EngagyApp – Privacy Policy

Version 1.0 · Effective 18 September 2026

Introduction
EngagyApp is a work app. Your employer uses it to send you company news, safety documents and other information you need for your job. This policy explains what happens to your information when you use it.

We have kept it short. If anything is unclear, use the contact at the end.
Who decides what happens to your information
Two organisations are involved.

Your employer decides what information goes into EngagyApp and what it is used for. Under data protection law they are the controller. They must also tell you the legal reason they process your information – ask them for their own privacy notice.

IT-Dev sp. z o.o. (“we”), the company behind the Engagy360 brand, builds and runs EngagyApp for your employer. We act on their instructions. We do not use your information for our own purposes. We never sell it and we never use it for advertising.
Where your information comes from
You did not sign up for EngagyApp. Your employer created your account and gave us:
1. your first and last name
2. your employee number
3. your department and your work site
4. who your manager is
5. your phone number, if they have one on file
“Work site” means the name of the place you work. For example, Kraków Plant. The app does not use your phone’s location. It never asks for it and cannot see it.

When you activate the app, two more things are created: the 6-digit PIN you choose, and a device code that ties your account to your phone.
What your employer can see
Some documents are marked as required. When you tap I have read and understood, we record who confirmed it, when, and which version of the document.

Your manager, people who publish content for your employer and your employer’s administrators can see this. They can also see if you have not confirmed a required document, and they can export this as a report.

This is the main purpose of the app. Your employer needs to be able to show that people were informed about safety rules and other important documents.

Your employer can also see your account details, whether your account is active, and when you last used the app.
What your employer cannot see
Which items you opened. The app records this only to show you what is new. Your employer’s reports show how many people opened an item, not who. Required documents are different: your employer can see who confirmed them, when, and who has not confirmed them yet (see What your employer can see).

Your PIN. Nobody at your employer, and nobody at IT-Dev, can see it.
What the app uses on your phone
1. The camera – only to read the activation code when you set up the app. No photo is taken or saved.
2. A device code – created when you activate, so your account works only on your phone. If someone tries your PIN on another phone, it will not work.
The app does not use your location, contacts, photos, files, calendar or microphone. It does not send notifications.

We use no advertising or tracking tools. The app contains no third-party analytics or crash-reporting libraries. Our servers keep technical records of how the app is running, for example errors and performance, which we use only to keep the app working.
Who else handles your information
1. Twilio sends the text message with your activation code, if you activate that way. They receive your phone number. Twilio is based in the United States. It is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as giving your information a level of protection comparable to EU law.
2. Microsoft Azure stores the information in data centres in the European Union and keeps our technical records.
Our up-to-date sub-processor list is published at https://engagy360.com/subprocessors. The mobile app does not connect directly to your employer’s systems. Documents may be copied to EngagyApp through integrations managed by your employer.
Where it is stored, and for how long
We host the app in data centres in the European Union. Your phone number is sent to Twilio in the United States when you activate by text message. This transfer is protected under the EU-U.S. Data Privacy Framework (see Who else handles your information). Microsoft, which runs the data centres, may access information from outside the EU for support and security, under safeguards recognised by EU law.

When your account is disabled, you lose access to the app. Your information is then kept for 12 months and deleted automatically. Your employer can choose a different period.

Your employer can put your account on legal hold – for example, if the information is needed for a legal claim or an investigation. While the hold is in place, your information is not deleted, even after the period above.

When your information is deleted, some statistics may remain – for example, how many people opened a document. These statistics do not identify you.
Your rights
Under EU data protection law you can ask to:
1. see your information and get a copy of it
2. correct it
3. delete it
4. limit how it is used – for example, while a mistake you reported is being checked
5. object to how it is used
Some rights have limits. For example, your employer may be required by law to keep a record that you confirmed a safety document, sometimes for several years and even after you leave. In that case, that record may not be deleted straight away. Your employer must tell you why.

Ask your employer first. They decide these things, and their privacy notice says who to contact. If you write to us instead, we will pass your request to them.
How we protect your information
1. Your PIN is never stored on your phone. On our servers it is kept only in a protected form that cannot be turned back into your PIN.
2. Everything sent between your phone and our servers is encrypted, and stored information is encrypted.
3. Your account works only on the phone you activated it on.
Age
EngagyApp is a workplace app for employees. It is not intended for anyone under 18.
Changes to this policy
If we change this policy we will publish the new version here with a new date, and tell your employer about significant changes.
For employers
Our Data Processing Agreement is published at https://engagy360.com/dpa and the current sub-processor list at https://engagy360.com/subprocessors.
Contact
IT-Dev sp. z o.o., ul. gen. Władysława Sikorskiego 26, 53-659 Wrocław, Poland, office@engagy360.com

Data protection contact: gluszczynski@it-dev.pl

If you are not satisfied with how your information is handled, you can complain to your national data protection authority. In Poland this is the Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl).