Privacy Policy

Alpaka Ltd ("Alpaka", "we", "us", "our") provides HR and workforce management software, including facial recognition clocking via the Alpaka Presence app. We understand that the data we handle - including biometric and employee data - is sensitive, and we take our responsibilities as a data controller and processor seriously.

This policy explains what data we collect, how we use it, and your rights. Please read it carefully. Your acceptance of this policy is deemed to occur on your first use of our Site or Software. If you do not agree, you must stop using them immediately.

1. Definitions

2. Our Role: Controller and Processor

Where you are a Customer, you are the data controller for the personal data of your employees processed through the Software (including timesheets, absence records, HR records and Biometric Data), and we act as data processor on your behalf, under our Data Processing Agreement. Where you are visiting our Site or dealing with us directly as a prospective Customer, we are the data controller.

We do not have a formal Data Protection Officer. Our data protection contact is Phill Rodgers, founder of Alpaka, who handles all data protection matters personally. You can reach him at support@alpaka.io or on 0203 286 6109. Alpaka is registered with the Information Commissioner's Office (ICO).

We aim to respond to any request relating to your personal data as soon as possible, and in any event within the statutory one-month period required by UK GDPR.

3. What This Policy Covers

This policy applies to personal data collected when you become a Customer, when a User uses our Software, or when you visit our Site. Our Site may link to other websites - we have no control over those sites and recommend you check their own privacy policies.

4. Your Rights

Under UK GDPR you have the right to:

1. Be informed about how we collect and use your personal data
2. Access the personal data we hold about you
3. Have inaccurate or incomplete data corrected
4. Request erasure of your personal data ("right to be forgotten")
5. Restrict processing of your personal data
6. Receive your data in a portable format
7. Object to us using your data for particular purposes
8. Rights relating to automated decision-making and profiling

Where you are an employee of a Customer, requests about your HR, attendance or Biometric Data should generally be directed to your employer as data controller in the first instance. If you have a complaint about our use of your data, contact us using the details in section 15. You also have the right to lodge a complaint with the Information Commissioner's Office.

5. What Data We Collect

If you are a Customer

• Company name, billing contact name, email address, postal address and telephone number
• We invoice Customers directly and are paid by bank transfer (BACS) - we do not collect, process, or store any card or payment details

If you are a User of our Software

• Name, work email address and role
• Employment records entered by your employer: contracts, HR records, qualifications, annual leave, absence and time off in lieu
• Timesheet, scheduling and attendance data
• Where Alpaka Presence is used: a reference photo and clock-in/clock-out photo used for facial matching ("Biometric Data"), or alternatively a keypad PIN, badge ID, or mobile device identifier if your employer has configured a non-biometric clocking method
• Location data, where enabled by your employer for mobile clock-in

If you visit our Site

• Name, email address and telephone number if you complete our contact form

We do not track, log, or retain any other data about visitors to our Site - see section 11 for our cookie policy.

6. Biometric Data and Alpaka Presence

Alpaka Presence can be configured by your employer for facial recognition only, for facial recognition alongside keypad PIN or ID badge, or for non-biometric methods only. This configuration is an instruction from your employer to Alpaka under our Data Processing Agreement - Alpaka does not decide which method you are required or permitted to use, and does not influence or advise on that choice.

Facial matching is special category processing under UK GDPR. Establishing a lawful basis for whichever configuration it selects - which may be your explicit consent, or another basis such as legitimate interest or employment necessity, together with a Data Protection Impact Assessment and Appropriate Policy Document where required - is your employer's responsibility as data controller, not Alpaka's. The Software itself does not present a consent screen at clock-in; if your employer has enabled facial recognition, you should ask them how their lawful basis was established and what your rights are.

When you clock in or out using facial recognition, your photo is compared against a reference photo on file using a third-party facial matching service. That comparison returns a match or no-match result to Alpaka - we do not generate, store, or have access to any facial geometry, template, or biometric embedding at any point, and the facial matching provider does not retain the photo after the comparison is made.

The reference photo itself is the only image data we retain. It is encrypted at rest and in transit, never sold or used for advertising, and never compared against any external database or used for surveillance purposes beyond clocking in and out. We retain the reference photo for up to 3 months, after which it is automatically discarded - or sooner, when your employer removes you as a User or on request, in accordance with clause 7.6 of our Terms & Conditions. See our Security & Data Protection page for further technical detail.

7. How We Use Your Data

All personal data is processed and stored securely, for no longer than necessary. Our use of your data always has a lawful basis - to perform a contract, because you (or your employer) have consented, or because it is in our legitimate interests. We use data to:

1. Provide and manage access to the Software
2. Operate scheduling, absence, timesheet and attendance features, including facial recognition clocking where enabled
3. Reply to your emails and support enquiries
4. Send service and account emails, and product updates you have opted into

We do not send unsolicited marketing. You may withdraw consent and request deletion of your data at any time, subject to your employer's own record-keeping obligations where applicable.

8. Where We Store Your Data

All Customer Data, including Biometric Data, is hosted on AWS infrastructure in Dublin, Ireland, within the UK/EEA. We have taken appropriate technical and organisational measures - including encryption and access controls - to safeguard all data collected through our Site and Software. Further detail is on our Security & Data Protection page.

9. Do We Share Your Data?

We contract with a small number of third parties to help deliver the Software - principally our hosting provider (AWS) and our facial matching provider. Where your data is shared for these purposes, we ensure it is handled under appropriate contractual safeguards and in accordance with UK GDPR. Photos used for facial matching are passed to our facial matching provider solely to return a match or no-match result at clock-in - that provider does not store the photo, and it is not shared with any other third party for any other purpose. See section 6 for how long we ourselves retain the reference photo. We do not use a third-party payment processor: Customers are invoiced directly and pay by bank transfer.

We may compile anonymised, aggregated statistics about product usage and share these with prospective investors or partners. No personally identifying or biometric data is included.

We may be required to share data in connection with legal proceedings or to comply with a court order or governmental authority.

10. Business Changes

If Alpaka is sold or transferred, your personal data may transfer to the new owner, who will be bound by this Privacy Policy and permitted to use your data only for the purposes for which it was originally collected.

11. Cookies

We use a single, strictly necessary first-party cookie to keep you signed in and identify your session. It is essential to the operation of the Software and cannot be disabled without losing the ability to sign in.

We do not use analytics, advertising, tracking, or any other non-essential or third-party cookies on our Site or in the Software. Because we only use strictly necessary cookies, no cookie consent banner is required under UK PECR - but you can still block or delete this cookie in your browser settings at any time, though doing so will sign you out and prevent you from logging back in until it is restored.

12. Data Retention

We retain Customer Data for as long as your Contract is active. On termination, Customer Data is available for export for 30 days, after which it is securely and irretrievably deleted, in accordance with clause 7.6 of our Terms & Conditions. Website enquiry data is retained only as long as needed to respond to and follow up on your enquiry.

Biometric Data is subject to a shorter retention period, described in section 6: reference photos are automatically discarded after 3 months, or sooner where a User is removed or requests deletion.

13. Accessing Your Data

You have the right to request a copy of any personal data we hold about you. Where you are an employee of a Customer, please contact your employer in the first instance, as they are the data controller. Otherwise, contact us using the details in section 15.

14. Automated Decision-Making

Alpaka Presence uses facial matching to identify a staff member at clock-in against their own stored facial data. This is a verification step, not automated decision-making that produces a legal or similarly significant effect - clock-in results are always reviewable by your employer, and no automated decisions about employment, pay or discipline are made by the Software itself.

15. Contacting Us

For any questions about this Privacy Policy or your personal data:

Email: support@alpaka.io
Phone: 0203 286 6109
Post: Alpaka Ltd, 6 The Leys, Northampton, NN2 6QZ

16. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page, and continued use of our Site or Software after changes are posted constitutes acceptance of the updated policy. We recommend checking this page periodically.