Introduction
Welcome to Trak Events Ltd’s (“Trak”, “we”, “us”, “our”) privacy policy.
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information about who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
In short: we use your data to run Trak for you and your organisation. We do not sell it, we do not use it for advertising, and we do not track you across other companies’ apps or websites.
This policy covers the Trak app and the Trak web platform. The Trak website and our early-access and discovery forms have their own privacy notice.
Who is responsible for your data
Trak Events Ltd is a software developer. We build the Trak app and platform, and organisations that run events subscribe to them (each a “Subscriber”) to manage their workforce and operations. In this policy, “your organisation” means the Subscriber you work for, work with or have applied to. Trak Events Ltd is registered in England and Wales (company number 17173183), with its registered office at 66 Paul Street, London EC2A 4NA, United Kingdom.
When your organisation is the controller
If you use Trak because you work for or with a Subscriber, or have applied to one, your organisation is the data controller of the personal data it holds about you in Trak, such as your shifts, pay, right to work documents and employment records. It decides why and how that data is used, and we act as its processor. Our legal obligations as a processor are set out in our subscription terms with the relevant Subscriber. Your organisation’s own privacy policy explains how it uses your data. Where it has provided one, you can find it under Help in the Trak app.
When Trak is the controller
Trak Events Ltd is the data controller and is responsible for certain personal data that we collect and use to run our own business: to operate and protect the Trak app and platform, to provide support, and to manage our relationships with Subscribers and suppliers.
Contact us
If you have any questions about this policy or about how we handle your data, please contact us:
Email: tom@trak.events
You have the right to make a complaint at any time to the UK regulator for data protection issues, the Information Commissioner’s Office (ICO). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
It is important that the personal data we hold about you is accurate and current. Please keep us or your organisation informed if your personal data changes during your relationship with us.
We keep our privacy policy under regular review. If we make a significant change, we will tell you in the app or by email. This version was last updated in November 2026.
Account deletion
You can request deletion of your Trak account and associated personal data at any time, from inside the app. You do not need to phone or email anyone.
Request account deletion
In the app: open your Profile settings, choose Account Deletion, then Request deletion, and confirm. Your organisation’s team reviews the request, and your access to the app ends when you submit it.
If you can no longer sign in: email tom@trak.events.
If you email us, please use the subject line Account Deletion Request and include the name, email address, and phone number linked to your Trak app account so we can identify your account securely.
What we delete
Once the request has been verified, we will delete or anonymise personal data linked to your app account where we are legally permitted to do so, and deactivate the app account. This may include your app login, app profile information, active sessions, device notification tokens, and optional app data that is no longer needed for operational, legal, payroll, tax, safety, or contractual reasons. This includes content you added that was shared with others, such as photos and text, unless it must be kept for a reason below.
Data that may need to be kept
Some records may need to be retained after an account deletion request where we or your organisation have a legal or legitimate business requirement. This can include payroll and tax records, right to work checks, shift and attendance records, incident or health and safety reports, financial records, fraud prevention records, and records required to resolve disputes or comply with employment, tax, safety, or regulatory obligations.
Where data must be retained, it will be restricted to the purpose required and kept only for as long as necessary.
Timing
We aim to acknowledge account deletion requests within one business day and complete eligible deletion requests within 30 days, subject to identity verification and any legal retention requirements. We will confirm by email when the deletion is complete, and tell you if any information has to be kept.
Third-party links
The Trak app and platform may include links to third-party websites, plug-ins and applications, including links added by your organisation. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave Trak, we encourage you to read the privacy policy of every website you visit.
Third-party apps, websites and services
If you use any third party apps, websites or services to access our services, your usage is subject to the relevant third party’s terms and conditions, cookies policy, and privacy policy. For example, if you add a pass to a digital wallet on your phone, your use is subject to the terms and privacy policy of its provider.
The data we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows. The data held about you depends on how your organisation uses Trak.
Workers and staff
- Identity Data: full name, date of birth, profile photo, right to work documentation, National Insurance number
- Contact Data: email address, phone number, residential address
- Financial Data: bank account details for payroll, and expense and daily allowance (per diem) claims with their receipts
- Employment Data: role, pay rate, shift records, attendance history, payslips and P45s, training and licence records, signatures on authorisation forms, ratings and written feedback, appraisal notes and goals, and the feedback you give about jobs you have worked
- Self-employment Data (self-employed crew only): business name and address, VAT number if you are VAT registered, and the invoices you send
- Travel Data: journeys, accommodation bookings and room allocations for events away from home, and the first part of your home postcode (the postcode district) to estimate travel
- Technical Data: app login information, account and device identifiers, device notification tokens, crash and performance reports linked to your account ID, and QR code check-in records
- Work Content: photos, documents, text and voice notes you choose to add in the app, such as task photos, delivery notes and event debriefs
- Business Card Data: the name, job title, photo and contact details on a digital business card, which can be seen by anyone you or your organisation share it with
- Referral Data: the name and email address of someone you choose to refer, and your referral and reward records
- Health and Safety Data: information recorded through the digital incident report form relating to workplace accidents, incidents, injuries or near misses, which may include details of the event, individuals involved, witnesses and any injury or medical treatment reported
Subscribers and their clients
- Identity Data: name, job title and company
- Contact Data: email address and telephone number
- Commercial Data: subscription details, service arrangements and invoicing information
Suppliers and contractors
- Identity Data: name, company and key contact details
- Contact Data: email address and telephone number
- Financial Data: bank details and payment records
Job applicants to a Subscriber
- Identity Data: name, address and CV information
- Contact Data: email address and telephone number
- Employment Data: work history, qualifications and references
Device permissions, location and biometrics
The app asks your permission before using your camera or microphone, and uses them only when you choose a feature that needs them. The camera scans QR codes and takes photos of tasks, delivery notes, documents and your headshot. The microphone records event debrief voice notes.
Trak does not use GPS or live location. If you turn on Face ID, it is handled by your device and we never receive your biometric data.
Children
Trak is for people working in events. It is not intended for anyone under 16, and we do not knowingly collect their data.
Special categories of personal data
We do not routinely collect Special Categories of Personal Data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data). However, in limited circumstances information about your health may be recorded where this is necessary for health and safety purposes, such as when recording or investigating a workplace accident, incident or near miss through digital incident reporting. We do not collect information about criminal convictions and offences unless this becomes necessary for legal or regulatory reasons, in which case it will be processed in accordance with applicable data protection laws.
If you fail to provide personal data
Where personal data is needed by law, or under the terms of a contract, and you fail to provide that data when requested, we or your organisation may not be able to perform that contract or provide you with the services.
How is your personal data collected?
We use different methods to collect data from and about you including through:
- Direct interactions: you provide personal data directly during onboarding and registration, when you add information, photos, documents or voice notes in the Trak app, or when you communicate with us or your organisation.
- Your organisation: your organisation may add or import information about you, including information it received from recruitment platforms or staffing agencies.
- Business communications: Subscriber, supplier and contractor information is generally collected through email correspondence, meetings, contracts and onboarding documentation.
- Other people using Trak: managers and colleagues may add information about you, such as ratings, attendance, incident reports or a referral.
- App and platform technologies: the Trak app and platform collect limited technical information as you use them, such as crash and performance reports.
How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you or your organisation.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal obligation.
- In limited circumstances where you have given your consent.
Where we act as a processor, we use your personal data only on the instructions of your organisation.
Purposes for which your personal data is used
We have set out below, in a table format, a description of the ways personal data is used in Trak, and the legal bases relied on to do so. We have also identified the legitimate interests where appropriate.
Note that personal data may be processed for more than one lawful ground depending on the specific purpose for which it is being used. Please contact us if you need details about the specific legal ground being relied on where more than one ground has been set out in the tables below.
Where Trak is the controller
| Purpose / Activity | Type of Data | Lawful Basis |
|---|---|---|
| Providing the Trak platform and app to Subscribers, and managing our relationships with Subscribers | Identity, Contact, Commercial, Technical | Performance of a contract; Legitimate interests in maintaining commercial relationships and managing business operations |
| Managing relationships with our own suppliers and contractors | Identity, Contact, Commercial, Financial | Performance of a contract; Legitimate interests in maintaining commercial relationships and managing business operations |
| Managing our internal systems and the Trak app and platform, including keeping accounts secure | Technical, Identity, Contact | Legitimate interests in operating secure workforce management systems, monitoring system usage and maintaining operational efficiency |
| Providing support and responding to questions and requests | Identity, Contact, Technical | Legitimate interests in helping people use Trak and resolving problems |
| Administering and protecting our business and the Trak app and platform (including troubleshooting, crash reporting, data analysis, testing, system maintenance, support, reporting and hosting of data) | Identity, Contact, Technical | Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise); Necessary to comply with a legal obligation |
| To use data analytics to improve the Trak app and platform | Technical | Necessary for our legitimate interests (to keep our products updated and relevant and to develop our business) |
| Complying with legal and regulatory obligations | Identity, Contact, Commercial, Financial | Compliance with legal obligations including tax regulations and other regulatory duties |
Where we act as a processor for your organisation
Your organisation is the controller for these purposes and decides which it uses and which lawful basis applies. The table shows those most commonly relied on, and your organisation’s own privacy policy has the details.
| Purpose / Activity | Type of Data | Lawful Basis |
|---|---|---|
| Recruiting and onboarding workers and staff | Identity, Contact, Employment | Performance of a contract; Legitimate interests in recruiting and managing suitable staff for event operations |
| Verifying identity and right to work | Identity (including right to work documentation, date of birth, National Insurance number) | Compliance with a legal obligation under UK immigration and employment legislation |
| Scheduling staff and managing workforce operations | Identity, Contact, Employment, Technical (app login data, QR check-in records) | Performance of a contract; Legitimate interests in managing staffing logistics, shift allocation and operational delivery of events |
| Administering payroll and payments | Identity, Financial, Employment | Performance of a contract; Compliance with legal obligations relating to tax, payroll and financial record-keeping |
| Preparing, checking and paying invoices from self-employed crew, including reminders to send them | Identity, Contact, Self-employment, Financial, Employment (approved shift hours and rates) | Performance of a contract; Compliance with legal obligations relating to tax, VAT and financial record-keeping |
| Setting daily allowances (per diems) for crew working away and processing expense and allowance claims | Identity, Financial, Employment | Performance of a contract; Compliance with legal obligations relating to tax and financial record-keeping |
| Planning travel and accommodation for crew working away, including estimating how far you live from an event | Identity, Contact, Employment, Travel. Distance is estimated from your postcode district only; no GPS or live location is used. | Performance of a contract; Legitimate interests in arranging safe and reasonable travel and accommodation for crew |
| Recording performance ratings and feedback, running appraisals, sharing written feedback with you once it has been approved, and asking for your feedback about jobs you have worked | Identity, Employment | Legitimate interests in managing performance, supporting staff development and making fair staffing decisions |
| Measuring the carbon footprint of events, including estimated staff travel | Employment (shift locations), your postcode district and any optional travel answers you give in the app. Results are reported only as totals, and groups of fewer than five people are never shown separately. No GPS or live location is used. | Legitimate interests in measuring and reducing the environmental impact of events and meeting client reporting expectations |
| Delivering and coordinating event services and operational teams | Identity, Contact, Employment | Performance of a contract; Legitimate interests in delivering event services and coordinating staff and operational teams |
| Sharing event-specific rota information with authorised client representatives and event operational partners for staffing coordination and verification | Identity and Employment data, including name, profile photo (unless you have asked for it not to be shared), assigned role, work location and shift or attendance times. Financial information, pay rates and internal approval records are not included. | Necessary for legitimate interests in delivering staffing services, coordinating event operations and enabling authorised recipients to verify staffing and attendance. Access is restricted using event-specific, time-limited and revocable email links. You can object to your photo being shown to clients at any time by contacting your organisation or, where available, using the photo setting in your app profile; it then stops being shown in every client view. |
| Recording, managing and investigating workplace accidents, incidents and near misses, including completing and maintaining digital incident reports and complying with health and safety and reporting obligations | Identity, Contact, Employment, Health and Safety Data | Compliance with a legal obligation under UK health and safety legislation. Article 9(2)(b) – Employment law obligations; and/or Article 9(2)(g) – Substantial public interest, including health and safety at work, may also apply |
| Collecting signatures on authorisation forms for work at licensed premises | Identity, Employment | Compliance with a legal obligation under licensing legislation; Legitimate interests in operating licensed premises lawfully |
| Providing digital business cards and wallet passes | Business Card Data, Identity, Contact | Legitimate interests in helping staff share professional contact details and prove who they work for |
| Running referrals and rewards | Identity, Contact, Referral Data | Legitimate interests in recruiting suitable staff and rewarding referrals |
| Complying with legal and regulatory obligations | Identity, Contact, Employment, Financial | Compliance with legal obligations including employment law, tax regulations, health and safety requirements and other regulatory duties |
Use of AI tools
The Trak app can turn an event debrief voice note into text using a third-party AI service. If you choose this, your recording is sent to that service. The app asks your explicit permission each time before sending a recording, and you can type your notes instead.
We may also use AI tools to support our services (e.g., drafting written material or supporting software development). We may need to share personal data with these providers in order to provide our services, however, these tools:
- Operate under human oversight
- Do not make fully automated decisions about you
- Are used to generate insights and recommendations only
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us: tom@trak.events
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosures of your personal data
We may share your personal data with the parties set out below for the purposes set out in the tables above:
- Your organisation, and the people it authorises to use Trak.
- Authorised representatives of a Subscriber’s clients, venues and event operational partners, where your organisation gives them access to limited event-specific rota information to coordinate staffing or verify attendance and working hours. The information disclosed is limited to what is necessary for that event and uses time-limited, revocable access controls.
- Service providers acting as processors who provide services such as IT and system administration, data storage and hosting, payment processing, email and text messaging, push notifications and digital wallet passes, crash reporting, and turning voice notes into text. This includes software built into the app for functions such as crash reporting. You can ask us for details of the specific providers.
- Payroll and accounting services that a Subscriber chooses to connect to Trak.
- Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
- HM Revenue & Customs, regulators and other authorities based in the United Kingdom.
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
We require all third parties, including service providers, software built into the app and any related entities that have access to your personal data, to provide the same or equal protection of your personal data as set out in this policy, and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We do not sell your personal data, share it with data brokers or advertising networks, or use it for advertising. We do not track you across other companies’ apps or websites.
International transfers
It is sometimes necessary for us to transfer your personal data to countries outside the UK. In those cases we will comply with applicable UK laws designed to ensure the privacy of your personal data.
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
- Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.
Please contact us at tom@trak.events if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you, your organisation and any applicable regulator of a breach where we are legally required to do so.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. Where we act as a processor, we keep data as instructed by your organisation and in line with our subscription terms.
If you request account deletion, we aim to complete it within 30 days, as set out in Account deletion. When a Subscriber’s subscription ends, its data is deleted or returned within 30 days, unless the law requires it to be kept.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Details of retention periods for different aspects of your personal data are available from us by contacting us: tom@trak.events
Withdrawing consent and your choices
You can withdraw consent or change your choices at any time:
- Camera, microphone, Face ID and notifications: turn these on or off in your phone’s settings or the app’s settings. Turning one off only affects the feature that uses it.
- Voice note transcription: the app asks each time before sending a recording. Say no, or type your notes instead.
- Your photo in client views: use the photo setting in your app profile, where available, or contact your organisation.
- Your data: request account deletion in the app, or contact tom@trak.events about any of your rights below.
Withdrawing consent does not affect processing carried out before you withdrew it.
Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of these rights please contact us: tom@trak.events. Where your request is about data your organisation controls, please contact your organisation. If you contact us first, we will pass your request to them or tell you how to reach them.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Your rights include
- Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: if you want us to establish the data’s accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.