Galaxy Workforce Privacy

Information the service handles

• Staff profile and access information, such as your name, mobile number, Galaxy ID, team, role and account activity. Some profile records are provided by Galaxy administrators or imported from Galaxy's previous workforce system.
• Work schedules, attendance and break records, leave and availability requests, tasks, updates and workplace messages that you or your administrators submit.
• Form answers and attachments you choose to submit, including photos, documents and signatures. Uploaded documents may contain personal information.
• Location coordinates and accuracy when you request location-based clocking, to check the assigned depot or geofence. The app does not continuously track location in the background.
• Notification device tokens and platform information when notifications are enabled, and technical request information used by the hosting and authentication services.

Purpose and access

The service uses this information to authenticate staff, organise work, record attendance, process forms and requests, communicate work updates and maintain the service. Access depends on your assigned role. Authorised administrators can manage workforce records; drivers access the records permitted for their role.

The application does not include advertising or third-party behavioural advertising trackers. Do not put unnecessary personal, medical or identity information in messages or form attachments.

Service providers and storage

Workforce uses Supabase for authentication, database and file storage, Twilio for sign-in SMS, and Vercel for the web portal. When push delivery is enabled, Expo and Apple or Google process device tokens and notification delivery. Push alerts use a generic message rather than including shift, leave or form details on the lock screen.

The Workforce Supabase project is hosted in Sydney. This does not mean all processing is confined to Australia: these providers may process technical, authentication or delivery data in other countries. Provider locations and retention arrangements need company confirmation before this draft is finalised.

Your device choices

You can manage camera, photo, location and notification permissions in your phone settings. Refusing a permission can prevent the corresponding function, such as location-verified clocking or taking an attachment photo. Only selected files are uploaded when you submit them.

Sign-in sessions are stored on your device so you can stay signed in. Signing out removes the local session; it does not erase records already submitted.

Retention, access and deletion

Request permanent account and associated data deletion online or in the app under My account. Galaxy aims to complete requests within 30 days and confirm the outcome using your registered contact details. Only legally required records will be retained, with the reason and period explained to you.

Contact drivers@galaxyhaulage.com.au for access, correction or help if you cannot sign in. Include your name and Galaxy ID if known, but not an SMS code or password. Identity verification may be required.

Employment, attendance and safety records may need to be retained even after app access ends. The company must confirm retention periods, backup expiry and how deletion requests are handled before this draft is finalised. Archiving a staff profile is not permanent deletion.

Questions and complaints

Send privacy concerns to the contact above with the details needed to investigate. If you remain dissatisfied, you can read about the Australian privacy complaint process at the Office of the Australian Information Commissioner.