Privacy Policy — GDPR, ePrivacy & CCPA Compliant

Privacy Policy

Last updated: October 16, 2026 — Effective: October 16, 2026
Data Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com

Not legal advice. This policy is a transparent summary of how we operate. For binding obligations, see the Data Processing Agreement (DPA) in your subscription contract. If you are a staffing agency, your company is the Controller for employee attendance data; Chegatta is the Processor.

1. Who we are and who controls what

• Website visitor: Chegatta is Controller for chegatta.com analytics and contact forms.
• Customer account (HR manager / owner): Chegatta is Controller for account data (name, work email, company).
• Employee attendance records: Your organization is Controller, Chegatta is Processor (Art. 28). We process only on your documented instructions, plus the DPA (available on request).

2. What we collect

Category	Examples	Source
Account	Name, work email, company name, hashed password, plan, billing contact	You type it
Attendance	Clock-in/out times, site polygon, break logs, device_fingerprint (hashed), Shift/KioskSession	Employee tap/scan
WhatsApp clock	Sender phone, message text, clock times (WhatsappMessage, channel whatsapp)	Employee WhatsApp message
Hiring & HR	NIF/NISS/employee_code, contract dates, LeaveRequest, PerformanceReview	You enter / employee onboarding
Contract signing	NIF, masked phone, OTP metadata, SHA-256 hashes, signing keys, RFC 3161 timestamps, PAdES seal, truncated IP	Employee signing ceremony
Photos	Profile photos you upload (gallery or camera); clock-in/out verification selfies (camera)	Your choice / punch ceremony
Technical	IP (truncated), User-Agent, device model, app version, crash logs (ErrorLog)	Automatic at request
Support	Messages to privacy@ / support, Lead/Trial form	You send
Business contacts	Public business email, company, professional name from company websites	Public sources, for relevant B2B outreach (see §4)

We do not collect: biometric templates (no facial recognition or matching is ever performed — photos are human-viewed evidence only), contacts, or browsing history.

3. How we collect it

• Directly from you (forms, dashboard, mobile browser/PWA or native iOS/Android apps).
• Automatically: IP + device at clock-in, and cookieless analytics via Umami Cloud (no third-party advertising cookies — see §8).
• From subprocessors (hosting, email) under Art. 28 contracts.

4. Why we use it — legal bases (GDPR Art. 6)

Purpose	Basis
Provide the service (account, clock-in, rosters, payroll calc, SEPA pain.001, Recibo)	Contract (Art.6(1)(b))
Employee photos — profile avatars for team identification; clock selfies as attendance evidence	Contract (Art.6(1)(b), employment administration). Consent is not relied on in the employment context
Keep attendance for labour law (PT Art.334 5y / ES Art.34.9 4y / 11h rest)	Legal obligation (Art.6(1)(c))
Security (TLS, SHA-256 device check, hash-chained audit, rate limiting)	Legitimate interest + Legal obligation
Improve the product (aggregate, not personal)	Legitimate interest (balanced)
Newsletter & product news (opt-in checkbox)	Consent (Art.6(1)(a)) — withdraw anytime
B2B outreach to business contacts (public business email, relevant offer)	Legitimate interest (Art.6(1)(f)) — one sequence max, one-click opt-out, deleted on objection
Cookie analytics (non-essential)	Consent (ePrivacy) — blocked until you Accept

5. Cookies & tracking — your choice on first visit

On your first visit we show a cookie banner (see bottom of every page). You can Accept all / Reject all / Customize.

Type	Name / Provider	Purpose	Duration	Needs consent?
Necessary	chegatta-cookie-consent, NEXT_LOCALE	Remember consent choice + language	12 months	No (strictly necessary)
Functional	device_fingerprint (hashed)	Prevent buddy punching (Shift/KioskSession)	Per shift	No — service operation
Analytics	Umami Cloud (cookieless by default, no cross-site tracking)	Pages visited, time on site, referrer (aggregate)	Session — only if you Accept analytics	Yes
No advertising	—	We use no third-party ad cookies, no data-broker sharing	—	—

Withdraw or change at any time: footer Cookie Preferences or clear chegatta-cookie-consent in your browser.

6. How we share — subprocessors (Art. 28)

We do not sell personal data. Sharing only with:

• Hosting & infra: AWS EU (eu-west-1, Ireland) — TLS in transit + encryption at rest, s3:GetObject for deploys.
• Email: Resend (transactional + opted-in/newsletter mail, Art.28 DPA; US processing under SCCs).
• SMS: Vonage (one-time codes & notifications to your phone number, Art.28 DPA).
• Push: Firebase Cloud Messaging / Expo Push (shift reminders to your device token, Art.28 DPA).
• WhatsApp (where enabled): Meta Platforms (template shift notifications + inbound clock-in messages, Art.28 DPA).
• Analytics (if you consent): Umami Cloud EU (cookieless, DPA).
• Legal / safety: when required by law or to protect rights.

Full subprocessor list on request: privacy@chegatta.com. We sign DPAs with each.

7. International transfers

Primary storage EU (Ireland). Email (Resend), SMS (Vonage), push (Google/Expo) and WhatsApp (Meta) process contact details in the US under SCCs (Art.46) + encryption. If support accesses from outside EEA, same safeguards. No transfer of attendance data outside EEA without your instruction.

8. Retention — how long we keep it

Data	Retention	Legal note
Account	While active + 12 months after deletion (to handle disputes)	Then deleted or anonymized
Attendance / Shifts / KioskSessions	Per your setting, or PT 5 years / ES 4 years (labour law)	Art. 334 PT, Art.34.9 ES
Payslips / SEPA runs / Audit chain	Same as attendance — locked runs immutable, new version on edit	Hash-chain re-verifiable
IP / raw device fingerprint / User-Agent	Anonymized after 90 days (truncated, hashed) — kept as anomaly stats only	GDPR minimization
Clock-in/out photos	Auto-deleted after 365 days by the daily privacy job	Evidence while fresh, then minimization
Profile photos	Duration of employment; deleted on replacement, explicit removal, or offboarding anonymization	Identity in team views
Signature evidence	Kept with the contract as a legal record; IP and device anonymized after 90 days; public verification link revocable by the employer	Proof of authorship and integrity
Support tickets / Leads	24 months
WhatsApp message content	Deleted after 90 days (timestamps, status, shift links kept with attendance)	GDPR minimization
Outreach contacts (public B2B)	Deleted within 30 days of objection or after 24 months of no reply	Suppression list (email only) kept to honour opt-outs
Backups	Daily, retained 14 days, encrypted	Then overwritten

9. Security

• TLS 1.2+ in transit, encryption at rest, SHA-256 device + document hashing, hash-chained ContractAuditEvent (tamper-evident), daily encrypted backups, role-based access (KioskPolicy, SiteManagerGrants), rate limiting (clock-by-id 10/min).

See Security page /en/security.

10. Your rights (GDPR Art.15-22 + CCPA)

For EEA/UK (GDPR) and California (CCPA — “Do Not Sell” — we don’t sell), you can:

• Access — copy of data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete (subject to 5y/4y labour retention)
• Restriction — limit processing
• Portability — CSV/JSON of your data
• Object — to legitimate-interest processing
• Withdraw consent — for marketing/analytics (doesn’t affect prior lawfulness)
• Complain — to your DPA (PT: CNPD, ES: AEPD, EU) or AG in California

Exercise: email privacy@chegatta.com — we reply within 30 days. For ATTENDANCE data where you are the Controller, we forward the request to your HR admin as Processor.

No automated decision-making with legal/significant effects (Art.22) — managers approve overtime/anomalies.

11. Children

Service not directed to children under 16. We do not knowingly collect their data. If you believe a child’s data was provided, contact us for deletion.

12. Changes to this policy

Material changes posted here with new Last updated date + banner in dashboard. Continued use after changes = acceptance. For major changes we email account owners.

13. Contact — Controller

• Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com
• Postal: on request via privacy@
• Contact form: /en/contact

14. Consent banner — how to manage

Your choice is stored as chegatta-cookie-consent = {necessary:true, analytics:false/true, marketing:false/true} in localStorage. Change anytime:

• Click Cookie Preferences in the footer, or
• Clear site data in browser → banner reappears.

Analytics and marketing cookies/scripts are blocked until you click Accept.

---

If you are a customer, this policy is supplemented by your Subscription Agreement + DPA. For the staffing-agency Controller/Processor split, see Multi-Company docs.