Privacy Policy

This policy explains what personal data is processed when the WorkLogTracker app is used, on Android, iOS or in a browser, and when the website www.worklog-tracker.com is visited or a message is sent to RMTracker S.L.

1. Who processes your data and in what capacity

WorkLogTracker is a tool that companies use to comply with their obligation to record their workforce's working time. This means there are different processing activities with different controllers, and it is worth distinguishing them because which one applies determines whom you should contact to exercise your rights.

If you are an employee and want to exercise your rights over your clock-ins or your work reports, your point of contact is your company. RMTracker S.L. will give it the assistance that the GDPR requires of a processor.

The full identification details also appear in the Legal Notice.

2. What data is processed in the app

About location, plainly

The app does not track continuously. Location is queried only at the moment the person taps to clock in, and only to check the distance to the workplace. Between one clock-in and the next the app does not query the device's position. If the location permission is denied, the clock-in is still recorded, without coordinates.

Within the company, the location of a clock-in is seen by the person concerned and, on a map alongside the workplace and its radius, by those with the role of owner, administrator or auditor and by the team manager of that person. No one else in the workforce sees it. The images of that map are served by the OpenStreetMap Foundation, as explained in section 6.

When the schedule ends

If the company has assigned a schedule, when its end time arrives the app shows a local notice on the device asking whether the person clocks out or keeps working. That notice is scheduled and generated by the phone itself: it does not go through any external notification service and nothing is sent to third parties. In the web version, the question appears within the app itself.

Location is stored only when the person answers, by clocking out or by tapping “Keep working”, just as with any other clock-in and under the same rules: never in the background or at a moment when they have not tapped anything.

If nobody clocks out, a few hours after the end of the schedule (the number set by the company, four unless it says otherwise) the working day is closed at the schedule's end time as an “unconfirmed exit”. If the person tapped “Keep working”, it is not closed then: if they still do not clock out afterwards, the safety close closes it, after the hours without activity set by the company (fourteen unless it says otherwise), at the time they tapped “Keep working”. In both cases, at the next clock-in the person is asked to confirm the closing time or to declare the exact time at which they left.

The question is also asked when the person clocks out after the end of the schedule, once the margin set by the company has passed (fifteen minutes unless it says otherwise), if there is no record that they kept working. If they confirm that they finished at the schedule's end time, that time replaces the one they clocked, which remains in the record.

Time worked after the end of the schedule, whether clocked or declared, is recorded as overtime declared by the person themselves (complementary hours if their contract is part-time). The declared or confirmed time and those hours are kept in the working-time record together with the moment they were declared.

Besides the person concerned, these exits and the location of those answers, on a map alongside the workplace and its radius, are seen by those with the role of owner, administrator or auditor; the owner and the administrator can open an incident about them. They form part of the working-time record, with the same legal basis and the same retention period (sections 4 and 5).

Payslips

The company may store each person's payslip in the app so that the person can download it whenever they wish. It is optional for the company, which may choose not to use it and may delete at any time the payslips it has stored.

A payslip is seen only by the person concerned and by those with the role of owner, administrator or auditor. Team managers and the rest of the workforce do not see them. They are stored in Supabase, in the European Union (Ireland region), for the retention period configured by the company, which is at least four years.

Special categories of data

WorkLogTracker does not use fingerprints, facial recognition or any other biometric data to clock in. It does process one item of health data: that a person is on sick leave, with its dates. The app does not ask for diagnoses or medical certificates.

Within the company, sick leave is seen only by the person concerned and by those with the role of owner, administrator or auditor, the three who can issue the official working-time record. Team managers and the rest of the workforce see neither the type nor the dates of a period of sick leave; at most, a manager may see that a late arrival by someone on their team was justified by an approved absence, without seeing which one. Outside the company it can be consulted only by RMTracker support staff while the company has given them access permission from the app (see section 10); they act as processor and are bound to confidentiality. In the official working-time record the days of sick leave appear as “Sick leave”, because the record has to explain why there is no working time on those days.

The reason for a leave or for any other absence that is not sick leave is, by contrast, seen by the manager of that person's team, who is the one who can approve it. It is enough to state it in generic terms (for example, “medical appointment”): neither the reason, nor the comment of whoever resolves the request, nor the free-text remarks on a clock-in or a report should be used to note diagnoses or other clinical information.

Permissions the app requests

No permission is essential for clocking in. All of them can be denied or withdrawn at any time from the device settings.

Voice dictation

To convert speech into text, the app uses the speech recognition service of the phone's own operating system, from Apple or Google. Depending on the device and its settings, that service may process the audio on the phone itself or send it to its manufacturer's servers, which process it under its own terms. WorkLogTracker neither receives nor stores the audio: only the resulting text, and only if you decide to save it in the report.

What is stored on your device

So that clocking in is possible offline, the app stores on the device itself, or in the browser if the web version is used, the clock-ins and reports pending submission and the list of workplaces. They are sent to the server when the connection is restored. The signed-in session and preferences, such as language, are also stored on the device; the detail of what is stored in the browser is in the cookie policy.

If your company came through a sales agent

RMTracker S.L. works with independent sales agents who earn a commission on the companies they bring in. If, when creating your company, you entered a sales agent's code or used their invitation, or claimed a sign-up they prepared for you, a note is made that your company belongs to that agent. That agent sees in their portal only the company's name, its registration date, the status of the subscription (trial, active, unpaid or cancelled) and, for each payment, its date, the basis on which the commission is calculated and the amount of the commission. They do not see the workforce, the clock-ins, the work reports or any other data on the use of the service.

If you do not want your company to be assigned to a sales agent, simply do not enter any code when creating it. If it already is and you want that to stop, write to legal@rmtrackersolutions.com.

If a sales agent or RMTracker prepares your account

If you ask for it, a sales agent or the RMTracker S.L. team can prepare your company's account so that you only need to review it. To do so they store the company's name, its tax ID (NIF or CIF), the country and time zone, and the name and email address of the person who will claim it. If the company provides it, they also store a list of its workforce with, at most, name, email address, job title, phone number, employee code and the role each person will have in the app (employee, manager, administrator or auditor) and the schedule each person will have assigned. They can also prepare the company's work schedules. No NIF, NIE or Social Security numbers of the workforce are stored: the company adds those itself later, if it needs them.

Only whoever prepared the sign-up and RMTracker S.L.'s administration see this data. A personal link is handed over that shows the company's name, who prepared it and the name and email address of the person responsible, and with which only that person, signing in with that same, already confirmed email address, can claim the account. On claiming it they accept the terms, this policy and the data processing agreement, and the company is created like any other. From then on, whoever prepared it no longer sees it and, if it is a sales agent, only receives what is explained in “If your company came through a sales agent”.

The workforce list is used only so that the company can add those people to the app, after reviewing and completing it. When the company adds them, or discards the list, the list is deleted; their data then becomes, where applicable, workforce data for which the company is responsible. It is for the company that provides the list to inform its workforce that it has shared it to prepare its account.

You can request it from the demonstration request form on this website. Through it you send us that same data and, in addition, the phone number of the person responsible, the approximate size and the sector of the company and, if you wish, the trade name, when to call you and a comment. Only RMTracker S.L.'s administration sees it, and uses it to prepare the account. The account may be prepared automatically as soon as you send the request: in that case the personal link to claim it reaches that email address straight away; if you did not request it, simply do not open it, and the sign-up lapses after thirty days. The workforce list is not included in the notification emails and is deleted from the website as soon as the account is prepared or the request is discarded and, in any case, thirty days after you send it.

If you are a sales agent

For the individuals and companies that collaborate as sales agents, the following is processed: name or company name, tax ID, tax address, email address, IBAN, the VAT and withholding rate that applies to them, the invoices they upload in PDF and the detail of their commissions and of the payments received. It is used to calculate and pay commissions and to comply with accounting and tax obligations.

3. If you visit the website or write to us

The fields marked with an asterisk in the forms are necessary to handle the request: without them it cannot be submitted. No commercial communications are sent by email to anyone who has not asked for them. The website does not use advertising cookies.

Visit statistics. To know how many people visit the website, from where and what interests them, each page view is recorded on our own servers with: the page, the language and country chosen on the website, the domain of the site you arrive from, the campaign parameters of the link (utm_*), whether you use a mobile, a tablet or a computer, and some clicks, such as those that lead to requesting a demonstration. In addition:

• Approximate country, region and city. They are deduced from your IP address at that moment, with a geolocation database installed on our servers (DB-IP), without sending the IP to anyone. The IP is not stored.
• Unique visitors of the day. To count how many different people visit the website each day, an irreversible fingerprint is calculated from your IP and your browser combined with a key that changes every day and is destroyed the following day. Neither the IP nor the browser is stored, and the fingerprint does not allow you to be recognised on another day.
• If you accept statistics in the cookie notice, your browser also stores a random identifier for thirteen months, to know whether you visit us again. You can withdraw consent whenever you wish from “Cookie preferences”, at the foot of the website, and the identifier is deleted. Your choice expires after thirteen months and you are then asked again.
• Proof of your choice. Each time you accept or reject statistics we store the choice, the date, the version of the cookie policy and a random number kept by your browser, in order to be able to demonstrate consent. It does not include your IP or other data that identifies you.

4. Legal basis

Article 90 of the LOPDGDD requires that the workforce and its representatives be informed, expressly and in advance, of the use of geolocation systems. It is for the employing company, which decides to implement the system, to give that information.

Where processing is based on legitimate interest, you may object to it on grounds relating to your particular situation, as section 9 explains.

5. How long data is kept

• Working-time record: four years, the period that employment law requires for keeping it available to the workforce, its representatives and the Labour Inspectorate. Once that period has elapsed, an automatic monthly process deletes the expired clock-ins, incidents, corrections and logs, and records how many records were deleted and for what period, without storing any personal data.
• Work reports: for as long as the relationship with the customer lasts and afterwards for the limitation periods of the actions that may arise.
• Absences and allowances: like the reports, for as long as the relationship with the customer lasts and afterwards for the limitation periods of the actions that may arise. Those that explain a day in the working-time record appear in it and are kept at least as long as that record.
• Payslips: for the retention period configured by the company, which is at least four years, unless the company itself deletes them earlier.
• Billing data: for the periods required by commercial and tax law.
• Account: while the subscription is active. When it ends, the company has thirty days to export its data; afterwards it is deleted or blocked, except for what must be kept by legal obligation.
• Acceptances of the legal texts: for as long as the relationship lasts and afterwards for the limitation periods of the liabilities that may arise, because they are the proof of what was accepted.
• Assignments to sales agents, commissions and sales agents' invoices: for as long as the relationship with the sales agent lasts and, afterwards, for the periods required by commercial and tax law.
• Prepared sign-ups: if nobody claims the account within thirty days of the link being created or renewed, or if it is cancelled, the workforce list is deleted and the sign-up lapses. Once claimed, the list is deleted when the company adds those people or discards it and, in any case, after thirty days. A record of each step (creation, changes, claim, cancellation) is kept, without workforce data, to be able to show how it was handled. If you request it from the website, the workforce list is deleted from the website as soon as the account is prepared or the request is discarded and, at the latest, thirty days after you send it; the rest of the request, after twelve months.
• Demonstration and contact requests: while they are being handled and followed up. If the service is not contracted, they are deleted twelve months after the last contact, or earlier if you ask. If it is contracted, they are kept as data of the customer's account.
• Account deletion requests and requests to exercise rights: the time needed to handle them and, afterwards, for the limitation periods of the liabilities that may arise from how they were handled.
• Support emails and queries: while the query is being resolved and, if you are a customer, for as long as the relationship lasts.
• Technical browsing data: only the short periods during which the website's hosting and distribution providers keep their technical logs.
• Visit statistics: four hundred days, after which they are deleted automatically. The daily key used to count unique visitors is destroyed the following day, and your browser's statistics identifier lasts thirteen months or until you withdraw consent. The proofs of your choice in the cookie notice are kept for three years, the longest limitation period for infringements of the LSSI-CE.

Clock-ins cannot be deleted or altered from the app: an error is corrected by adding a correction approved by a manager, which is recorded alongside the original clock-in. This is deliberate, because a record that could be rewritten would be useless as evidence.

6. Who else is involved

To provide the service and maintain the website, the following providers are used. Except for the OpenStreetMap Foundation and Google (YouTube), for the reasons explained below the table, they act as processors or sub-processors and the contract required by article 28 of the GDPR is in place with them:

When the map of a clock-in is opened, the browser or device of whoever is viewing it requests the map images directly from the servers of the OpenStreetMap Foundation, which receive their IP address and the map tiles shown, but not anyone's name or any other working-time record data. For that reason it does not appear as a sub-processor in the data processing agreement.

The sales portal, which only sales agents, Pro sales agents, partners and RMTracker administration can access, offers video tutorials hosted on YouTube. When the list of tutorials is opened, the browser or device of whoever is viewing it requests the video thumbnails from YouTube's servers (i.ytimg.com), and when one is played the YouTube player is loaded in its enhanced privacy mode (youtube-nocookie.com), which may store information in the browser or device while the video is watched. Google thus receives the IP address and the technical data of the connection of whoever is watching, and processes what it observes of the playback as controller, under its own privacy policy. It receives no working-time record data or account data, and no record is kept of who watches which tutorial. For that reason it does not appear as a sub-processor in the data processing agreement. The members of the workforce of a customer company do not use this portal.

Card details are entered directly into the payment gateway and never reach WorkLogTracker's servers. Stripe also processes some payment data on its own account, as controller, to prevent fraud and comply with its legal obligations as a payment institution.

Apple and Google also act on their own account, and not on behalf of RMTracker S.L., when you download the app from their stores or use the speech recognition of their systems.

If your company came through a sales agent, that agent receives the information described in section 2, and nothing more.

Beyond these cases, data is neither sold nor disclosed to third parties except where legally required or at the request of a competent authority, such as the Labour Inspectorate, the courts or the Tax Agency.

7. International transfers

The app's data is hosted in the European Union. Some providers are companies from outside the European Economic Area or may access the data from outside to provide their service. In those cases the transfer is made only with one of the safeguards required by Chapter V of the GDPR:

You can request information about these safeguards by writing to legal@rmtrackersolutions.com.

8. Automated decisions and artificial intelligence

The app generates alerts automatically: for example, when a clock-in is made outside the radius of the assigned workplace or when a working day stays open for too long. Such alerts produce no effect by themselves: they are a signal for a person to review and decide. No automated decisions with legal or similarly significant effects within the meaning of article 22 of the GDPR are made, and no profiles are built.

WorkLogTracker does not use artificial intelligence systems to evaluate people or their performance, and the data is not used to train models. The only automatic recognition involved is voice dictation, which the phone's operating system provides when the person requests it.

9. Your rights

You may exercise the following rights at any time, free of charge:

• Access: to know whether your data is processed, which data, for what purpose, where it comes from, to whom it is disclosed and for how long.
• Rectification: to correct inaccurate data or complete incomplete data. A clock-in is rectified by means of a correction, which keeps the original.
• Erasure: to have your data deleted when it is no longer necessary, except for what must be kept by legal obligation, such as the working-time record.
• Objection: to have your data no longer processed where the processing is based on legitimate interest, unless there are compelling legitimate grounds or for the defence of claims.
• Restriction: to have it kept without being processed while a claim about its accuracy or about your objection is resolved, or when you need it for a claim.
• Portability: to receive the data you provided, in a structured and commonly used format, or to have it transmitted to another controller.
• Not to be subject to automated decisions with legal or similar effects, which WorkLogTracker does not make.
• Withdraw consent, where the processing is based on it, without affecting what was processed before.

Whom to contact:

• If you are an employee and it concerns your clock-ins, reports, absences, payslips or schedules, contact your company, which is the controller. If you write to RMTracker S.L., your request will be forwarded to it without delay.
• In all other cases — your account, your billing, your data as a sales agent or what you sent through the website — write to legal@rmtrackersolutions.com stating which right you are exercising. To delete your account you can also use the account deletion page.

If there are reasonable doubts about your identity, the information needed to confirm it may be requested. The request is handled within one month, extendable by a further two months when it is complex, and you will be told if so, in accordance with article 12 of the GDPR.

If you consider that your data has not been processed properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

10. Security

Access to data is limited by company and by role through row-level security in the database: a person can reach only the data of the company they belong to, and within it only what their role allows. Passwords are stored encrypted by the authentication provider, communications travel encrypted, data is encrypted at rest and relevant actions are logged.

Employment identifiers, being personal data that the rest of the workforce does not need to know, are stored separately from the rest of the record and are accessible only to the person concerned and to whoever manages the payroll or handles an inspection.

Access by RMTracker staff. RMTracker staff have no permanent access to a company's workforce data. Without permission, they see only the account data they need to invoice and manage the service, such as the company's details, its subscription, its payments and the acceptance of the legal texts. To help with a query, whoever has the role of owner or administrator can grant them from the app a support access permission for 24 hours, 72 hours or 7 days, and revoke it at any time. While it lasts, authorised support staff see the company's screens in read-only mode: they cannot change anything, they do not see the employment identifiers (NIF or NIE and Social Security number) or the documents sent to the workforce and their signatures, and they cannot open files, such as payslips or the attachments, photographs and signatures of work reports. Each permission, each revocation and each entry in support mode is logged, and the company can consult them in the app.

Only in an emergency (the service is not working, there is an incident affecting the integrity of the data or the company cannot grant the permission) may RMTracker's authorised technical staff consult the database directly. Before doing so they record in that log the reason, and the app notifies those with the role of owner or administrator of the company.

The detail of the measures and of how incidents are handled is in the security policy.

11. Accuracy of data and data of other people

Anyone who provides data, in the app or on the website, undertakes that it is truthful and to keep it up to date. The customer company is the one that registers its workforce and that must inform them of the processing of their data, in accordance with articles 13 and 14 of the GDPR. Anyone who records in a report the signature and document of a customer must have a reason for doing so and tell them what they are collected for.

12. Minors

The service is aimed at companies and their employees. It is not intended for minors under sixteen years of age.

13. Changes to this policy

This policy is reviewed whenever what the app or the website does changes. Any modification will be published on this page with its version number and its date of entry into force. If the change is substantial, customers will be notified through the contact details on their account. The app records which version each person accepted.