Privacy Policy — GDPR, ePrivacy & CCPA Compliant

Privacy Policy

Last updated: October 16, 2026 — Effective: October 16, 2026
Data Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com

Not legal advice. This policy is a transparent summary of how we operate. For binding obligations, see the Data Processing Agreement (DPA) in your subscription contract. If you are a staffing agency, your company is the Controller for employee attendance data; Chegatta is the Processor.

1. Who we are and who controls what

• Website visitor: Chegatta is Controller for chegatta.com analytics and contact forms.
• Customer account (HR manager / owner): Chegatta is Controller for account data (name, work email, company).
• Employee attendance records: Your organization is Controller, Chegatta is Processor (Art. 28). We process only on your documented instructions, plus the DPA (available on request).

2. What we collect

Category	Examples	Source
Account	Name, work email, company name, hashed password, plan, billing contact	You type it
Attendance	Clock-in/out times, site polygon, break logs, device_fingerprint (hashed), Shift/KioskSession	Employee tap/scan
Registro por WhatsApp	Número del remitente, texto del mensaje, horas (WhatsappMessage, canal whatsapp)	Mensaje de WhatsApp del empleado
Hiring & HR	NIF/NISS/employee_code, contract dates, LeaveRequest, PerformanceReview	You enter / employee onboarding
Firma de contratos	NIF, teléfono enmascarado, metadatos OTP, hashes SHA-256, claves de firma, sellos RFC 3161, sello PAdES, IP truncada	Ceremonia de firma del colaborador
Fotografías	Fotos de perfil que subes (galería o cámara); selfis de verificación de entrada/salida (cámara)	Tu elección / fichaje
Technical	IP (truncated), User-Agent, device model, app version, crash logs (ErrorLog)	Automatic at request
Support	Messages to privacy@ / support, Lead/Trial form	You send
Business contacts	Public business email, company, professional name from company websites	Public sources, for relevant B2B outreach (see §4)

No recogemos: plantillas biométricas (nunca se realiza reconocimiento ni comparación facial — las fotos son solo evidencia para revisión humana), contactos ni historial de navegación.

3. How we collect it

• Directly from you (forms, dashboard, mobile browser/PWA or native iOS/Android apps).
• Automatically: IP + device at clock-in, and cookieless analytics via Umami Cloud (no third-party advertising cookies — see §8).
• From subprocessors (hosting, email) under Art. 28 contracts.

4. Why we use it — legal bases (GDPR Art. 6)

Purpose	Basis
Provide the service (account, clock-in, rosters, payroll calc, SEPA pain.001, Recibo)	Contract (Art.6(1)(b))
Fotografías del empleado — avatar para identificación en el equipo; selfis como prueba de asistencia	Contrato (art. 6.1.b), gestión laboral. No se invoca el consentimiento en el contexto laboral
Keep attendance for labour law (PT Art.334 5y / ES Art.34.9 4y / 11h rest)	Legal obligation (Art.6(1)(c))
Security (TLS, SHA-256 device check, hash-chained audit, rate limiting)	Legitimate interest + Legal obligation
Improve the product (aggregate, not personal)	Legitimate interest (balanced)
Newsletter & product news (opt-in checkbox)	Consent (Art.6(1)(a)) — withdraw anytime
B2B outreach to business contacts (public business email, relevant offer)	Legitimate interest (Art.6(1)(f)) — one sequence max, one-click opt-out, deleted on objection
Cookie analytics (non-essential)	Consent (ePrivacy) — blocked until you Accept

5. Cookies & tracking — your choice on first visit

On your first visit we show a cookie banner (see bottom of every page). You can Accept all / Reject all / Customize.

Type	Name / Provider	Purpose	Duration	Needs consent?
Necessary	chegatta-cookie-consent, NEXT_LOCALE	Remember consent choice + language	12 months	No (strictly necessary)
Functional	device_fingerprint (hashed)	Prevent buddy punching (Shift/KioskSession)	Per shift	No — service operation
Analytics	Umami Cloud (cookieless by default, no cross-site tracking)	Pages visited, time on site, referrer (aggregate)	Session — only if you Accept analytics	Yes
No advertising	—	We use no third-party ad cookies, no data-broker sharing	—	—

Withdraw or change at any time: footer Cookie Preferences or clear chegatta-cookie-consent in your browser.

6. How we share — subprocessors (Art. 28)

We do not sell personal data. Sharing only with:

• Hosting & infra: AWS EU (eu-west-1, Ireland) — TLS in transit + encryption at rest, s3:GetObject for deploys.
• Email: Resend (transactional + opted-in/newsletter mail, Art.28 DPA; US processing under SCCs).
• SMS: Vonage (one-time codes & notifications to your phone number, Art.28 DPA).
• Push: Firebase Cloud Messaging / Expo Push (shift reminders to your device token, Art.28 DPA).
• WhatsApp (donde esté activo): Meta Platforms (notificaciones de turno + mensajes de registro, Art.28 DPA).
• Analytics (if you consent): Umami Cloud EU (cookieless, DPA).
• Legal / safety: when required by law or to protect rights.

Full subprocessor list on request: privacy@chegatta.com. We sign DPAs with each.

7. International transfers

Primary storage EU (Ireland). Email (Resend), SMS (Vonage), push (Google/Expo) and WhatsApp (Meta) process contact details in the US under SCCs (Art.46) + encryption. If support accesses from outside EEA, same safeguards. No transfer of attendance data outside EEA without your instruction.

8. Retention — how long we keep it

Data	Retention	Legal note
Account	While active + 12 months after deletion (to handle disputes)	Then deleted or anonymized
Attendance / Shifts / KioskSessions	Per your setting, or PT 5 years / ES 4 years (labour law)	Art. 334 PT, Art.34.9 ES
Payslips / SEPA runs / Audit chain	Same as attendance — locked runs immutable, new version on edit	Hash-chain re-verifiable
IP / raw device fingerprint / User-Agent	Anonymized after 90 days (truncated, hashed) — kept as anomaly stats only	GDPR minimization
Fotos de entrada/salida	Eliminadas automáticamente tras 365 días por el trabajo diario de privacidad	Prueba mientras recientes, después minimización
Fotos de perfil	Duración del vínculo; eliminadas al sustituir, eliminar explícitamente o anonimizar a la salida	Identidad en vistas de equipo
Evidencia de firma	Guardada con el contrato como registro legal; IP y dispositivo anonimizados tras 90 días; enlace público revocable por el empleador	Prueba de autoría e integridad
Support tickets / Leads	24 months
Contenido de mensajes de WhatsApp	Eliminado tras 90 días (fechas, estados y turnos con la asistencia)	Minimización RGPD
Outreach contacts (public B2B)	Deleted within 30 days of objection or after 24 months of no reply	Suppression list (email only) kept to honour opt-outs
Backups	Daily, retained 14 days, encrypted	Then overwritten

9. Security

• TLS 1.2+ in transit, encryption at rest, SHA-256 device + document hashing, hash-chained ContractAuditEvent (tamper-evident), daily encrypted backups, role-based access (KioskPolicy, SiteManagerGrants), rate limiting (clock-by-id 10/min).

See Security page /en/security.

10. Your rights (GDPR Art.15-22 + CCPA)

For EEA/UK (GDPR) and California (CCPA — “Do Not Sell” — we don’t sell), you can:

• Access — copy of data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete (subject to 5y/4y labour retention)
• Restriction — limit processing
• Portability — CSV/JSON of your data
• Object — to legitimate-interest processing
• Withdraw consent — for marketing/analytics (doesn’t affect prior lawfulness)
• Complain — to your DPA (PT: CNPD, ES: AEPD, EU) or AG in California

Exercise: email privacy@chegatta.com — we reply within 30 days. For ATTENDANCE data where you are the Controller, we forward the request to your HR admin as Processor.

No automated decision-making with legal/significant effects (Art.22) — managers approve overtime/anomalies.

11. Children

Service not directed to children under 16. We do not knowingly collect their data. If you believe a child’s data was provided, contact us for deletion.

12. Changes to this policy

Material changes posted here with new Last updated date + banner in dashboard. Continued use after changes = acceptance. For major changes we email account owners.

13. Contact — Controller

• Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com
• Postal: on request via privacy@
• Contact form: /en/contact

14. Consent banner — how to manage

Your choice is stored as chegatta-cookie-consent = {necessary:true, analytics:false/true, marketing:false/true} in localStorage. Change anytime:

• Click Cookie Preferences in the footer, or
• Clear site data in browser → banner reappears.

Analytics and marketing cookies/scripts are blocked until you click Accept.

---

If you are a customer, this policy is supplemented by your Subscription Agreement + DPA. For the staffing-agency Controller/Processor split, see Multi-Company docs.