Administrator Privacy Policy

Product: TopTimePro Admin Panel & Mobile App | Last Updated: March 2026

This Privacy Policy ("Policy") explains how Topform Technologies ("we," "us," or "our") collects, uses, stores, and protects data in connection with your use of the TopTimePro Administrator Dashboard (web panel) and the TopTime Admin Mobile Application.

As an administrator, you occupy a dual role: you are both a data subject (your own account data is processed by us) and a data processor or controller on behalf of your organisation (you process employee data through the platform). This Policy addresses both roles.

        Important: Your organisation (the Subscriber) is independently responsible for ensuring that the personal data of employees processed through this platform complies with applicable data protection laws, including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL).
    

1. Data We Collect About You (as an Administrator)

When you use the Admin App or web panel, we may collect:

Account Information: Your name, email address, password (hashed), job role, and company association.
Session & Authentication Data: Login timestamps, access tokens, device identifiers, and IP addresses.
Device Information (Admin App): Device model, OS version, Firebase Cloud Messaging (FCM) token for push notifications, and Android device ID for session binding.
Usage & Audit Logs: All significant administrative actions you perform (e.g., payroll approvals, attendance corrections, role changes) are logged with timestamps for security and compliance purposes.
Terms Acceptance: The date and time you accepted these Terms and this Privacy Policy, stored as terms_accepted_at in our database.

2. Employee Data You Access Through the Platform

As an administrator, you will access and process personal data belonging to employees. This data includes, but is not limited to:

Personal identifiers (name, employee code, national ID, passport details)
Contact information (phone, email, emergency contacts)
Employment records (department, designation, store, contract type, joining date)
Attendance and biometric data (clock-in/out times, device logs, shift records)
Payroll and financial data (salary components, bank details, payslips, deductions)
Leave records and balances
HR documents (offer letters, employment contracts, uploaded files)
Performance and project assignments

You are a Data Processor. You access this data on behalf of your organisation. You must not use it for any purpose outside of legitimate business operations, must not share it with unauthorised parties, and must handle it in accordance with your organisation's data protection policies and applicable UAE law.

3. How We Use Your Administrator Data

Authentication & Access Control: To verify your identity, manage your session, and enforce role-based permissions.
Security & Audit: To detect and investigate unauthorised access, fraud, or misuse of the platform through audit logs.
Push Notifications: Your FCM token is used to deliver real-time alerts (e.g., approval requests, attendance flags, system alerts) to the Admin App.
Service & Support: To troubleshoot technical issues and provide customer support.
Compliance: To maintain records required for legal obligations and contractual commitments to your organisation.

4. Legal Basis for Processing

We process your administrator data under the following legal bases:

Contractual Necessity: Processing is necessary to provide the platform services under the agreement with your organisation.
Legitimate Interests: Audit logging and security monitoring are in our legitimate interest and that of your organisation.
Legal Obligation: Certain records are maintained to comply with applicable UAE laws.
Consent: By accepting these Terms, you consent to the collection and use of your account and device data as described.

5. Data Retention

Your administrator account data is retained for the duration of your organisation's active subscription, plus an additional period of up to 2 years for audit and compliance purposes.
Audit logs may be retained for up to 5 years depending on contractual obligations.
Upon termination of the subscription, data may be purged in accordance with our Data Retention Policy or exported to the Subscriber upon request.

6. Data Security

We implement industry-standard technical and organisational measures to protect administrator and employee data, including:

HTTPS/TLS encryption for all data in transit
Encrypted storage for sensitive fields (passwords are bcrypt-hashed)
Role-based access control (RBAC) to limit data exposure
Firebase authentication tokens for secure push notification delivery
Regular security reviews and server hardening

While we take all reasonable precautions, no system is 100% secure. You are responsible for maintaining the security of your account credentials and devices.

7. Data Sharing

We do not sell your data. We may share data with:

Your Organisation (the Subscriber): Your account activity is visible to your organisation's primary account holder.
Infrastructure Providers: Hosting and database providers who process data on our behalf under strict data processing agreements.
Firebase (Google): Used for push notification delivery. FCM tokens are shared with Firebase as necessary.
Legal Authorities: If required by law, court order, or to protect against fraud or harm.

8. Your Rights (as an Individual Data Subject)

In relation to your own administrator account data, you have the right to:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate data (your profile can also be updated directly in the Admin App or web panel).
Deletion: Request deletion of your data, subject to legal retention obligations.
Portability: Request your data in a structured, machine-readable format where applicable.
Objection: Object to processing based on legitimate interests.

To exercise these rights, contact us at [email protected].

9. Cookies & Tracking (Web Panel)

The web admin panel uses session cookies to maintain your login session. These are essential cookies and cannot be disabled without preventing access to the platform. No third-party advertising or tracking cookies are used within the administrator panel.

10. Children's Data

The TopTimePro Admin Platform is not intended for use by individuals under the age of 18. If you have reason to believe a minor has been granted admin access, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Continued use of the platform after changes are posted constitutes acceptance. Significant changes will be communicated via the platform or email.

12. Contact & Data Protection Enquiries

For privacy-related enquiries or to exercise your rights:
Email: [email protected]
Website: https://toptimepro.com