Trust ERP Privacy Policy

App: Trust ERP (com.tiib.erp)
Data controller: Trust Bank (مصرف الثقة)
Effective date: June 6, 2026
Last updated: June 6, 2026

This Privacy Policy explains how Trust ERP (“the App”, “we”, “us”) collects, uses, stores, and shares information when you use the mobile application. It applies to the Android and iOS versions of Trust ERP published under the package name com.tiib.erp.

By using the App, you acknowledge that your employer (Trust Bank) processes your work-related data through this system in accordance with this policy and applicable employment and banking regulations.

1. Information We Collect

1.1 Account and employee information

When you sign in and use HR features, the App processes information associated with your employee account, which may include:

• Employee ID and login credentials
• Name, job title, department, workplace, and contact details
• Attendance records, leave requests, expense requests, and other HR transactions
• Internal messages, memos, tickets, and documents you create or receive through the App
• Profile photos and attachments you upload
• Salary slips, payment history, and other employment records made available by your employer

1.2 Location data

The App accesses location data. Depending on your settings and the features you use, we may collect:

• Precise (GPS) location — latitude, longitude, and location accuracy
• Approximate location — derived from network or coarse location signals when precise location is unavailable
• Background location — when you enable geofence-based automatic attendance, the App may access location while running in the background to detect entry to or exit from authorized work geofences

Location is used to:

• Verify manual check-in and check-out at authorized work locations
• Validate geofence-based automatic attendance
• Support compliance and workplace presence features configured by your employer
• Detect suspected mock or spoofed location data for attendance integrity

Location data is transmitted to your organization’s Trust ERP / HRMS servers. We do not sell location data to third parties.

1.3 Device and app information

When you log in or use certain features, the App may collect:

• Device identifier (e.g., Android ID or iOS identifier for vendor)
• Device model, manufacturer/brand, operating system version, and app version
• Push notification token (FCM) to deliver alerts
• Network connectivity status
• IP address when communicating with our servers

1.4 Camera and photos

With your permission, the App may access the device camera and photo library to:

• Capture photos for attendance, internal memos, tickets, requests, and documents
• Select and upload attachments from your device
• Save generated certificates or files to app-scoped storage

The App uses system pickers where possible and does not request broad storage access on modern Android versions.

1.5 Microphone and speech data

With your permission, the App may access the microphone to:

• Record voice messages in chat or HR workflows
• Support voice commands and speech recognition features

Speech recognition may be processed on-device and/or sent to your organization’s servers depending on the feature used.

1.6 Biometric authentication

If you enable biometric login (Face ID, fingerprint, or equivalent), biometric verification is performed by your device’s operating system. We do not receive or store your biometric data on our servers. The App only receives a success or failure result from the device.

1.7 Diagnostics and crash data

The App may use Firebase Crashlytics (Google) to collect crash logs, stack traces, and basic device state to improve stability. This may include device model, OS version, and app version.

2. How We Use Information

We use collected information to:

• Authenticate you and maintain your session
• Provide attendance, leave, HR self-service, chat, notifications, and other employer-configured features
• Verify workplace presence and enforce geofence rules set by your employer
• Send push notifications about approvals, attendance, memos, and other work events
• Protect against fraud, unauthorized access, and attendance manipulation
• Maintain audit trails required for banking and HR compliance
• Improve app reliability and fix errors

3. How We Share Information

We may share information in the following circumstances:

• With your employer (Trust Bank): HR administrators, managers, and authorized personnel may access your work-related data according to internal policies and your role.
• With service providers: We use trusted providers such as Google Firebase for push notifications and crash reporting. These providers process data on our behalf under contractual safeguards.
• For legal and security reasons: When required by law, regulation, court order, or to protect the rights, safety, and security of Trust Bank, employees, and customers.

We do not sell your personal information.

4. Data Storage and Security

Data is stored on servers operated by or for Trust Bank and protected using administrative, technical, and organizational measures appropriate for a banking environment, including encrypted transport (HTTPS/TLS) and access controls.

Some information (such as session tokens or cached HR data) may be stored locally on your device. You should protect your device with a screen lock and not share your credentials.

5. Data Retention

We retain information for as long as needed to provide the App, fulfill HR and legal obligations, resolve disputes, and enforce agreements. Retention periods for attendance, payroll, and HR records are determined by Trust Bank’s internal policies and applicable law.

When you leave employment or your access is revoked, your employer may deactivate your account. Some records may be retained as required for audit, tax, or regulatory purposes.

6. Your Choices and Rights

You can control certain data collection through your device and App settings:

To access, correct, or request deletion of employment-related data, contact Trust Bank HR. Some requests may be limited by legal, regulatory, or employment record-keeping requirements.

7. Children

Trust ERP is not intended for individuals under the age of 18 and is available only to authorized employees.

8. International Transfers

Your data is primarily processed in connection with Trust Bank’s operations in Iraq. If data is transferred to service providers in other countries, appropriate safeguards are applied consistent with applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the latest version. Material changes may be communicated through the App, your employer, or other appropriate channels.

10. Contact Us

For privacy questions or requests regarding Trust ERP, contact:

• Trust Bank HR Department
• App support: through your internal HR or IT help desk

When submitting a request, include your employee ID and a description of your question or request.