Privacy policy

Privacy and Data Protection Policy

This notice explains how SupplyBridge processes information for the relevant service provider and its users.

Roles and information

For Tenant business records, the Tenant is the data controller and the Platform is the processor. Information can include account and contact details, work and booking records, signatures, device metadata, uploaded evidence, IP address, user agent, and—only during eligible duty or emergency workflows—location readings. The Tenant decides the operational purposes and retention periods. The Platform processes service, security and billing information under its own legal responsibilities where applicable.

Purposes and lawful bases

Processing supports account administration, contracted services, dispatch, proof of attendance or work, safety, security, billing, support, legal compliance and establishment or defence of claims. Depending on the context, lawful bases include contract performance, legal obligations, legitimate interests, and explicit permission where legally required. Employee device permission is not treated as unlimited consent to monitoring.

Location limitation

Field, store or hotel location features are restricted to active shifts, standby responses or explicit emergency actions. They stop at clock-out and must not be used for unrelated off-duty surveillance. Device and connectivity restrictions may create incomplete readings.

Sharing, retention and international processing

Information is shared only with authorised Tenant users, contracted infrastructure and service providers, professional advisers, or authorities where legally required. Subprocessors must be bound by data-protection obligations and international transfers require a valid GDPR safeguard. Acceptance evidence is immutable and may be retained for contractual limitation periods and legal accountability. Other records follow the Tenant's instructions and applicable statutory retention.

Security and breach handling

Appropriate access controls, tenant isolation, transport security and audit safeguards are applied proportionately. No system is guaranteed risk-free. Confirmed personal-data breaches are handled under the GDPR and Malta's Data Protection Act, including notification duties where applicable.

Your rights and Malta supervision

Subject to legal conditions, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent where processing relies on it. Contact the Tenant for operational or employment records and the Platform privacy contact shown on its public legal page for Platform-controlled processing. You may complain to Malta's Information and Data Protection Commissioner (IDPC), without prejudice to another competent EU supervisory authority.

This notice is governed by the GDPR, Malta's Data Protection Act (Chapter 586), and applicable laws of Malta.