ROC Teams log in

ROCteams Privacy & Data Protection Policy

Last Updated: August 11, 2026 v2026-08-11

1. Roles and Applicable Frameworks

1.1. U.S. Customers: For Customers and data subjects located in the United States, ROCteams LLC acts as a "Service Provider" (as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and comparable state privacy laws), and the Customer acts as the "Business." ROCteams processes Personal Information only to provide the Services and for no independent commercial purpose of its own. Customers with employees located in California should note that the CPRA extends CCPA-style rights to employees, not only consumers — this is directly relevant here, since the Service processes employee geolocation, timekeeping, and identity-verification data.

1.2. International / GDPR: To the extent applicable data protection law, including the General Data Protection Regulation (GDPR), applies to a Customer's use of the Service, the Customer acts as the "Data Controller" and ROCteams LLC acts as the "Data Processor." ROCteams shall process Personal Data only for the purposes of providing the Services as defined in the Service Agreement and under the documented instructions of the Customer.

2. Processing Scope and Data

ROCteams processes the following categories of Personal Data on Customer's behalf, solely as necessary to provide the workforce management services requested by the Customer. ROCteams shall not process such data for any independent commercial purpose.

  • Identity and employment data: name, contact information, employee ID, department, position, hire date, and employment status.
  • Sensitive identity data: Social Security Number (stored encrypted, with only the last four digits retained in a readable form for reference), date of birth, and home address, where a Customer chooses to collect these fields.
  • Timekeeping and location data: geolocation coordinates, timestamps, shift and schedule data, and clock-in/clock-out photographs captured for identity verification purposes.
  • Fleet and vehicle data: vehicle activity logs, mileage, and maintenance records, where the Customer uses fleet management features.
  • Payroll-related data: pay rates, timesheet data, and the external employee identifiers used to export timesheet data to a Customer-selected third-party payroll provider (such as Gusto, ADP RUN, or QuickBooks), where the Customer configures a payroll export integration.
  • Expense and card transaction data: merchant name, merchant category, transaction amount, and receipt photographs, where the Customer uses the Expense Wallet feature.
  • AI assistant prompts: natural-language text a Customer's authorized user submits to the platform's AI assistant feature, which may incidentally contain names, phone numbers, or other Personal Data the user includes in their own request. See Section 6.
  • Federated sign-in data: where a user chooses to sign in using a Google account, the Google account's email address, verified-email status, given and family name, and Google's stable account identifier, received from Google at sign-in for the sole purpose of authenticating that user. See Section 6A.

3. Sensitive Identity Data

3.1. Purpose: Where a Customer elects to collect Social Security Numbers, dates of birth, or home addresses, this data is used solely for the Customer's own HR, tax, and compliance recordkeeping purposes. Social Security Numbers are stored in encrypted form; access to unmasked sensitive HR fields within a Customer's organization is restricted by role-based permission and is off by default even for users with edit-level access to other HR data.

3.2. Clock-In/Clock-Out Photographs: The Service captures a photograph of the employee at clock-in and clock-out for identity-verification purposes. ROCteams does not currently perform automated biometric matching or facial-recognition analysis on these photographs; they are stored as image files associated with the corresponding timekeeping record. Customer represents and warrants that it has provided any notice, and obtained any consent, required under applicable law before enabling photo-based clock-in for its employees, including under any state biometric privacy statute that may apply to Customer's workforce.

4. Geolocation Data

4.1. Purpose: The platform utilizes real-time geolocation tracking to facilitate fleet management and workforce scheduling.

4.2. Customer Warranty: The Customer represents and warrants that it has obtained all necessary consents from its employees (the Data Subjects) to track their location through the ROCteams mobile application during work hours or as otherwise permitted by local law.

4.3. Minimized Processing: ROCteams commits to processing geolocation data only for the duration required to satisfy the specific workforce management task requested (e.g., active shift tracking) and will not use such data for any profiling or automated decision-making outside the scope of the Services.

5. Data Security and Integrity

ROCteams implements industry-standard technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256); Social Security Numbers are additionally encrypted at the application layer.
  • Access Control: Strict role-based access control (RBAC) ensures only authorized personnel at the Customer's organization can view fleet/employee location data, and unmasked sensitive HR fields (SSN, date of birth, home address, pay rate) require a separate, explicitly-granted permission.
  • Isolation: Infrastructure is logically isolated to prevent unauthorized access between tenant datasets (tenant-level isolation).
  • Auditing: Regular access control reviews and log-based auditing monitor administrative actions and modifications to sensitive data.

6. AI-Assisted Processing

The Service includes an optional AI assistant feature. When an authorized user submits a natural-language request, that text is transmitted to Google (Google Gemini) to be interpreted into a structured action; Google acts as a sub-processor for this limited purpose. Requests are parsed into a predefined, restricted set of actions and validated against the requesting user's actual permissions before anything is executed; any action that would modify Customer data is held for explicit human confirmation before it is applied — see the Terms of Service, Section 10. Customer should instruct its users not to include Social Security Numbers, financial account numbers, or other highly sensitive identifiers in free-text prompts to the AI assistant.

6A. Federated Sign-In (Google)

The Service offers optional "Sign in with Google" authentication. Where a user elects to use it, the user is redirected to Google to authenticate, and Google returns to ROCteams only the identity information listed in Section 2 (email address, verified-email status, given and family name, and Google's stable account identifier). ROCteams requests only Google's basic identity scopes (openid, email, and profile); it does not request, receive, or store access to a user's Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service data, and it does not request offline access or retain refresh tokens. ROCteams uses this information solely to create or identify the corresponding ROCteams account. Google acts as an independent controller of the user's Google account and processes the sign-in under its own privacy policy; ROCteams does not control, and receives no copy of, the user's Google account credentials. Use of Google sign-in is entirely optional and a user may instead set and use a password on their ROCteams account at any time.

7. Sub-processors

The Customer provides general authorization for ROCteams to engage the following categories of third-party sub-processors, provided that such sub-processors are bound by data protection obligations at least as restrictive as those herein: (a) cloud hosting and database infrastructure providers; (b) Stripe, for payment processing and, where the Expense Wallet feature is used, card issuance (Stripe Issuing); (c) Google, for AI assistant prompt interpretation (Google Gemini), as described in Section 6, and — where a user elects to use it — for federated sign-in authentication, as described in Section 6A; (d) the Customer's own selected payroll provider (such as Gusto, ADP RUN, or QuickBooks), where the Customer configures a payroll export integration; and (e) transactional email providers.

8. Data Subject and Employee Rights Requests

The Customer is solely responsible for responding to any request from an employee or individual to access, rectify, or erase their Personal Data, including requests made under CCPA/CPRA by California employees. ROCteams will provide reasonable technical assistance to the Customer to facilitate such requests.

9. Data Deletion and Retention

9.1. Retention: ROCteams shall retain Personal Data only for as long as is necessary to provide the services or to comply with applicable legal obligations.

9.2. Post-Termination: Upon termination of the Service Agreement, ROCteams will, upon the Customer's written request, delete or anonymize all Personal Data in its possession within thirty (30) days, except to the extent that storage is required by applicable law.

10. Security Incident and Breach Notification

10.1. Notification: If ROCteams discovers a security breach involving unauthorized access to or acquisition of unencrypted Personal Data processed on Customer's behalf, ROCteams will notify the affected Customer without unreasonable delay so that the Customer can meet its own notification obligations to affected individuals and regulators.

10.2. Florida Information Protection Act: Where a breach involves Personal Information of Florida residents, ROCteams will provide the information reasonably necessary for Customer to comply with the notification timelines and requirements of the Florida Information Protection Act, Fla. Stat. § 501.171, including notice to affected Florida residents within 30 days of discovery (extendable to 45 days for good cause shown) and notice to the Florida Attorney General where a breach affects 500 or more Florida residents. Where ROCteams itself is the party required to notify under applicable law, it will do so within the timelines that law requires.