Last updated 6 November 2026·SPM Technologies (Private) Limited
1. Who we are, and the two different roles we play
VEYQON is workforce management software published by SPM Technologies (Private) Limited ("SPM Technologies", "VEYQON", "we", "us"), a company incorporated in Sri Lanka:
SPM Technologies (Private) Limited No. 57, Lloyd's Avenue Batticaloa 30000 Sri Lanka Company registration number: PV 00245366
VEYQON is not a consumer product. There is no public sign-up. You can only use it if your employer — or an organisation you work with — has a VEYQON workspace and has issued you an account.
That structure determines who is legally answerable for your data, and it is the most important thing in this document.
Employee Go (com.veyqon.employeego) is the HR and employee app. Fleet Go
(com.veyqon.fleetgo) is a separate app for fleet drivers; it is not an HR app. Both are employee-only, with
accounts issued by your employer and no public sign-up. For both, your employer is the controller, and VEYQON is the processor.
1.1 Your employer is the controller
For everything you do inside VEYQON as an employee — signing in, checking in and out, running task timers, requesting leave, submitting expenses, viewing your payslips — your employing organisation is the data controller under Art. 4(7) GDPR, and under the equivalent concepts in UK GDPR, Canada's PIPEDA, India's DPDP Act 2023 and Sri Lanka's Personal Data Protection Act No. 9 of 2022.
Your employer decides:
- whether to use VEYQON at all;
- which features are switched on, including whether location is recorded;
- who inside the organisation can see which records;
- which fields of your employee profile are filled in;
- how long records are kept, within the limits we support;
- the lawful basis on which your data is processed.
SPM Technologies acts as a processor (Art. 4(8) / Art. 28 GDPR) on your employer's documented instructions. We do not decide the purposes of processing your employment data, and we do not use it for our own purposes.
What this means for you in practice: if you want to access, correct, or delete your employment records, or object to how they are used, your first point of contact is your employer's HR or data protection contact, not us. Section 10 explains what happens if you contact us directly.
1.2 Where we are the controller
We are a controller for a narrow, separate set of data that is not your employment record:
- account and billing contacts at customer organisations;
- people who contact our sales or support channels;
- visitors to our public website;
- server and security logs we keep to run the service safely.
Section 8 covers that data.
1.3 Scope
This policy covers the Employee Go mobile app for iOS and Android (bundle identifier
com.veyqon.employeego), the Fleet Go mobile app for iOS and Android (bundle identifier
com.veyqon.fleetgo), the VEYQON web application, and the backend service behind them.
Where a section describes behaviour that differs between the apps, it says which app it means; a statement that does not name an app applies to both.
It does not override any privacy notice your own employer gives you. Where the two differ on a question your employer controls — legal basis, retention, internal access — your employer's notice governs.
2. What the apps collect, in detail
2.1 Account and sign-in data
| Data | When it is collected | Where it comes from |
|---|---|---|
| Your company's VEYQON workspace address | The first time you open Employee Go or Fleet Go | You type it on the sign-in screen |
| Email address / username | Each sign-in | You |
| Password | Each sign-in — transmitted to your employer's workspace for authentication, never stored on the device | You |
| Session cookie | On successful sign-in | Issued by your employer's workspace, held in the device's native cookie store |
| Name, employee record, job title, department, reporting line | After sign-in | Your employer's workspace |
2.2 Location data — the most sensitive thing we handle
We want to be precise about this rather than reassuring, because precise location is a special-care category in an employment context. Both apps read your device's precise (GPS) location, only while that app is in use and never in the background.
Employee Go (com.veyqon.employeego). Employee Go reads your device's latitude and longitude at precise (GPS) accuracy in these situations:
- when you record an attendance check-in or check-out;
- when you start, pause or stop a task timer — the coordinates are sent to your employer's workspace and saved on the timesheet. This includes an automatic pause when you leave a task's work area;
- while a task that has a work area (geofence) has an active timer, Employee Go watches your position on the device to pause the timer automatically when you leave the area. These continuous positions are compared on the device and are not sent to the server; coordinates are sent only at start, pause and stop; and
- while the check-in screen is open, your position is watched on the device to improve the accuracy of the fix.
When Employee Go does not collect location:
- Never in the background. Employee Go requests When In Use permission only and declares no background location capability. It cannot read your location while it is closed or backgrounded.
- No location history is built. There is no route and no trail. Positions watched on the device (items 3 and 4) are not stored as a history.
- Not at check-in or check-out, if your employer has switched it off. Location capture at check-in and check-out is governed by a workspace-level setting; where your employer has disabled it, no coordinates are captured at check-in or check-out. Task timer coordinates have no equivalent setting.
- Not, if you decline. If you refuse or later revoke location permission in your device settings, check-in and the task timer still work — the event is simply recorded without coordinates.
You are told before it happens. On first launch Employee Go takes you through a flow that presents the Terms and Conditions, asks for location permission (with a Not Now option), and then shows a specific notice that starting, pausing or stopping a task timer records your location at that moment. You must accept the terms and acknowledge the task-timer notice before you can use Employee Go. Notification permission is requested separately, after you sign in.
Coordinates are shown back to you. After a check-in with location enabled, Employee Go displays the recorded coordinates and a map of that point, so you can see exactly what was recorded. Maps (on the check-in screen and for task and shift locations) are rendered from OpenStreetMap, which means the map area you are viewing and your IP address reach the OpenStreetMap Foundation's tile servers when a map is displayed. The map is not requested at all where no coordinate was recorded.
Retention. Check-in and check-out coordinates are kept with the attendance record they are attached to, for the period your employer's statutory obligations require. No fixed deletion period is automated. Task timer coordinates are covered in §6. Automated deletion of coordinates is not yet in operation; until it is, coordinates persist alongside the underlying record. We state this rather than describe a control we have not built.
One entry deserves to be named rather than buried:
- Bank account details and tax identifiers (IBAN, account number, PAN or equivalent) are payroll data held by your employer. VEYQON does not initiate payments and does not transmit these to any payment processor.
No health data. Earlier builds of the Profile screen showed a blood group field, which would have been special-category data under Art. 9 GDPR. That field was removed from Employee Go on 19 August 2026 and is not part of the shipped Profile screen on either iOS or Android.
Whether a given field is populated at all is your employer's decision.
2.5 Notifications and device tokens
Employee Go. On iOS, if you allow notifications, Apple issues your device a push token (APNs). That token is:
- stored locally on your device;
- sent to our server and registered against your user account, so notifications about your approvals and rejections reach the right handset;
- deleted, and de-registered from the backend, when you sign out — so the next person to use the handset does not receive your HR notifications.
On Android, Employee Go does not use Firebase and no push token is generated. Instead, a background job checks your employer's workspace roughly every 15 minutes while the phone has a network connection and the battery is not low, and shows a notification on the device. Delivery on Android is therefore delayed, not instant. On the Android lock screen a notification shows only "New HR update".
Push delivery on iOS is being introduced and may not be active for every workspace. On Android, notifications are checked periodically (about every 15 minutes) and can arrive late.
You can decline notifications and change your mind later in your device settings.
Fleet Go. On iOS, if you allow notifications, an Apple push token is sent to our server, linked to your account, and deleted when you sign out. On Android, the Firebase Messaging library is bundled but not configured and no token is generated; alerts come from periodic checks of your employer's workspace, shown as notifications on the phone; the text of a notification can be read on the Android lock screen. If you decline notifications you receive no alerts, but the in-app notification list still works.
2.6 Technical and connection data
When Employee Go, Fleet Go or the web application makes a request, the server processes standard connection data: IP address, request time, the endpoint requested, and a user-agent string. This is used to operate, secure and troubleshoot the service. Server logs are rotated on the hosting platform's schedule and are not retained for analysis beyond troubleshooting.
2.7 What is stored locally on your device
Employee Go stores the following in the operating system's own preference store and cookie jar:
- your company workspace address (also mirrored in browser local storage);
- your consent choices: the first-launch consent flow (terms, location, task-timer location acknowledgement) and terms accepted per workspace;
- your push on/off setting and, on iOS, your push token;
- cached HR settings, your cached shift assignment, and the cached signed-in user and employee record used for the offline check;
- the last known GPS fix with its timestamp, reused only if it is less than 60 seconds old;
- the state of a paused task timer;
- your theme preference (light/dark);
- on Android, a list of notification record names already seen (at most 300, per employee and workspace);
- your session cookie, held in the device's native cookie store. Your password is not stored.
The session cookie authenticates you to your employer's workspace, and the iOS push token is registered as described in §2.5. At sign-out, Employee Go clears the cached signed-in user and employee records and removes your push token from our server. Your consent choices, workspace address, cached settings and theme stay on the device.
Fleet Go stores in its local storage: your assigned trips and trip status; the fuel, breakdown, inspection and payment-request records you have opened or submitted; a cached copy of notifications and which of them you have read; your consent choices (terms accepted per workspace, location and notification choices); the workspace address; and the push on/off setting and token. At sign-out, Fleet Go removes your iOS push token (or stops Android alert checks) and the cached signed-in user and employee records. Your consent choices, workspace address and cached trip and request records stay on the phone until you clear app data or uninstall.
2.8 What we do not collect
Stated as verified facts about the Employee Go and Fleet Go application source, not as marketing claims:
- No third-party analytics SDK. No Google Analytics, Firebase Analytics, Sentry, Mixpanel, Amplitude, PostHog or comparable telemetry library is used in either app.
- No advertising SDK, no advertising identifier (IDFA/AAID), and no App Tracking Transparency prompt — because we do not track you across other companies' apps or websites.
- No access to your device's contacts, microphone, calendar, or health/fitness data (Apple HealthKit, Google Fit), and no background location, in either app. Employee Go on iOS asks for camera and photo library access only when you attach a photo (for example a receipt) or save a downloaded document to your photo library; on Android it declares no camera permission and attachments come from the system file picker. It has no access to your file system beyond the files you explicitly pick. Fleet Go has no camera or photo library access. (This concerns data on your device. Health information your employer has recorded in your employee profile — §2.4 — is a separate matter and is covered there.)
- No sale of personal data. We do not sell, rent or share personal data with data brokers, and we do not "sell" or "share" it as those terms are defined under the California Consumer Privacy Act.
- No use of your employment data to train machine learning models.
2.9 Fleet Go (com.veyqon.fleetgo): what the app collects
The tables and notes below apply to Fleet Go, for iOS and Android. Fleet Go is a separate app for fleet drivers and is not an HR app.
| Group | What is collected |
|---|---|
| Account | Your name, email address and user ID (from sign-in); your employer's workspace address; a session cookie; and, if your employer turns it on, a two-factor (one-time) code. Your password is sent for sign-in and is not stored on the phone. |
| Precise location (GPS) | Read only while Fleet Go is open, never in the background: (a) continuously while a trip is active, sent to your employer's dispatchers about every two seconds together with your speed, heading, name and the vehicle plate, so they can follow the trip; (b) when a trip is started or ended, to check that you are within the stop's radius; and (c) once when a breakdown report is submitted, including when no trip is active. |
| Entries you make | Fuel requests; breakdown reports (with location and description); pre-trip inspection records; and payment requests (amounts and remarks). |
| Notifications | On iOS, an Apple push token, sent to our server and linked to your account, and deleted at sign-out. On Android, no token is generated (see §2.5). |
| Stored on the device only | Assigned trips and trip status; the fuel, breakdown, inspection and payment-request records you have opened or submitted; a cached copy of notifications and which were read; your consent choices; the workspace address; and the push on/off setting and token. |
Fleet Go does not collect HR, attendance, shift, leave, expense, salary, banking or identity data, has no task timers or timer coordinates, and does not support photo or file attachments. It does not use the camera, microphone or contacts, an analytics SDK or an advertising SDK, does not track you across other companies' apps, does not collect background location, and does not sell data.
2.10 Fleet Go: device permissions
| Permission | Why | If you decline |
|---|---|---|
| Location (while using Fleet Go) | Trip tracking, Start/End Trip checks, and breakdown reports | Live tracking and Start/End Trip do not work. You can still write a breakdown report, but the location is not filled in. |
| Notifications | Alerts from your employer's workspace | You receive no alerts. The in-app notification list still works. |
First-launch screens. Fleet Go shows the Terms and Conditions; a location permission screen; a notification permission screen; and a trip-tracking notice. Location and Notifications each have a Not Now option. You must accept the terms and the tracking notice to use Fleet Go: Not Now on those two screens does not skip them. Android backups are switched off for Fleet Go. You can also refuse or revoke any permission in your phone's settings.
2.11 App Store and Google Play disclosures (Fleet Go)
These should mirror the data-safety and privacy answers given in the store listings.
- Data types: name, email address, user ID, precise location, approximate location (shared with the OpenStreetMap Foundation when map tiles load), financial information (payment-request amounts), other user content (fuel requests, breakdown reports, inspection records and payment-request remarks), and on iOS a device ID (push token).
- All of it is linked to the user, used for app functionality only, not used for tracking, not sold, not used for advertising, and encrypted in transit.
- Deletion and access requests go to your employer first. VEYQON forwards any it receives to the employer, as section 10 explains.
3. Why the data is processed, and on what legal basis
Because your employer is the controller, your employer determines the legal basis. The table below sets out the bases we would normally expect a customer to rely on. It describes the processing; it does not replace your employer's own notice.
| Purpose | Data involved | Legal basis typically relied on by the employer |
|---|---|---|
| Authenticate you and maintain your session | Credentials, session cookie, workspace URL | Art. 6(1)(b) GDPR — necessary for the employment contract |
| Record attendance and working time | Check-in/out events, timestamps | Art. 6(1)(c) GDPR — legal obligation to record working time; in Germany §26(1) BDSG |
| Verify where attendance or field work occurred | Precise coordinates at those events (Employee Go: check-in/out and task timer start, pause and stop) | §26(1) BDSG / Art. 6(1)(f) GDPR — the employer must document its necessity and balancing test |
| Administer leave, expenses and advances | The relevant records and attachments | Art. 6(1)(b) GDPR |
| Maintain and display your employee profile | Identity, contact, banking and payroll fields | Art. 6(1)(b) and 6(1)(c) GDPR |
| Make payroll documents available to you | Salary slips | Art. 6(1)(b) and 6(1)(c) GDPR |
| Notify you of approvals and rejections | Push token, notification content | Art. 6(1)(b) / 6(1)(f) GDPR |
| Keep the service secure, available and debuggable | Technical and log data | Art. 6(1)(f) GDPR — our and the employer's legitimate interests |
Note for employers and their counsel. Consent under Art. 6(1)(a) is a weak basis in an employment relationship because of the imbalance of power — in Germany expressly so under §26(2) BDSG. The first-launch acknowledgement inside Employee Go and Fleet Go should be treated as a transparency measure, not as the lawful basis for location processing.
Location is on the employer's instructions. In Employee Go, location at check-in and at task timer start, pause and stop is captured on your employer's instructions. In Fleet Go, trip location tracking is likewise carried out on your employer's instructions. The employer must have its own lawful basis for this and, where required (for example German works council co-determination), must consult employee representatives. In Employee Go your employer can switch off location capture at check-in and check-out; there is no equivalent switch for task timers. Your employer controls whether trips are assigned and whether Fleet Go is used.
Works councils. In Germany, recording employee location at check-in, at task timer start, pause and stop, and tracking a driver's trip in Fleet Go is a technical facility capable of monitoring employee conduct or performance. That engages co-determination under §87(1) No. 6 BetrVG, and a works agreement (Betriebsvereinbarung) may be required before the feature is switched on. Comparable employee-representation rules exist in other jurisdictions. This is the employer's obligation, and no wording in a privacy policy substitutes for it.
4. Who else is involved — sub-processors and third parties
We use a deliberately small number of third parties. As a processor we engage sub-processors under Art. 28(2)–(4) GDPR, on the written terms each provider makes available. Two of the entries below are not conventional sub-processors and we would rather be precise than tidy: Apple issues the iOS push token to your own device under its own terms with you and with us as a developer, and the OpenStreetMap Foundation and Project OSRM operate public services that your device requests directly — we have no contract with them, and we list them because your IP address or data reaches them.
| Party | What they receive | Why | Location |
|---|---|---|---|
| Hostinger International, Ltd. | All workspace data, at rest and in transit | Hosting the VEYQON backend and database | Server in Germany; company registered in Cyprus |
| Apple Inc. (APNs) | Push device token, iOS devices only (Employee Go and Fleet Go), and the notification content where notification delivery is in use | Issuing the device token and delivering notifications to iPhones and iPads | United States and global edge infrastructure |
| OpenStreetMap Foundation | The map area you are viewing, and your IP address, when a map is drawn on your device (Employee Go and Fleet Go) | Rendering in-app maps | United Kingdom |
| Project OSRM (router.project-osrm.org) — Fleet Go only | The coordinates of a trip's planned stops (your employer's locations). Your live position is not sent. | Drawing a trip's route on the map | Public service; we have no contract with it |
Employee Go and Fleet Go. Data from both apps is hosted by Hostinger in the same place as the rest of the service. Both apps draw their maps from OpenStreetMap tiles: each tile request carries your IP address and the map area you are viewing. Fleet Go sends the coordinates of a trip's planned stops to Project OSRM to draw the route; Employee Go does not use OSRM. On iOS, Apple's push service carries the push token and the notification text for both apps. On Android, neither app uses Firebase to generate a device token: Employee Go and Fleet Go check your employer's server periodically and show notifications on the device. Neither app has an analytics SDK, an advertising SDK, tracking, or sale of data.
Support, billing and email are handled by SPM Technologies' own staff. We do not use a third-party helpdesk, CRM, email marketing or billing platform for customer data.
Notification content. Notification payloads travelling through Apple infrastructure do not contain salary figures or comparable detail — they carry the fact and the destination ("Your leave request was approved"), not the substance.
Inside your organisation. Your records are visible to colleagues according to the role-based permissions your employer configures — typically your manager, HR, and finance for expense-related records. Ask your employer how access to check-in coordinates is configured in your workspace.
We do not disclose your data to anyone else, except where we are legally compelled to by a binding order from a competent authority, in which case we notify the controlling employer unless the law forbids it.
A current sub-processor list is maintained at veyqon.co/subprocessors, and customers are notified 30 days before a new sub-processor is engaged.
5. Where your data is stored, and international transfers
5.1 One server, in Germany
VEYQON runs on a single server located in Germany, operated for us by Hostinger International, Ltd. Every customer workspace is hosted on that server, whatever the customer's own country. There is no per-region or in-country hosting today, and we do not claim otherwise.
Data from Employee Go and Fleet Go goes to your employer's workspace on this server. Fleet Go data, including trip locations, is visible to your employer's dispatchers.
For people in the EEA this means the data itself rests inside the European Union. It does not mean that no one outside the EU can reach it — see §5.2, which describes access from Sri Lanka.
Hostinger is engaged as a sub-processor and its data processing addendum, which incorporates the Standard Contractual Clauses, applies to this relationship.
5.2 Access from Sri Lanka — stated plainly
SPM Technologies is established in Sri Lanka. Our engineering and support staff are based there. When we provide support, investigate an incident, or maintain the service, our personnel in Sri Lanka may access data held on our server in Germany. That is a transfer to a third country, and we would rather state it than let you discover it.
Sri Lanka does not have an adequacy decision from the European Commission or the UK Government. Transfers of personal data from the EEA or the UK to us are therefore made under:
- the European Commission's Standard Contractual Clauses (Decision 2021/914), module three (processor to sub-processor) or module two as applicable, supplemented by a transfer impact assessment; and
- for transfers out of the UK, the UK International Data Transfer Addendum to those Clauses.
These are incorporated into our Data Processing Agreement with each customer.
5.3 Other applicable law
Depending on where you work and where your employer is established, the following may apply, and we contract to support them:
- EU GDPR and, for German employers, the BDSG (in particular §26 on employment data);
- UK GDPR and the Data Protection Act 2018;
- Canada's PIPEDA and applicable provincial legislation;
- India's Digital Personal Data Protection Act 2023;
- US state privacy laws including the CCPA/CPRA, under which we act as a "service provider" and not a "third party";
- Sri Lanka's Personal Data Protection Act No. 9 of 2022, which governs us as a company domiciled in Sri Lanka. As at the date of this policy the Act's substantive provisions have not yet been brought into force by Ministerial Order, although the Data Protection Authority is operational. We will comply with those provisions when they commence.
6. How long data is kept
| Data | Retention |
|---|---|
| Employee Go location coordinates (check-in, check-out) | No fixed deletion period is automated. Automated deletion is not yet in operation — see §2.2. The attendance record is retained for the period your employer's statutory obligations require. |
| Attendance, leave, expense, advance and payroll records | Set by your employer, and largely fixed by law. Statutory periods for payroll and attendance documentation are commonly 6 or 10 years depending on the country. |
| Server and connection logs | Rotated on the hosting platform's schedule; not retained for analysis. |
| Employee Go task timer coordinates (start, pause, stop) | Readable only by HR, manager and admin roles. Our policy is to delete timer coordinates one month after the salary period they fall in has been processed, keeping the timesheet itself. Automated deletion is not yet in operation; until it is, coordinates stay on the record. |
| Fleet Go trip location, breakdown location and trip records (and inspection, fuel and payment-request records) | These are kept by your employer under their own retention policy. Automated deletion is not yet in operation for Fleet Go either. |
| Push device token | Until you sign out, or until the token is invalidated by Apple (iOS only; no Android token is generated). |
| Device-local data (consent flags, workspace URL, theme, caches) | Until you clear app data or uninstall. At sign-out: Employee Go — clears the cached signed-in user and employee records and removes the push token from our server (consent choices, workspace address, cached settings and theme stay); Fleet Go — removes the iOS push token (or stops Android alert checks) and the cached signed-in user and employee records (consent choices, workspace address and cached trip and request records stay). |
| Workspace data after a customer leaves | Deleted or returned in accordance with our Data Processing Agreement with that customer. |
7. Security
- Encryption in transit. All traffic between Employee Go, Fleet Go and the backend uses HTTPS/TLS. The production mobile build does not permit unencrypted connections.
- Where data rests. Workspace data is stored on our server in Germany, on storage provided by Hostinger. We do not claim encryption at rest across every component of the deployment. Database access is restricted to the application and to named administrators.
- Session handling. Sessions are held in the operating system's native cookie store, rather than in web storage accessible to page scripts.
- Access control. Access to the data of both apps is governed by role-based permissions configured by your employer in their workspace. Employee Go timer coordinates are readable by HR, manager and admin roles only.
- Server logs. Server connection logs (IP address, time, endpoint and user-agent, see §2.6) apply to requests from Employee Go, Fleet Go and the web application.
- Our staff access. SPM Technologies personnel access customer workspace data only where necessary for support, maintenance or incident response. Access is limited to named personnel who require it for those purposes and is subject to written confidentiality obligations.
- Breach notification. Where we become aware of a personal data breach affecting a customer workspace, we notify the controlling employer without undue delay, as Art. 33(2) GDPR requires, so they can meet their own 72-hour duty. Notifying a supervisory authority and, where required, affected employees, is the employer's responsibility as controller.
No system is perfectly secure, and we do not claim otherwise.
8. Data we control ourselves
Separately from employment data, we process a limited set of data as controller:
| Category | Purpose | Legal basis |
|---|---|---|
| Business contact details of customer administrators and prospects | Managing the customer relationship, support, billing | Art. 6(1)(b) and 6(1)(f) GDPR |
| Support correspondence | Answering and resolving your request | Art. 6(1)(b) / 6(1)(f) GDPR |
| Website visit data | Operating and securing our website | Art. 6(1)(f) GDPR |
| Billing and invoicing records | Contract performance and statutory accounting retention | Art. 6(1)(b) and 6(1)(c) GDPR |
This data is handled by SPM Technologies staff directly. For it, you may exercise your rights against us using the contact details in §11.
Our marketing website sets no non-essential cookies. It runs no analytics, no advertising or tracking scripts, and no third-party embeds that profile visitors. The only storage used is what is strictly necessary to serve the pages you request.
9. Automated decision-making
VEYQON does not make automated decisions producing legal or similarly significant effects about you within the meaning of Art. 22 GDPR. Approvals of leave, expenses and advances are made by people in your organisation. Workflow rules may route a request to a particular approver, but the decision itself is human.
10. Your rights, and how to use them
Under the GDPR — and in substance under UK GDPR, PIPEDA, the DPDP Act, the CCPA/CPRA and the Sri Lankan PDPA once in force — you have the right to:
- access the personal data held about you (Art. 15);
- rectify inaccurate data (Art. 16);
- erasure in defined circumstances (Art. 17);
- restrict processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21);
- withdraw consent where consent is the basis, without affecting prior lawfulness;
- not be discriminated against for exercising your rights, where local law provides that protection.
Fleet Go data — trip locations, breakdown reports, inspections, and fuel and payment requests — is within the scope of access, correction and deletion requests, as is Employee Go data. You can also stop location collection at any time by turning off Location for Employee Go or Fleet Go in your phone's settings.
Statutory retention obligations — payroll and tax records in particular — will often override an erasure request. That is a legal limit, not a refusal of your right.
Where to send the request. Because your employer is the controller of your employment data, send your request to your employer's HR or data protection contact. If you send it to us, we will forward it to the controlling employer and assist them in responding, as Art. 28(3)(e) GDPR requires. We cannot act on your employment records without your employer's instruction, and we will not delete an employer's records on an employee's request alone.
Complaints. You may lodge a complaint with the supervisory authority where you live, where you work, or where the alleged infringement took place. In Sri Lanka, the competent authority is the Data Protection Authority of Sri Lanka (dpa.gov.lk).
11. Contact
Data protection contact: [email protected]
Support: veyqon.co/support
Postal: SPM Technologies (Private) Limited, No. 57, Lloyd's Avenue, Batticaloa 30000, Sri Lanka
Telephone: +94 76 664 6404
Data Protection Officer. SPM Technologies has not appointed a Data Protection Officer. We have assessed that our processing does not meet the thresholds in Art. 37(1) GDPR requiring mandatory appointment. Data protection enquiries should be sent to the address above.
12. Children
VEYQON is a workplace application intended for people in employment. It is not directed at children, we do not knowingly collect data from children, and there is no route for a child to obtain an account — access requires an employer-issued credential. Employee Go and Fleet Go are intended for users aged 18 and over.
13. Changes to this policy
We will publish any change on this page and update the "Last updated" date. Where a change materially affects how personal data is handled — a new sub-processor, a new category of data — we will notify customer organisations in advance in accordance with our Data Processing Agreement, and they will inform their employees.