WSManager Privacy Policy

1. Who we are
2. Information we collect
3. How we use information
4. Legal basis for processing
5. When we share information
6. Sub-processors
7. FSM Developments support access
8. Storage and international transfers
9. Data retention
10. Security
11. Your rights
12. Cookies and similar technologies
13. Children
14. Changes to this policy
15. How to contact us

FSM Developments Ltd is a New Zealand company that develops and operates WSManager. Each workshop that uses WSManager (the “workshop”) has its own address, for example yourworkshop.wsmanager.co.nz, and its own database. For the purposes of the New Zealand Privacy Act 2020, the workshop is the “agency” that collects and holds the personal information of its staff, customers and suppliers in WSManager, and decides what is recorded. We hold that information on the workshop's behalf as its processor, acting on its documented instructions. We are also the agency for the small amount of information we hold about the workshop's account contacts, such as for billing and support.

2.1 Staff and user accounts

The workshop's Owners add the people who use WSManager. For each person the workshop enters:

• Identity and contact details — name, email address, mobile number and role.
• Sign-in details — a password hash and, for the shared workshop computer, a PIN hash. We never store passwords or PINs in a readable form.
• Payroll code— the person's employee code in the workshop's payroll system (Smartly), so that approved hours can be exported against the right person.

2.2 Time, leave and payroll export

• Time records — when a person clocks on and off, the jobs they work on, travel and vehicle kilometres, breaks, and any approval or correction made by a supervisor.
• Leave — leave requests and leave balances as the workshop enters them.
• Payroll export files— approved hours for the workshop's payroll provider. WSManager does not calculate pay, tax, KiwiSaver or leave entitlements.

2.3 Clock-on and clock-off location (optional)

This is off by default. An Owner can turn on “Record location when people clock on and off” in the workshop's settings, and the workshop should tell its staff before it does. While it is on, when a person clocks on, clocks on for a call-out, or clocks off from their own login (their phone or computer), their browser asks for their position. If it is given, we keep the latitude, longitude and accuracy with that shift. If it is not given (for example, permission is declined), we record the reason instead, and the person is still clocked on or off. The shared workshop computer records no location. Location is shown only to the people who approve the timesheet and to the person themselves. It is not shown on job pages or the job board, and it is not included in exports or the payroll file. It is not used to track people between clock-ons, and we do not send it to any third party. The map link shown beside it is a link the person taps themselves.

2.4 The workshop's business records

• Customers and suppliers — contact names, email addresses, phone numbers and addresses.
• Assets — vehicle, machinery and boat details such as registrations, VINs or HINs, and fleet numbers.
• Jobs and invoicing — jobs, notes, parts, quantities, prices and invoices.
• Audit log — a record of who changed what, and when.
• In-app notifications — for example, that leave has been approved or a part has arrived. WSManager does not send email in this release; notifications appear in the app.

2.5 Account contacts and support

Names, email addresses and phone numbers of the workshop's account contacts, and the messages and files they send us when asking for help.

2.6 Information collected automatically

• Technical data — IP address, browser type, device information, timestamps and security events, in server and monitoring logs.
• Error reports — when something goes wrong, a technical error report. See the Sentry entry in Section 6.

2.7 Information from services the workshop connects

If the workshop connects Xero, we exchange information with Xero only to the extent needed for the features it uses: contacts, invoices, items and parts, and tracking options for each job are sent to Xero, and supplier purchase orders and bills are read back for job costing. We do not sync payroll with Xero.

We use the information above only to:

• provide, maintain and improve WSManager for the workshop;
• create and manage user accounts, including authentication and access control;
• give the workshop technical support;
• invoice the workshop and administer its subscription;
• send service-related notices to the workshop's account contacts (for example, security alerts and material changes to the Services or this policy);
• monitor for, investigate and prevent fraud, abuse and security incidents; and
• comply with legal obligations and enforce our Software Licence Agreement.

We do not sell personal information, we do not use it for advertising, and we do not use workshop data to train machine learning models.

We process personal information on the following lawful bases: performance of a contract with the workshop; compliance with a legal obligation; our legitimate interests in operating and securing the Services; and, where required, consent (which can be withdrawn at any time). The workshop is responsible for having a lawful basis, and for telling its staff what it records, including location where it turns that on.

We share personal information only as described in this policy:

• With sub-processors that help us run the Services (see Section 6). Each is bound by agreements that require appropriate security and confidentiality.
• With the workshop's authorisation — for example, when its Owner connects Xero.
• For legal reasons — where disclosure is reasonably necessary to comply with a law, regulation, court order or enforceable governmental request, or to protect the rights, property or safety of FSM, our users or the public.
• In a business transfer — if we are involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

Workshop data is never shared with other workshops.

We engage the following sub-processors to provide the Services. Each is bound by a written data-processing agreement (DPA) or equivalent terms that require appropriate security and confidentiality safeguards.

This list is current as at the effective date above and is reviewed at least annually. When we add or replace a sub-processor we will update this page and notify the workshop's account contacts by email or in-product notice before the new sub-processor begins processing personal information.

To help with a problem on any screen, FSM Developments can have a support login in each workshop. Customer data can be accessed by FSM Developments through that login, and only to give support.

• It is an Owner account, so it can see what an Owner can see. It is not one of the workshop's staff: it does not record time and is left out of staff lists, timesheets, payroll and leave.
• The workshop's Owners can see it in Settings, under Staff (“FSM Developments support access”), with its last sign-in and status, and can suspend it at any time. Suspending it ends its session immediately.
• Everything it does is recorded in the workshop's audit log under its own name, as for any other user, as is suspending and restoring it.

The workshop's data is stored on Microsoft Azure infrastructure in New Zealand North (Auckland).Some sub-processors operate outside New Zealand:

• European Union (Germany) — Sentry (error reports, which are designed to contain no personal information).
• Australia and the workshop's Xero region — Xero, only if the workshop connects it.
• United States— Resend (password reset emails: a person's name, email address and reset link).
• United States and global — Google Maps Platform (address text typed into address fields, for suggestions).
• United States and global edge network — Vercel (help site only, no customer data).
• Global edge network — Cloudflare (DNS, CDN, edge TLS, DDoS protection), through which all traffic to WSManager passes.

When personal information is transferred outside New Zealand, we take reasonable steps under Information Privacy Principle 12 of the Privacy Act 2020 to ensure it is protected by comparable safeguards, including contractual commitments (the DPAs linked in Section 6) and the sub-processor's own certifications (for example, ISO 27001, SOC 2).

We retain personal information only for as long as is necessary to provide the Services, comply with legal obligations, resolve disputes and enforce our agreements. Typical retention periods:

• Workshop data — for the life of the subscription. The workshop decides what it enters and can ask us to correct it.
• Workshop data after termination — the workshop can ask for an export within 30 days after termination, and we delete its database within 90 days after termination unless a longer period is required by law or specifically agreed.
• Billing records — at least 7 years, as required by New Zealand tax law.
• Support correspondence — up to 24 months from last contact.

We take the security of personal information seriously and implement appropriate technical and organisational measures, including:

• TLS for all data in transit, with all traffic passing through Cloudflare;
• encryption at rest for databases and file storage;
• a separate database for each workshop, chosen on every request, to reduce the risk of cross-workshop exposure;
• role-based access control within each workshop, passwords and PINs stored only as hashes, and sign-in lockout after repeated failed attempts;
• no database passwords in the application: Azure managed identities are used, and encryption keys are held in Azure Key Vault;
• an audit log of changes within each workshop;
• regular patching, logging, monitoring and backup.

No system is completely secure. If we become aware of a privacy breach that has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals, and the workshop, in accordance with the Privacy Act 2020.

Under the New Zealand Privacy Act 2020 you have the right to:

• access personal information held about you and request a copy;
• request correction of personal information that is inaccurate or out of date; and
• complain to the Office of the Privacy Commissioner (privacy.org.nz).

Most personal information in WSManager is held for a workshop, so if you work for, or are a customer of, a workshop that uses WSManager, please ask the workshop first. We will help the workshop respond. You can also contact us at support@fsmdevelopments.co.nz, marked for our Privacy Officer, Adam Bilcich, and we will generally direct a request about workshop data to the workshop and assist it in responding.

WSManager uses only the cookies it needs to work. They are not used for analytics or advertising, and there are no analytics or advertising trackers in the app. They are:

• a sign-in cookie that keeps you signed in (for up to 12 hours idle, or 60 days if you choose “Keep me signed in on this device” or are a shared workshop device);
• a cookie used on the shared workshop computer to remember who is acting on it; and
• a short-lived cookie used to protect the sign-in to Xero when the workshop connects it.

Because these are essential, blocking them will stop sign-in from working. The help site does not set cookies of its own.

The Services are not intended for individuals under the age of 16 and we do not knowingly collect personal information from children.

We review this policy at least annually and update it when our practices or sub-processors change. When we make a material change, for example adding a new sub-processor or expanding how we use personal information, we will update the “last updated” date at the top of the policy and notify the workshop's account contacts by email or by an in-product notice in WSManager.

For any privacy question or request, please contact:

FSM Developments Ltd
Privacy Officer: Adam Bilcich
139 Kohimarama Road, Kohimarama, Auckland 1071, New Zealand
Email: support@fsmdevelopments.co.nz