Privacy policy

Who we are

HyneSite is a William Hynes Group company. For the personal data described here, the legal entity behind HyneSite acts as the controller for this website and acts as a processor for our clients' workforce data, checked at their gates. Our details (registered name, company number, registered office and ICO registration) are To confirm and will be listed here before launch.

Our clients: construction and energy companies and their contractors. When one of them uses HyneSite, they remain responsible for their workers' data and decide how long to keep right-to-work records; we carry out the checks and keep the records on their instructions.

Face checks: the photo isn't kept

A worker's face is their way through the gate, and it is special category data under UK GDPR. We handle it with the narrowest process we could build:

• Consent first. No face is enrolled without the worker's consent, given on the gate tablet at induction or to a site manager in the portal. The consent record keeps the notice the worker saw and the legal basis.
• The photo is used once. A photo taken at induction or in the portal is turned into a face template, a set of numbers, and then discarded. HyneSite does not keep the photo.
• Only a reference is stored. HyneSite stores a reference to the template. The template itself is held by Amazon Rekognition in its London region, for that client only, and never leaves it.
• There is always a way without a face. Anyone can sign in by name at the gate instead. The notice workers see says plainly that saying no will not affect their work.

Right-to-work checks with Yoti

Where a client switches it on, a worker can check their right to work on the gate tablet with Yoti IDV, a certified right-to-work provider on the UK government's register. It's their choice: anyone can show their documents to a site manager instead.

• What Yoti checks. The worker photographs their UK or Irish passport, or gives their Home Office share code and photographs a photo ID. Yoti takes a short video of their face to check they're really there, and matches it to the photo on their document. For a share code, Yoti also fetches their record from the Home Office. Matching faces is biometric processing, like face sign-in.
• What we keep. Yoti's signed report, the photos of the document, the live photo Yoti took and, for a share code, the Home Office result. Unlike face sign-in photos, these are kept: they're the client's right-to-work evidence, which the Home Office asks employers to keep, and they're kept and deleted like any other (below).
• Yoti's copy. We delete each check at Yoti as soon as we've copied it, and ask Yoti to delete its images within a week in any case. Yoti's identity verification privacy notice explains its side.
• Tying it to face sign-in. If the worker uses face sign-in, we compare their face template once with the live photo Yoti took, in Amazon's London region, to confirm the person Yoti checked is the person who signs in at the gate. Amazon doesn't keep the photo; we record how alike the two were.
• When no one needs to look. If Yoti's check of a UK or Irish passport passed, the name and date of birth match what the worker typed, and the faces match, the check is recorded without anyone reviewing it. Every share code, and any check that doesn't line up, goes to a site manager. Nobody is turned down automatically: a check that can't be accepted goes to a person.

What else we hold

• Right-to-work records. A worker's name, right-to-work status and the evidence behind it, so our clients can meet their legal duty to check. The employer's duty here is the client's; we keep the record for them.
• Gate activity. Who signed in at which gate and when, so sites know who is on site.
• Account details. Names, work emails and roles for the client staff who run HyneSite, and the audit trail of changes made in it.

Where it's held

The database and stored files are kept in the UK (London). Faces are matched in Amazon's London region. Digital right-to-work checks are made by Yoti, which says it keeps the data in its UK data centres: our sub-processors page has the detail. Emails we send, such as invitations and daily summaries, go through Resend, which keeps its records in the US under UK GDPR safeguards.

How long we keep it

Deletion is automatic, every night, not a promise on a slide:

• Face templates go straight away if consent is withdrawn, overnight when the worker leaves, and after 12 months without a sign-in.
• Right-to-work records are kept while the worker is engaged, then for the client's retention period: 2 years by default, the Home Office minimum, up to 6 years if the client chooses. Evidence files go first, then the records.
• Digital right-to-work checks are deleted at Yoti as soon as we've copied them. Our copy is right-to-work evidence, kept as above.
• Gate activity is kept for the client's retention period and cleared after it.
• The audit log is kept for six years, then cleared.

Who can see it

Four roles inside each client's workspace. Site managers and gate operators can be limited to their own sites' gates, tablets and activity. Right-to-work records and evidence files are visible to owners, admins and site managers only. Each client's data is kept separate in the database, and row-level security enforces that on every read.

Every change logged

The audit log shows who changed what, and when, naming the fields that changed but never their contents. Owners and admins can read it. Face consents record the notice the worker saw, so a client's data protection officer can see exactly what any worker agreed to.

The HyneSite app

The HyneSite app for iPhone, iPad and Android phones and tablets works with the same data as the portal, under the same rules. Two services help the app itself work:

• Notifications. If you allow notifications, your device gets a push token, which we store against your account so we can tell you when someone is waiting at one of your gates. Alerts go through Google's Firebase Cloud Messaging and Apple's push service, and include the worker's name and the site. Signing out removes it, and we stop using one that stops working.
• App updates. Fixes reach the app through Capgo, a service that delivers new versions of the app's screens without a trip to the app store. When it checks for an update, your device sends Capgo a random identifier for that install, the app and operating system versions, and whether an update installed. Capgo never sees your account or any workforce data, and the updates it delivers are encrypted so only the HyneSite app can open them.

The app has no advertising, no analytics and no location tracking, and nothing in it tracks you across other apps or websites.

This website

• Light or dark. Your choice of theme is remembered in your own browser. It never leaves your device.
• Book a demo. Details you send us through the demo form are used only to arrange your demo. We don't add you to a mailing list.
• Client portal and gate tablets. Signing in to the portal or pairing a tablet is a use of the HyneSite service, covered by the sections above and the client's own agreement with us.

Your rights

Under UK GDPR you can ask to see the personal data we hold about you, to correct it, to erase it, to object to or restrict how it is used, and to withdraw consent for face checks at any time. To exercise a right, contact the site's operator or our data protection contact: To confirm.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint.

Changes to this policy

We update this page when how we handle data changes, and the newest version always lives here.