering accounts, operating and securing S4, communicating with you about the service, providing support, handling account deletion, meeting our legal obligations and running our business.

Which of these applies to a particular piece of information can depend on the agreement between Vesoft Services Limited and the company concerned. If you have a question about how a company uses your information, you can ask that company directly, or contact us and we will help direct your request.

4. Information S4 uses

Depending on how you use S4 and which features your company uses, S4 handles:

• Account and contact details — your name, email address, telephone number, your role and account status, and whether your email address has been verified.
• Guard profile and licensing — your SIA licence number and expiry date, right-to-work status and expiry date, and your availability.
• Employment and payroll administration, where your company uses these features — employment details, payroll set-up, bank details, an emergency contact, driving and transport details, and National Insurance number and Unique Taxpayer Reference, which are stored encrypted.
• Screening and compliance, where used — identity details, address history, references, consents, and documents uploaded by you or your company.
• Companies, clients and sites — company details, client organisations and contacts, sites, site addresses and site location settings.
• Shifts, attendance and timesheets — rotas and shift schedules, shift offers and your responses, Book On and Book Off times, timesheets and their approval.
• Operational records — Welfare Checks, Log Book entries, incidents and how they were resolved, Site Requests, emergency alerts, and the notes you write in them.
• Location at Book On, where your company's site requires it — see section 5.
• Security and account records — sign-ins and sessions, password resets, email verification, and a record of changes made to records, which we use to keep S4 secure and accountable. Passwords are stored only in a protected, hashed form.
• Communications — the account emails we send (such as email verification and password reset) and messages you send to our support team.

5. Location when you Book On

Some security companies require location verification at particular sites. When you Book On at one of those sites, S4 asks for permission to use your location while you are using the app, takes a single reading of your device's location, and sends it with your Book On.

The reading is used to confirm that you are at or near the site. The Book On record can store the location coordinates, how accurate the reading was, and the calculated distance from the site, and your company can see them as part of its attendance records.

S4 does not track your location continuously and does not use your location in the background. Whether location is requested at all depends on how your company has set up the site. You can change location permission in your device settings, but Book On at a site that requires location verification will not work without it.

6. Why S4 uses this information

• to provide your account, sign you in and keep your session secure;
• to plan, offer and assign shifts, and to record attendance;
• to support Welfare Checks, safety alerts and the response to them;
• to keep the operational records — Log Book, incidents, Site Requests — that companies and their clients rely on;
• to prepare timesheets, payroll and invoicing information for your company;
• to support compliance checks and, where used, screening;
• to keep S4 secure, prevent misuse and keep an accountable record of changes;
• to provide support, account recovery and account deletion;
• to meet legal obligations that apply to us.

7. Our legal reasons for using information

UK data protection law requires a lawful basis for each use of personal information. There is no single basis for everything S4 does: it depends on the information, the purpose and who is responsible for it. Depending on the circumstances, the basis may be:

• performance of a contract — for example, providing S4 under the agreement with your company, or with you;
• compliance with a legal obligation — for example, keeping records that the law requires;
• legitimate interests — for example, keeping S4 secure, preventing misuse and keeping an accountable record of changes, where those interests are not outweighed by your rights;
• consent — only where consent is genuinely the appropriate basis. Where we rely on consent, you can withdraw it at any time.

Where your company is responsible for information, as described in section 3, it decides the lawful basis for its own use of that information and can tell you what it is. Some screening and compliance information is treated more carefully by the law, and additional legal conditions apply to its use.

8. Who can see your information

• The security company you work for or that gave you access, and colleagues it permits to use its S4 workspace. One company cannot see another company's records.
• That company's clients, where the company shares records with them — for example timesheet approvals in the S4 client portal, or incident reports and Daily Site Logs the company chooses to send.
• Service providers that host and operate S4 for us: Supabase (database and file storage), Render (the S4 application server), Vercel (hosting of the S4 web application) and Resend (account emails such as verification and password reset). They act on our instructions.
• Professional advisers, regulators, law enforcement or courts, where the law requires it or where it is needed to establish, exercise or defend legal rights.

We do not sell personal information and do not share it for advertising.

9. Where information is processed

S4's database and file storage are hosted in the European Union (Ireland). The S4 application server is hosted in the United States, and our web hosting and email providers may process information in other countries. Where this involves a transfer of personal information outside the UK, we use the safeguards that UK data protection law requires for that transfer.

10. How information is protected

S4 uses encrypted connections, stores passwords and sign-in tokens only in protected hashed form, encrypts National Insurance numbers and Unique Taxpayer References, keeps uploaded documents in private storage that is accessed through short-lived links, and separates each company's records from every other company's. Access is limited to the people and roles that need it, and changes are recorded. No system can be completely secure, and you should keep your password private.

11. How long information is kept

We keep information for as long as it is needed for the purposes above. Some records have to be kept for longer than your account, because a company, its clients or the law may rely on them:

• shift, attendance and timesheet records — for pay, invoicing, accounting and disputes;
• Welfare Check, Log Book, incident and safety-alert records — as operational and evidential records of what happened on site;
• licensing, right-to-work, screening and compliance records — where employment, licensing or legal requirements apply;
• security and audit records — to keep S4 secure and to investigate misuse.

We keep these records only for those legitimate legal, contractual, security, employment, accounting or evidential needs. Where your company is responsible for a record, its own retention requirements also apply.

12. Deleting your account

You can ask to delete your account in the S4 app or on our account deletion page. When an account is deleted, access to it ends straight away, every signed-in session is ended, and direct account details such as your email address, name and phone number are deleted or anonymised. Records that have to be kept for the reasons in section 11 may be retained, and where your name forms part of those records it may remain on them.

An account that owns a company workspace, or an S4 administrator account, cannot be deleted directly in the app, because that would leave a company or the service without someone responsible for it. The request is recorded and our support team will help transfer or close the workspace first.

13. Your rights

Under UK data protection law you can ask to access your information, correct it, delete it, restrict or object to its use, and in some cases receive it in a portable form. To make a request, email info@vesoft.co.uk. We may need to confirm your identity first. Where your company is responsible for the information, we may pass your request to it or help it respond.

You can also complain to the Information Commissioner's Office at ico.org.uk.

14. Who S4 is for

S4 is a work tool for adults. It is not designed for children, and you must be 18 or over to use it.

15. Automated decisions

S4 applies the rules a company sets up — for example, a missing or expired compliance document can stop a shift from being assigned until it is resolved. Decisions about recruiting, deploying or employing people are made by the people at the company, not by S4.

16. Changes to this policy

We will update this policy when S4 or the way it uses information changes. The effective date and document reference at the top show which version applies. Where a change is significant, we will tell you in S4 or by email.