This document is Annex I to the WorkLogTracker Terms of Use and forms an inseparable part of them. It governs the processing of personal data that RMTracker carries out on behalf of the employing company that subscribes to the service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Who is who
Controller: the employing company that subscribes to the service. It decides for what purposes and how the data is processed, and is answerable to the data subjects and to the supervisory authority.
Processor:
- Processor: RMTracker S.L. ("RMTracker")
- Tax ID (NIF): B88803085
- Address: Avenida de Andalucía no. 36, Local 2, 29793 Torrox, Málaga (Spain)
- Data protection email:
legal@rmtrackersolutions.com
RMTracker processes the data solely to provide the service. It does not use it for its own purposes, does not disclose it to third parties except where legally required, does not sell it and does not use it to train artificial intelligence systems.
2. Subject matter, nature and purpose
To record the working time of the controller's workforce, manage schedules and workplaces, document work reports, make available to each worker the payslips that the controller decides to store, handle incidents and correction requests, and generate the reports and exports that the controller requests. The operations comprise collection, recording, structuring, storage, consultation, communication to the controller itself, erasure and destruction. No other purpose is pursued: the data is not used for profiling, for advertising or for training models.
3. Duration
This annex enters into force when it is accepted and lasts for as long as the service contract is in force. When it ends, the provisions of section 9 apply.
4. Categories of data
| Category | What it includes |
|---|---|
| Identification | First name and surname, email address, telephone number if provided |
| Employment relationship | Employee code, position, role, workplace, assigned schedule |
| Employment identifiers | NIF or NIE and Social Security affiliation number |
| Working time | Clock-ins, breaks and clock-outs with date and time, associated workplace and remarks |
| Absences | Type (holiday, personal matters, paid leave or medical leave), dates, half day or time slot, reason if stated, status of the request, who requested it and who resolved it, annual allowance and days used |
| Payslips | Salary receipt in PDF that the controller decides to store, with its month, the file name and size, and when the person concerned first opened it |
| Location | Coordinates and accuracy at the specific moment of each clock-in |
| Work reports | Tasks, materials, expenses, mileage, photographs and the customer's handwritten signature with their name and document |
| Incidents and corrections | Alerts generated, requests submitted and their resolution |
| Traceability | Log of relevant actions on the above data |
5. Categories of data subjects
- The controller's workers registered in the application.
- Contact persons of the controller's customers who sign a work report.
5 bis. Particularities of this service
The service processes, on behalf of the controller, one item of special category data under Article 9 of the GDPR: that a worker is on medical leave, with its dates. No diagnoses or medical certificates are requested, and within the company medical leave is visible only to the person concerned and to the owner, administrator and auditor roles; team managers see neither its type nor its dates. No biometric data is used for clocking in. The controller undertakes not to enter diagnoses or other clinical information, or data of other special categories, in the free-text fields, including the reason for an absence and the comment of the person who resolves it.
Location is checked only at the moment of clocking in, to verify the distance to the assigned workplace, and no continuous tracking is carried out. It is for the controller to inform the workforce and their representatives expressly and in advance, in accordance with Article 90 of the LOPDGDD. If location permission is denied, the clock-in is recorded anyway without coordinates.
Storing payslips in the application is optional for the controller, which may delete them at any time. Within the company only the person concerned and the owner, administrator and auditor roles see them; team managers do not. They are kept for the period that the controller configures in the application, which may not be shorter than four years.
The payment gateway is not listed among the sub-processors because it does not access the workforce data: it is involved only in invoicing the customer, a processing activity in which RMTracker acts as controller and not as processor.
6. Obligations of RMTracker as processor
In accordance with Article 28(3) of the GDPR, RMTracker undertakes to:
- Process the data only on documented instructions from the controller, including those relating to international transfers. Normal use of the service constitutes that instruction. If RMTracker considers that an instruction infringes data protection legislation, it will inform the controller immediately.
- Ensure confidentiality of those who access the data, by express undertaking or statutory duty, which continues after the end of the relationship.
- Apply the measures under Article 32, described in section 7.
- Not engage another processor without authorisation. The controller authorises the sub-processors listed in section 8. Any addition or replacement will be notified thirty days in advance and the controller may object; if it objects and the change is essential to provide the service, it may terminate the contract without penalty.
- Assist the controller so that it can respond to the exercise of the rights of access, rectification, erasure, restriction, portability and objection. If a data subject contacts RMTracker directly, they will be referred to the controller and the controller will be informed without delay.
- Assist the controller in complying with Articles 32 to 36: security, breach notification and impact assessment.
- Notify personal data breaches without undue delay and, in any case, within forty-eight hours of becoming aware of them, with the information required by Article 33(3) that is available to it. Forty-eight and not seventy-two because the controller needs margin to comply with its own deadline.
- Erase or return the data at the end, in accordance with section 9.
- Make available to the controller the information necessary to demonstrate compliance with this annex, and allow for and contribute to audits, in accordance with section 10.
7. Security measures
The measures are described by what the system does, not by what is usually said in a contract. They are verifiable:
- Isolation between companies. Access to the data is restricted in the database itself by means of row-level security: a person can only reach the data of the company to which they belong.
- Role-based access control. Within each company, what each person can see and do depends on their role, enforced on the server as well and not only in the interface.
- Separation of employment identifiers. The NIF and the Social Security number are stored separately from the rest of the record and are accessible only to the person concerned and to whoever manages payroll or handles an inspection.
- Payslips in private storage. The payslip files are kept in non-public storage, restricted by company and by role, and are downloaded through short-lived signed links. Who uploads them and who deletes them is logged.
- Encryption. Communications are transmitted encrypted and passwords are stored using resistant key derivation functions.
- Integrity of the record. Clock-ins cannot be altered or deleted: an error is corrected by means of an approved correction that is logged alongside the original clock-in.
- Traceability. Relevant actions on the data are logged with their author and time.
- Access by RMTracker staff only with permission. RMTracker staff have no permanent access to the controller's operational data. They access it on a read-only basis when an owner or administrator of the controller grants them from the application a temporary permission of 24 hours, 72 hours or 7 days, which can be revoked at any time, and even then without access to employment identifiers, workforce documents or stored files. Each permission, revocation and access is logged and the controller can consult it in the application. Direct querying of the database is reserved for emergencies, is logged beforehand with its reason and is notified to the controller's owners and administrators.
- Backups managed by the hosting sub-processor, with recovery to an earlier point in time.
- Minimisation. Location is checked only at the moment of clocking in and no continuous tracking is carried out.
The measures may evolve. RMTracker will not degrade them: any change will maintain an equivalent or higher level of protection.
8. Authorised sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Hosting of the database, authentication and storage of attached files and payslips | European Union (Ireland region) |
With each sub-processor RMTracker maintains a contract that imposes the same obligations as this annex, and answers to the controller for its performance as if it were RMTracker's own.
9. End of the processing engagement
Once the contract has ended, RMTracker will erase the personal data processed on behalf of the controller, or will return it in a commonly used and machine-readable format if the controller so requests before erasure, and will erase the existing copies.
Once the subscription has ended, the controller has thirty days to export its data using the application's own functions. After that period, RMTracker will erase the personal data processed on its behalf, including copies, unless it is required to keep them by a legal obligation, in which case they will be blocked for the corresponding period. The controller may request beforehand the return of the data in a structured and commonly used format, or immediate erasure, which will be confirmed in writing if so requested. It should be remembered that employment legislation requires the controller to keep the working-time record for four years: exporting before erasure is not a recommendation, it is what allows the controller to keep complying with that obligation.
10. Audit
The controller may request, once a year and with fifteen days' notice, the information necessary to demonstrate compliance with this annex. It may also carry out an audit, itself or through an independent third party that is not a competitor of RMTracker, subject to prior agreement on date, scope and confidentiality, and without interrupting the service.
Additional audits arising from a security breach, from a request by the supervisory authority or from a demonstrated non-compliance are not subject to that annual limit.
11. Confidentiality undertaking
This section replaces a separate confidentiality agreement, so that it is not necessary to sign a separate document.
Both parties undertake to keep secret the confidential information of the other to which they have access in connection with this relationship, to use it only to perform it and not to disclose it to third parties without written authorisation. Non-public technical, commercial, financial and organisational information is considered confidential and, in particular, the personal data processed under this annex.
The following information is not confidential:
- information that was public before being received, or becomes public without breach of this undertaking;
- information already lawfully held by the receiving party without a duty of secrecy;
- information developed independently without using the information of the other party; or
- information that must be disclosed by legal requirement or at the request of a competent authority, in which case the other party will be notified beforehand whenever that is lawful.
This undertaking remains in force for three years after the relationship ends. For personal data there is no time limit: the duty of confidentiality under Article 28(3)(b) of the GDPR does not expire.
12. Liability
Each party is liable for the damage it causes by breaching the obligations that this annex and the GDPR impose on it, on the terms of Article 82 of the Regulation. RMTracker is not liable for the controller's instructions or for the lawfulness of the processing that the controller decides on.
13. Acceptance without signature
This annex is accepted electronically when the account is created, in the manner permitted by Article 28(9) of the GDPR, and does not require a handwritten signature. A record of each acceptance is kept: who made it, when, and which version of the text was in force. The controller may request a certificate of its acceptances at any time.
If this annex changes, reasonable notice will be given and a new acceptance will be obtained. The previous ones are kept: they are the history of what was in force at each moment.
14. Governing law
This annex is governed by the GDPR, by Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights, and by Spanish law. In matters not provided for here, the WorkLogTracker Terms of Use, of which it forms part, apply.