# WashBox Employee privacy notice

Source: https://washbox.ae/staff-privacy
Language: en-AE
Provider: WASH BOX FOR CAR WASHING - L.L.C - S.P.C · call or WhatsApp +971 58 540 1230 · care@washbox.ae · 07:00-22:00 daily
Service area: Abu Dhabi, Al Reem Island, Yas Island, Saadiyat Island, United Arab Emirates. Exterior cleaning only, fully mobile.

Effective 18 August 2026.

This app is a work tool for car-wash staff. It records where and when you photograph a car, and it reports the state of your handset to the office. This notice says what it collects, who sees it, and how to ask to see or delete your data. In plain terms, with no padding.

## Who this notice is for

This notice is for the employees of a car-wash company who use the WashBox Employee app to record their work. It is not for customers. If you are a resident whose car is washed, the notice that describes your data is a separate document at washbox.ae/privacy.

You do not create an account in this app. There is no sign up. Your employer's office creates your account, sets your starting PIN, and can reset it. You sign in with an employee code and that PIN.

## Who is the controller

WashBox is a platform used by more than one independent car-wash company. Each company is a separate operator with its own staff and its own records, and one company can never see another's.

The company that employs you is the controller of your records. It decides that you use the app, it approves your handset, and it holds your work. WASH BOX FOR CAR WASHING - L.L.C - S.P.C, licensed in Abu Dhabi under licence CN-6695626, runs the platform on that company's behalf and processes your data on its instructions.

This split matters when you ask about your data. Questions about why you are monitored, how long your work is kept, or a correction to a record belong to your employer. If you cannot reach a resolution through the office, write to WashBox at care@washbox.ae and we will help.

## Location tied to each photograph

When you take a before or after photograph of a car, the app reads your location at that moment and stores the GPS coordinates and the accuracy of the fix alongside the photograph. This is the point of it: the coordinates are the evidence that a wash happened, to the right car, in the right place, at the right time.

The location is read only at the moment you capture a photograph, and only while the app is open in front of you. The app does not track you in the background, and it does not follow your movements between jobs. In an underground car park there is often no satellite fix in time, so a photograph may carry no coordinates and you name the building instead.

The app asks for location permission the first time you use it, next to the camera permission, and explains why. If you refuse, the app cannot do its job, because a photograph with no location is not the evidence the wash needs.

## Photographs of customer vehicles

The app photographs each car before and after the wash. Every photograph is stored with the time it was taken, the location where there was one, and a checksum that shows it has not been altered.

These photographs are the employing company's business records and its evidence that a wash was done. Once you submit a wash you can no longer change its photographs from the app: from that point they are evidence, not a draft. Only the office can add a photograph to a submitted wash afterwards, and only on the record, so a correction can never pass as your own work.

In the office panel a photograph is hidden rather than deleted, so it can still answer a dispute. The photographs sit in private storage and are never made public.

## Your device information

So that you know plainly: the state of the handset you sign in from is reported to your employing company's office. This is deliberate, and you deserve to know it.

When you sign in, the app registers the handset with its platform, its model, its operating-system version, its app version, and a stable installation identifier that is created when the app is installed. That identifier is how the office recognises the same phone the next time, so a stolen code and PIN alone cannot be used from another device.

While you are working, the app sends the office a short status roughly every five minutes and whenever the battery drains: your app version, your operating-system version, the battery level as a percentage, whether you are on wifi, mobile data or offline, how many washes are still waiting to upload, and how much space the app's photographs are taking on the phone. This status is never queued, so the office reads the present state rather than a stale one.

## Your account and sign-in

Your account holds your full name, your employee code, your mobile number where the office has recorded it, and your language choice. Your PIN is never stored as you type it: it is kept only as a one-way hash, so nobody at WashBox or at your employer can read it back. The office can reset it, but not read it.

The app keeps a count of failed PIN attempts and locks the account for a short time after too many, because a four-digit PIN is quick to guess and the approved handset is the real second factor.

Each time you sign in the server records a session: a hashed copy of your sign-in token, when it expires, and the description your app sends about itself. Only the hash is stored, so a copy of the database cannot be used to sign in as you.

A handset must be approved before it can be used. The first phone you ever sign in from is bound to you automatically; any later phone is created waiting, and the office must approve it before it will work.

## Customer details you enter

As part of a wash you enter the car's number plate and its emirate, and sometimes a customer mobile number and the amount collected and how it was paid. This is the employing company's record of the customer and the job, and the company is the controller of it.

You are handling another person's data on your employer's behalf. Enter only what the job needs, and treat it as the customer's, not yours.

## Our lawful basis

We process this data under the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

The basis for recording your location, your photographs and the state of your handset is not your consent. It is the performance of your employment relationship and your employer's legitimate need to evidence the work done, to assign a wash to the right place and time, and to know that its equipment is working. You are told about this monitoring here rather than being asked to agree to it, because it is a condition of the work, not an optional extra.

Where the law gives you rights over your own personal data, you keep them, and the section below explains how to use them.

## Who sees your data

The people who see your work, your device status and your account are the office staff of the company that employs you, and you. No other operator on the platform can see it.

We do not sell your data and we do not share it for advertising. The app carries no advertising or analytics software; it stores only what it needs to sign you in, record your washes and report your handset's state.

We use ordinary service providers to run the system, such as hosting and storage for the photographs. They act on our instructions and for no other purpose.

## How long it is kept

We keep your account and your sign-in sessions while your account is active. When your employer removes your account, its devices and sessions are removed with it.

Your washes and their photographs are the employing company's business records and its evidence that work was done, and they remain the company's after your account is gone. They are not ours to erase on the company's behalf. In the office panel a photograph is hidden rather than deleted so it can still answer a dispute.

We have not set a fixed number of months for these records. The company keeps them for as long as it needs them for its accounts and for any dispute. Ask your employer directly about its own retention.

## Seeing or deleting your data

There is no self-service account in this app. You did not create your account and there is no button in the app to delete it, because the office creates and removes staff accounts. That is deliberate, not an omission.

To ask to see the personal data held about you, to correct it, or to have your account deleted, start with your employer's office, since it is the controller of your records and the only party that can close your account. Requests about your work, such as a wash on your record or a device status, are theirs to answer.

If you cannot resolve it through the office, or you want WashBox as the platform operator to act, write to care@washbox.ae from or quoting the mobile number the office holds for you, and tell us your employee code and the company you work for. We will verify the request with your employer and act on the data we hold, which is your account and its sign-in sessions.

We will not delete the company's business records, such as the washes and photographs, on the company's behalf, for the reasons given in the retention section above. Your right of access to your own personal data still applies to them, and we will help you exercise it through your employer.

## Changes to this notice

If we change this notice we will post the new version here and update the effective date at the top. If a change materially affects how your data is handled, we will make that clear rather than expecting you to spot it.