Privacy Policy

Last updated: 8 July 2026

1. Who we are

DWMPulse is an internal HR and operations application for Your DWM Limited ("DWM", "we", "us"), a UK-registered company. This policy explains how we handle personal data processed through DWMPulse, including data accessed via connected third-party services such as Google Calendar.

For the purposes of the UK GDPR and the Data Protection Act 2018, DWM is the data controller for personal data processed through DWMPulse.

2. What data we hold about you

As part of employing you, we hold and process:

• Identity and contact data: name, preferred name, date of birth, home address, personal and work email addresses, phone numbers, National Insurance number, nationality.
• Employment data: job title, department, line manager, contract type, start date, employment history, salary and pay banding, working hours, leave entitlement, notice period.
• Records of work: shifts, leave requests, absence records, work-from-home records, performance recognitions, disciplinary records where applicable.
• Documents: contracts, right-to-work documents, disciplinary paperwork, signed forms, and any files you upload to your own profile.
• Emergency contact details you provide.
• Login and audit records: login times, IP addresses, and an audit log of significant actions taken in the system.

This data is used to administer your employment and comply with our legal obligations as your employer.

3. Google Calendar integration

If you choose to connect your Google Calendar to DWMPulse:

• What we access: we only ever create, update, and delete events that DWMPulse itself has added. We use Google's calendar.events.owned scope, which technically cannot see or modify any other event in your calendar. We do not read your existing calendar entries. We also read your Google email address once (via the userinfo.email scope) purely to display "Connected as ..." on your profile — we do not read any other profile information.
• What we create: events representing your approved leave, recorded absences, approved WFH-bank days, and shifts assigned to you in DWMPulse.
• What we store: an encrypted refresh token that lets DWMPulse write events to your calendar on your behalf. The token is stored in our database using AES-256-GCM encryption. We do not store your Google password.
• How to disconnect: go to your profile in DWMPulse and click "Disconnect Google Calendar" at any time. When you disconnect, we delete your refresh token from our database. Events DWMPulse has already added to your calendar remain in your calendar unless you delete them yourself.
• What we do not do: we do not share Google Calendar data with any third party, we do not use it for advertising, we do not train any machine-learning models on it, and we do not process it for any purpose other than the specific calendar entries you've enabled.

4. How we protect your data

• Personal data classified as sensitive (National Insurance number, salary, home address, emergency contacts, comments) is encrypted at rest in our database using AES-256-GCM.
• The Google Calendar refresh token is encrypted using the same scheme.
• Uploaded documents in sensitive categories (contracts, investigations, complaints) are encrypted at rest on disk.
• Access is controlled by role-based permissions. Administrators and line managers see only what they need for their role. System-level administrators (Superadmin) are deliberately blocked from seeing HR-sensitive data on other employees.
• All web traffic uses HTTPS with modern TLS.
• We maintain an audit log of significant actions taken in the system.

5. Data retention

• While you are employed: we retain your data for the duration of your employment.
• After you leave: employment records are retained for 6 years after your employment ends, in line with HMRC and pension-scheme requirements. Records may be anonymised earlier on request, subject to legal retention obligations.
• Google Calendar tokens: deleted immediately when you disconnect or when we lose access (e.g. you revoke access from your Google account settings).

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you. You can export a copy of your own data at any time from your profile page ("Export My Data").
• Rectify inaccurate data (correct it via your profile or ask HR).
• Erasure — request deletion of your data, subject to our legal retention obligations.
• Restriction or objection to certain processing.
• Complain to the Information Commissioner's Office (ICO) at https://ico.org.uk.

7. Cookies

DWMPulse uses a single session cookie (PHPSESSID) to keep you signed in. Optionally, if you tick "Remember me" at login, we set a second cookie that keeps you signed in for 7 days. We do not use any third-party analytics, advertising, or tracking cookies.

8. Third-party services

• Amazon Simple Email Service (SES) — sends notification emails on our behalf. Your work email address is transmitted to SES for this purpose.
• Google Calendar — as described above, only if you choose to connect it.

We do not sell or share your personal data with any other third parties, except where required by law.

9. Contact

Questions about this policy, or to exercise any of your rights above:

Email: hr@dwmas.co.uk
Post:
Top Floor
3–5 St Paul's Square
Birmingham
B3 1QU