Privacy & data

Yes, if the app uses location. The privacy policy and in-app disclosure should match actual app behaviour.

Yes, where it is needed for a selected process such as onboarding, contract changes, attendance, or offboarding. The recommended principle is minimisation: store only necessary fields, restrict access by role, audit changes, and archive people who are no longer active.