Privacy Policy

This policy explains what data the GearDock service ("we", operated by [LEGAL_ENTITY], [REG_ADDRESS]) stores, when, where, and what your rights are.

Controller and processor roles

• For account and billing data (your registration details, subscription and invoices) we are the data controller.
• For the data you enter into your companies (tenants) — employees, assets, assignments, requests, uploads — your organisation is the controller and we act as processor on your documented instructions.

What we store

• Account & billing details — account name, owner, billing email, country, VAT ID, subscription state. Card details are held by Stripe, never by us.
• Tenant/company records — company names, branding, IT contact details, public-page settings.
• Employee records — name, email, phone, department, position.
• Asset records — make, model, serial numbers, specifications, purchase and warranty data, and OS/licence keys. Keys are encrypted at rest, masked in the interface, and every reveal is written to the audit log.
• Assignment history — who held which asset, when, handover conditions and notes.
• Equipment requests — requester, justification, decisions.
• Uploaded media — asset photos, invoice scans, handover signatures.
• Activity/audit logs — actor, action, timestamp and change details for meaningful operations.
• Authentication & session data — login credentials (passwords hashed), sessions.

The public QR page

Each device carries a QR label linking to a public page that shows the device's type, model, serial number and status. If the tenant enables it, this page also displays the current holder's name and a contact channel so a found device can be returned. Tenants can instead show only a generic IT contact. The public page never shows specifications, prices, licence keys or history. Employers enabling holder display are responsible for informing their employees.

When data is collected

At registration (account, first company, admin user) and continuously during use, as your team creates and updates records. We do not buy, enrich or scrape data from third parties.

Where data is hosted, and sub-processors

Data is hosted on [HOSTING_LOCATION] servers. We use the following sub-processors:

• Hosting provider — [HOSTING_LOCATION] (infrastructure, backups).
• Stripe — payment processing and invoicing.
• Email provider — [CONTACT_EMAIL provider / transactional email service] (notifications, reminders).

Retention

Tenant data is retained while your account is active. After account closure, data is deleted within a defined retention window, except where invoices and billing records must be kept for statutory periods. Audit logs follow the same lifecycle as the tenant they belong to.

Your rights

Subject to GDPR and applicable law you may request access, export (inventory, history and procurement exports are built into the product), correction and deletion of personal data. Account owners can exercise these directly in the product or by writing to [CONTACT_EMAIL]. Employees whose data is managed by their employer should contact their employer (the controller); we support the employer in fulfilling such requests.

Cookies

We use essential cookies only (session, authentication, CSRF protection). If analytics are enabled, we use a privacy-friendly, cookieless service; no third-party tracking cookies are set without consent.

Contact

[LEGAL_ENTITY], [REG_ADDRESS] — [CONTACT_EMAIL]. Governing law: [GOVERNING_LAW/JURISDICTION].