Bluzen ACS Privacy Policy

Bluzen ACS is used by organisations (each a "Customer") to record and manage the attendance and site access of their workforce. For the workforce and attendance data held in the service, the Customer named on your sign-in screen decides why and how that data is collected and used. Bluzen processes it on the Customer's behalf and on its instructions, as a data intermediary under the PDPA, under a written contract with the Customer.

Bluzen is itself responsible for the personal data it needs in order to provide, secure and support the service: administrator account details, security and audit logs, and the correspondence we have with the Customer's staff.

If you are a worker, contractor or visitor whose attendance or access is recorded in the service, your employer or the organisation that runs the site is the right first point of contact about your records. We will refer any request we receive to them and help them respond.

Workforce records: name, employer and contractor company, position, an employee or contractor identifier, the sites and gates a person is entitled to use, and where the Customer records them, nationality, gender, date of birth, a national identity number, and a contact phone number and email address. The national identity number and contact details are encrypted.

Access credentials: card numbers and other credential identifiers issued to a person.

Attendance and access events: the time, place and reader at which a credential was presented, whether access was granted, and where the Customer uses the mobile application, the location reported by the device at the moment of clocking in or out. Location is captured only at that moment; the application does not track a person continuously.

The mobile application: when a person links their phone, the phone’s platform (iOS or Android), its model name, the version of the application, and the public half of a key the phone creates for itself. The private half of that key never leaves the phone. When the person clocks in or out, the code they scanned, the location the phone reported with its stated accuracy, and whether the phone reported that location as simulated, all kept with the attendance record. The location is shown to the person on their own day, and to the organisation’s staff who are permitted to review clock-ins. The camera is used only to read that code; no image is stored or sent. The application does not read the name the owner gave the phone, their contacts, photos or any other content of the phone, and it does not use location in the background.

Records imported from a previous system: the same categories, as the previous system stored them. Imported records are kept as published, marked as imported, and corrected alongside rather than overwritten.

Administrator accounts: name, work email address, role and permissions, second-factor enrolment (an authenticator application, a passkey, or a phone number where the Customer enables one-time codes), and sign-in history.

Security and audit logs: an append-only record of each administrative action and sign-in, including the network address and browser it came from, and an approximate location derived from that address using a database held on our own systems, so the address is not sent to a third party for lookup.

The service does not collect biometric identifiers. See section 10.

To record attendance and site access and to produce the attendance, headcount and access reports the Customer configures; to control which people may pass which gates; to administer the Customer’s workforce records; and to keep an accurate history of those records, including corrections.

To operate the service: to authenticate administrators, to secure accounts against unauthorised access, to detect and investigate misuse, to send transactional emails such as account invitations, password resets and security alerts, and to provide support.

To meet our legal obligations, including under the PDPA, and to establish, exercise or defend legal claims.

We do not use personal data in the service for marketing, profiling or advertising, and we do not sell it.

Workforce and attendance data is collected and used by the Customer on the basis that applies to it under the PDPA and, where the workforce is outside Singapore, the data protection law of that place. That basis is ordinarily the consent of the individual, the deemed consent that arises when a person provides data for a purpose that has been notified to them, or the exceptions the PDPA provides for managing or terminating an employment relationship and for legitimate interests such as site security, subject to the safeguards those exceptions require. The Customer is responsible for giving its workforce the notices the law requires.

Bluzen processes administrator account data and security logs on the basis that it is necessary to provide the service the Customer has contracted for and to protect the service and its users, and, for security logging, on the basis of the PDPA's legitimate-interests exception.

Personal data is encrypted at rest at the field level (AES-256-GCM) with keys held in a managed key and secrets store separate from the database. Where a value must be searched, the search uses a keyed hash rather than the value itself. Data in transit is encrypted with TLS.

Every administrative action is authorised against an explicit access policy before it runs, and is denied by default. Access is scoped to a single Customer at the query layer, so one Customer’s data cannot be read from another’s account.

The audit log is append-only, and the network address and browser it stores are themselves encrypted. Administrator sessions use secure, encrypted cookies. Our own staff have access to Customer data only when a Customer asks us for support or when we need it to keep the service running, and every such access is recorded.

We design and operate Bluzen ACS to the standard of ISO/IEC 27001 and Singapore's Data Protection Trustmark, and we review our measures regularly against them.

We use the following providers to run the service. Each processes personal data only on our instructions, under a written contract, and does not use it for its own purposes: Naver Cloud Platform (compute, database and object storage, Singapore region); Amazon Web Services (management of encryption keys and secrets, and email delivery); Google Maps Platform, which draws the maps in the service and in the mobile application and so receives the area being shown and the address searched for, under Google’s own terms; and, where the Customer enables one-time codes by SMS, an SMS delivery provider named in the Customer Agreement.

We disclose personal data to no one else, except to the Customer it belongs to, to our professional advisers under a duty of confidence, where the law requires it or a competent authority lawfully demands it, or where it is necessary to protect the rights, property or safety of any person.

The service, its database and its backups are hosted in Singapore. Encryption keys and secrets are held by Amazon Web Services and may be stored outside Singapore. The people whose data the service records may be located in another country, which means their personal data is transferred to Singapore for processing.

Where personal data is transferred out of Singapore, we do so in accordance with the PDPA’s transfer limitation obligation, ensuring by contract that the recipient provides a standard of protection comparable to the PDPA. Where personal data is transferred into Singapore from another country, the Customer is responsible for the lawfulness of that transfer under the law of that country, and we support it under the Customer Agreement.

Attendance and access records are kept online for one year from the date of the event, and in archival storage for a further two years, so that the reporting the Customer relies on stays reproducible. Beyond that period, records are kept only for as long as the Customer instructs or the law requires.

Workforce records and credentials are kept for as long as the person is on the Customer’s register, and afterwards for as long as the attendance records that refer to them. Administrator accounts are kept while the account is active and for a reasonable period after it is closed, so that the audit log remains attributable.

Security and audit logs are kept for the life of the Customer’s service and thereafter for as long as our legal, regulatory and audit obligations require.

When a Customer leaves the service, its data is exported to it on request; the export archive is available for thirty days. The Customer’s data is then deleted from the service and, within the normal backup cycle, from backups, except where we are required by law to keep it.

We do not keep personal data in a form that identifies a person for longer than these purposes require.

Under the PDPA you may ask for access to the personal data we hold about you and for information about how it has been used or disclosed in the past year; you may ask us to correct an error or omission; and you may withdraw any consent you have given, on reasonable notice, although withdrawing consent may mean the Customer can no longer record your attendance or grant you site access. Where the law of another country gives you additional rights, such as a right to object to processing or to erasure, you may exercise them against the Customer.

Requests should be made to the Customer where the data concerns your attendance, access or workforce record, and to our Data Protection Officer at dpo@bluzen.com where it concerns an administrator account or our own processing. We will respond, or tell you how long we need, within thirty days of receiving a request, and we may ask you to verify your identity first.

Asking for your data to be deleted. In the mobile application, Remove this phone (on the Profile page) ends the phone’s link to the service straight away and deletes the link details stored on the phone. To ask for your attendance, access or workforce record itself to be deleted, contact the organisation that registered you (your employer or the organisation that runs the site), or write to our Data Protection Officer at dpo@bluzen.com, who will pass the request to that organisation and help it respond. Records the organisation must keep by law, or for the periods in section 8, may be retained; if anything is kept, you will be told what and why.

If you are not satisfied with how a request has been handled, you may complain to the Personal Data Protection Commission of Singapore, or to the data protection authority of the country whose law applies to you.

The service does not use biometric identification. Attendance is recorded by a card or other credential presented at a reader, or by the mobile application where the Customer uses it. Biometric templates are not collected, stored or sent to any reader.

Unlocking the mobile application with a fingerprint or face on your own phone is a function of your device; no biometric data reaches the service.

If a Customer were to ask for a biometric method in future, it would be a different category of personal data with stricter obligations. This policy would be revised, and the affected people notified, before any such method was enabled.

The service sets a session cookie that keeps you signed in, and stores your interface preferences, such as language, in your browser. These are necessary for the service to work. We do not use advertising or third-party analytics cookies.

The mobile application keeps its link to the service in the phone’s secure storage, and its settings, such as appearance and whether it asks for the phone’s unlock, on the phone. It contains no advertising or third-party analytics.

If we become aware of a breach of security affecting personal data in the service, we will assess it without delay and tell the affected Customer as soon as practicable, with the information they need to meet their own obligations. Where a breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission within three calendar days of assessing that it is, and the affected individuals where the breach is likely to result in significant harm to them, in each case in consultation with the Customer.

We may update this policy from time to time. The date at the top records the last revision. Material changes will be notified to Customers before they take effect. The English version of this policy is authoritative.

Our Data Protection Officer can be reached at dpo@bluzen.com. General enquiries: app.support@bluzen.com. Bluzen Pte. Ltd., Singapore.