Opus PM Privacy Policy | Opus Business Expert

1. Who we are

Opus PM is published by Opus Accountancy Limited, a limited company registered in England and Wales, company number 03956240, with its registered office at Bretton House, Bell Meadow Business Park, Park Lane, Pulford, Chester, CH4 9EP.

Opus Accountancy Limited is the data controller for the personal data described in this policy. That means it decides what is collected and why. This policy covers the Opus PM app only. It does not cover any website, and it does not cover any other app.

App: Opus PM (iOS)
Published by: Opus Accountancy Limited
Company number: 03956240
Registered office: Bretton House, Bell Meadow Business Park, Park Lane, Pulford, Chester, CH4 9EP
Data protection contact: [email protected]

2. What this app collects

Opus PM collects the following, and nothing else. Each entry says what it is for and where it goes.

contact information, such as your name, email address or phone number: your work email address, and the name and username on your staff account. To sign you in to the practice’s system and to know which member of staff you are. Sent to us or to a service provider.
content you create, such as photos, messages or files: the notes you type on a time entry or a leave request, and — if you approve or decline someone else’s leave — the note you write about that decision. To record what the time was spent on, and why a leave request was decided as it was. Sent to us or to a service provider.
your search history: what you type into the client search box, which is sent to our server with each search. To find the client you are looking for. Sent to us or to a service provider.
identifiers that could be used to recognise you or your device: your staff user identifier, the session token that keeps you signed in, and a notification token for the device. To keep you signed in, to know which staff account is making a request, and to send notifications to the right device. Sent to us or to a service provider.
any other personal data: your leave and absence records — the type of leave, the dates, whether a day is a half day, and any request you submit on behalf of someone who reports to you. To book, approve and keep track of leave. Sent to us or to a service provider.

3. What this app does not collect

Apple groups the data an app might collect into categories, and asks a developer to declare which apply. For Opus PM, these do not:

health or fitness data
financial information, such as payment card details
your location
sensitive information, such as racial or ethnic origin, health or sexual orientation
your address book or contacts
your browsing history
your purchase history
data about how you use the app
diagnostic data, such as crash logs or performance measurements

The app does not track you. It does not link what you do in it to data from other companies’ apps or websites, and it shares nothing with data brokers.

4. Why, and the lawful basis

The UK GDPR requires a lawful basis for processing personal data. These are the bases we rely on, for the data that reaches us:

contact information, such as your name, email address or phone number: Contract. To sign you in to the practice’s system and to know which member of staff you are.
content you create, such as photos, messages or files: Contract. To record what the time was spent on, and why a leave request was decided as it was.
your search history: Legitimate interests. To find the client you are looking for.
identifiers that could be used to recognise you or your device: Contract. To keep you signed in, to know which staff account is making a request, and to send notifications to the right device.
any other personal data: Contract. To book, approve and keep track of leave.

Things that stay on your device

Most of what you see in Opus PM is not your data. Client names, company details and the names, emails and phone numbers of contacts at those companies come down to your phone from the practice’s own system so you can read them. The app is a reader of that database, not a source of it: the only client-derived things it ever sends back are the client a time entry is logged against, and the text you type into the client search box.

Two different responsibilities apply, and they are not the same. For your own staff account — your sign-in, your session, the time you log, the leave you request, the notes you type — Opus Accountancy Limited decides how that data is used and is answerable for it under this policy. The client records the app displays are a different matter: they are held for the practice’s clients, under the engagement between the practice and each of them, and that engagement rather than this app policy is what governs them. If your details appear in this app because you are a contact at a client company, this is not the document that describes how they are handled.

If your account has a manager or administrator role, the app keeps an offline copy of the client list on the device so it still opens without a connection. That copy is the whole list, including each named contact’s email, phone and mobile. It is written to the app’s own storage, where no other app can read it, and it is deleted when you sign out, when your role changes, and when you delete the app. Accounts without one of those roles keep no copy on disk at all.

Tapping Email, Call or Message on a client’s details hands that address or number to the app on your phone that handles it — your mail app, the dialler, Messages. Nothing is sent anywhere by Opus PM when you do, and what happens next is governed by that app’s own terms. The WhatsApp shortcut is different: it sends the number over the internet, and it is listed above for that reason.

Your fingerprint or face never leaves your device and the app never sees it. When you unlock the app with Face ID, Touch ID or your passcode, the check is done by the iPhone itself and the app is told only whether it passed. The app also hides its contents in the iOS app switcher, so a client list is not left visible in a screenshot of your open apps.

Who we share data with

We share personal data only where it is necessary for the purposes described above. The parties involved are:

Apple: Push notifications. The device’s notification token, and the contents of every notification the practice’s system sends you. Those contents can include a client’s name, the name of a piece of work, a deadline, a colleague’s username, and the reason a leave request was decided. Notifications are not encrypted end to end and appear on your lock screen. All of it is handled under Apple’s own privacy policy. Processed in countries outside the United Kingdom, not yet confirmed.
Opus ID: The sign-in service, which the practice operates on its own domain. Your Opus ID password, which you type into the sign-in page in a browser rather than into the app, and which the app never sees. It issues the token that carries your email address to the practice’s server. Because the sign-in happens in your browser, a session cookie for it stays in that browser afterwards, outside the app, which is why signing out asks the sign-in service to end the session as well as clearing the app. Processed in the United Kingdom (a self-hosted server in Manchester).
Meta: WhatsApp, if you use the WhatsApp shortcut on a client’s phone number. The client’s phone number, sent to WhatsApp’s wa.me address to open a chat. This happens as soon as you tap the shortcut, whether or not WhatsApp is installed on the device. Nothing else about the client is sent, and nothing is sent if you do not use that shortcut. Processed in countries outside the United Kingdom, not yet confirmed.

We do not sell personal data, and we do not share it for anyone else’s marketing. We will disclose personal data where we are legally required to, and to the extent necessary to establish, exercise or defend legal claims.

Transfers outside the United Kingdom

Some of the parties above are based outside the United Kingdom, or process data on infrastructure that is. Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations for the destination country where they apply, and otherwise on the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, together with any additional safeguards the transfer requires.

Children

This app is not directed at children, and it does not knowingly collect personal data from anyone under 13. If you believe a child has provided personal data through this app, contact us using the details below and we will delete it.

How long data is kept

contact information, such as your name, email address or phone number: Your staff account is created and closed by the practice, not in the app. On the device, your details are held only inside the signed-in session and are deleted when you sign out.
content you create, such as photos, messages or files: Kept with the record they belong to. You can delete a time entry and cancel a leave request from the app; a note written when someone else’s leave was declined belongs to that request and cannot be removed from the app. How long the practice keeps these records is set by its retention schedule and is not stated here until it has been confirmed.
your search history: The app keeps no record of your searches: what you typed is gone when you leave the screen. Any log the server keeps of the requests themselves is an operational record of the practice’s own system, kept under its retention arrangements rather than under anything the app sets.
identifiers that could be used to recognise you or your device: Signing out deletes every token the app holds on the device. The app also asks our server to stop sending notifications to that device, though it cannot confirm that the server removed the record. Records held about you as a member of staff are kept under the practice’s own staff and engagement records rather than under anything the app sets.
any other personal data: Kept as part of the practice’s employment records. Where a manager submits or decides a request for someone who reports to them, the record is about that person rather than about the manager. How long these records are kept is set by the practice’s retention schedule and is not stated here until it has been confirmed.

Your rights over your personal data

You have rights over the personal data we process as controller. We aim to respond promptly; how long a response takes depends on the nature and extent of the request. You have the right to:

request access to your personal data under Article 15 of the UK GDPR, so that you receive a copy of what we hold;
request rectification under Article 16 of any errors or inaccuracies in it;
request erasure under Article 17 where there is no good reason for us to continue processing it;
object to processing under Article 21 where we rely on legitimate interests and you believe your own interests or rights override them;
request restriction of processing under Article 18, for example while its accuracy is established;
withdraw consent under Article 7 where we process on the basis of your consent;
request the transfer of your personal data to you or to another controller under Article 20.

To exercise any of these rights, email [email protected]. There is no charge.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile individuals.

Getting help with the app

Questions about how Opus PM works, rather than about your personal data, are answered on the support page at opus.expert/opus-pm/support, which also explains how to ask for your data to be deleted.

Contact and complaints

If you have any question about this policy, or would like to discuss how we process personal data, email [email protected]. You can also write to us at Bretton House, Bell Meadow Business Park, Park Lane, Pulford, Chester, CH4 9EP.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. We would ask you to raise the matter with us first so that we have the chance to put it right.

Information Commissioner’s Office: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk/concerns

Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, and its effective date is shown at the top. Where a change materially affects what the app collects, it is accompanied by an update to the app’s App Store privacy details.