App privacy
policy.

The App is an internal, work-only tool. It is used by people authorised by Genie Clean Limited to broadcast live video and audio from their device to Genie Clean's central streaming infrastructure, from where it is redistributed to Genie Clean's own channels on third-party platforms.

The App is not available to the general public. Accounts cannot be self-registered. Every account is created and issued by Genie Clean Limited to a named individual as part of their work for us. There is no consumer sign-up, no advertising, no tracking, and no sale of personal data.

Genie Clean Limited ("Genie Clean", "we", "us") is the data controller for personal data processed through the App.

Registered office: Unit 3a Centurian Office Park, Tribune Way, York, England, YO30 4RY

Company number: 15811742

ICO registration number: ZB911123

Privacy contact: privacy@genie-clean.co.uk

We are established in the United Kingdom and process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

This policy covers Authorised Users - employees, workers, contractors and other individuals to whom Genie Clean has issued App credentials.

It also covers third parties who appear in a broadcast, to the limited extent their image or voice is captured by an Authorised User's device.

It does not cover viewers of the redistributed stream on third-party platforms. Once a stream leaves our infrastructure and is published to a platform such as TikTok, that platform's own privacy policy governs anything it collects from viewers.

The App collects account and identity data, broadcast content, and technical session data needed to operate the service.

Broadcast content includes the image and voice of the Authorised User and is inherently personal data. It is captured only while a broadcast session is active and only after the user has granted camera and microphone permission at the operating-system level and started a session in the App.

• Name and work email address, or host identifier, supplied by Genie Clean when the account is created
• Authentication credentials and session tokens
• The role and permissions assigned to the account
• Live video captured by the device camera
• Live audio captured by the device microphone
• Any on-screen content the Authorised User chooses to share
• Device model, operating system version, and App version
• IP address of the broadcasting device
• Session metadata: start and end time, duration, bitrate, resolution, connection quality, dropped-frame and error counts
• Diagnostic and crash logs
• Push notification token, where notifications are enabled

We do not ask for date of birth, home address, postal address, gender, or any other personal detail that is not required to operate the App.

• Precise or approximate location data
• Contacts, calendar, photo library, or health data
• The Advertising Identifier (IDFA). We do not use the AppTrackingTransparency framework because we do not track users across other companies' apps or websites
• Third-party analytics or advertising SDKs
• Personal data for sale, data brokers, or third-party artificial intelligence providers for their own purposes

We do not rely on consent as the lawful basis for processing Authorised Users' data, because consent given by a worker to their employer is generally not freely given. Authorised Users therefore cannot withdraw consent as a route to stopping this processing, but they retain the right to object under Article 21, and they can decline camera and microphone permission or simply not start a broadcast.

We do not carry out covert monitoring. Broadcasting only occurs when the user actively starts a session, and the App displays a clear on-screen indicator while a session is live.

We do not intentionally collect special category data. However, live video and audio may incidentally reveal information such as a person's apparent racial or ethnic origin, or a visible health condition.

We do not use broadcast content to infer, record, or make decisions about any such characteristic. Where such data is incidentally captured in a stream that is published, we rely on Article 9(2)(e), data manifestly made public by the data subject, in respect of the Authorised User, who chooses to appear on camera as part of their role.

The App connects to streaming and authentication infrastructure built and operated by Genie Clean Limited. We do not use a third-party live-streaming service to ingest, transcode or store broadcasts, and we do not use third-party analytics or advertising services.

Every processor is engaged under a written contract meeting Article 28 UK GDPR, requiring protection of personal data at least equivalent to that described in this policy.

• Hosting and infrastructure provider: IONOS. Our systems run on a virtual private server operated by Genie Clean Limited on IONOS infrastructure located in the United Kingdom. IONOS acts as our processor under a written data processing agreement and has no right to access or use the data for its own purposes
• Downstream distribution platforms: streams are redistributed to Genie Clean's own accounts on TikTok, Meta or other platforms. These platforms act as independent controllers in respect of the published broadcast and any viewer data they collect
• Apple: receives standard App Store and, where used, TestFlight data under its own privacy policy
• Professional advisers, insurers and regulators where we are legally required or permitted to disclose

Authorised Users are instructed not to broadcast identifiable members of the public, customers, or colleagues who have not agreed to appear. Where a person is nonetheless captured, we process their image and voice on the basis of our legitimate interests in operating the broadcast, and we will remove or edit the recording on request where it is reasonably practicable to do so.

Requests should go to the privacy contact in this policy.

Account data, session data and broadcast recordings are stored on infrastructure located in the United Kingdom.

IONOS is part of a group established in Germany, and limited access from Germany may occur for support and maintenance purposes. Germany is covered by the UK's adequacy regulations for the EEA, so no additional transfer safeguard is required for that access.

Where a broadcast is redistributed to a third-party platform, that platform will process and store the published content under its own arrangements, which may involve transfers outside the UK. Those transfers are outside our control and are governed by that platform's privacy policy.

Anyone whose personal data we process has the right to request access to it, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to data portability where it applies. Requests go to the privacy contact in this policy and we will respond within one month.

These rights are not absolute. We may need to keep certain records, for example employment records, or a recording relevant to an ongoing complaint or legal claim, where we have an overriding legitimate ground or a legal obligation to do so.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would ask that you raise it with us first.

Accounts for this App are issued and controlled by Genie Clean Limited. An Authorised User can request deletion of their account from within the App via Settings > Account > Request account deletion, or by emailing the privacy contact in this policy.

On receipt of a request we will deactivate access and delete the account and its associated profile and session data, subject to any retention we are legally required or entitled to apply under this policy. We will confirm in writing what has been deleted and what has been retained, and why.

Deleting an App account does not delete employment or engagement records held by Genie Clean outside the App, which are governed by our separate employee privacy notice.

Access requires credentials issued by Genie Clean. Streams are transmitted over encrypted connections. Stored recordings and account data are held on access-controlled infrastructure with role-based permissions. Credentials are revoked when a user's engagement ends. We keep an audit trail of account creation, access and revocation.

The App is a workplace tool and is not directed at or intended for children. Accounts are only issued to individuals aged 18 or over.

We may update this policy. The current version is always available at https://genie-clean.co.uk/legal/app/privacy and is linked from within the App. Where a change materially affects how we use personal data, we will notify Authorised Users directly.

privacy@genie-clean.co.uk

Genie Clean Limited, Unit 3a Centurian Office Park, Tribune Way, York, England, YO30 4RY