Privacy notice — IT Asset Tracking

What this system does

It records which IT asset has been issued to which employee, where each asset physically is, and what software licences are installed on it.

Lawful basis

Personal data is processed for employment purposes under S.7(i) of the Act — to issue and recover company equipment and to safeguard the employer from loss. Consent is not the basis, so there is no consent-withdrawal flow for this register.

What is held

Employee code, name, work email, work phone, designation, department, client, location, joining date, employment status, and the record of assets issued to and returned by that person. Special-category data — identity numbers, financial, health, biometric — is not collected, and the custom-field editor rejects field names that suggest it.

Who can see what

Access is role-scoped. IT Engineers see only the fields needed to hand out hardware — code, name, designation, client, location and status. Contact details, employment dates and employee custom fields are omitted from what their screens receive, not merely hidden.

Retention and erasure

After an employee exits, their identifying fields are retained for the configured retention period and are then anonymised — irreversibly overwritten while the asset custody history is kept and linked to a pseudonym token. Deleting the history itself would destroy asset accountability, so anonymisation is used in its place.

Your rights

You may request access to your data, correction of it, erasure, or raise a grievance. Requests are logged and tracked against a response deadline. Contact your Data Protection Officer to make one.

Transparency

Every bulk export of personal data from this system is logged with the actor, the report, the filters used and the row count.