Privacy Policy — GDPR, ePrivacy & CCPA Compliant

Privacy Policy

Last updated: October 16, 2026 — Effective: October 16, 2026
Data Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com

Not legal advice. This policy is a transparent summary of how we operate. For binding obligations, see the Data Processing Agreement (DPA) in your subscription contract. If you are a staffing agency, your company is the Controller for employee attendance data; Chegatta is the Processor.

1. Who we are and who controls what

• Website visitor: Chegatta is Controller for chegatta.com analytics and contact forms.
• Customer account (HR manager / owner): Chegatta is Controller for account data (name, work email, company).
• Employee attendance records: Your organization is Controller, Chegatta is Processor (Art. 28). We process only on your documented instructions, plus the DPA (available on request).

2. What we collect

Category	Examples	Source
Account	Name, work email, company name, hashed password, plan, billing contact	You type it
Attendance	Clock-in/out times, site polygon, break logs, device_fingerprint (hashed), Shift/KioskSession	Employee tap/scan
Picagem por WhatsApp	Número do remetente, texto da mensagem, horas (WhatsappMessage, canal whatsapp)	Mensagem WhatsApp do colaborador
Hiring & HR	NIF/NISS/employee_code, contract dates, LeaveRequest, PerformanceReview	You enter / employee onboarding
Assinatura de contratos	NIF, telefone mascarado, metadados OTP, hashes SHA-256, chaves de assinatura, carimbos RFC 3161, selo PAdES, IP truncado	Cerimónia de assinatura do colaborador
Fotografias	Fotos de perfil que carrega (galeria ou câmara); selfies de verificação de entrada/saída (câmara)	Escolha do utilizador / cerimónia de ponto
Technical	IP (truncated), User-Agent, device model, app version, crash logs (ErrorLog)	Automatic at request
Support	Messages to privacy@ / support, Lead/Trial form	You send
Business contacts	Public business email, company, professional name from company websites	Public sources, for relevant B2B outreach (see §4)

Não recolhemos: modelos biométricos (nunca é feito reconhecimento ou comparação facial — as fotografias são apenas evidência para visualização humana), contactos ou histórico de navegação.

3. How we collect it

• Directly from you (forms, dashboard, mobile browser/PWA or native iOS/Android apps).
• Automatically: IP + device at clock-in, and cookieless analytics via Umami Cloud (no third-party advertising cookies — see §8).
• From subprocessors (hosting, email) under Art. 28 contracts.

4. Why we use it — legal bases (GDPR Art. 6)

Purpose	Basis
Provide the service (account, clock-in, rosters, payroll calc, SEPA pain.001, Recibo)	Contract (Art.6(1)(b))
Fotografias do colaborador — avatar para identificação na equipa; selfies como prova de assiduidade	Contrato (art. 6.º, n.º 1, al. b), gestão laboral. O consentimento não é invocado no contexto laboral
Keep attendance for labour law (PT Art.334 5y / ES Art.34.9 4y / 11h rest)	Legal obligation (Art.6(1)(c))
Security (TLS, SHA-256 device check, hash-chained audit, rate limiting)	Legitimate interest + Legal obligation
Improve the product (aggregate, not personal)	Legitimate interest (balanced)
Newsletter & product news (opt-in checkbox)	Consent (Art.6(1)(a)) — withdraw anytime
B2B outreach to business contacts (public business email, relevant offer)	Legitimate interest (Art.6(1)(f)) — one sequence max, one-click opt-out, deleted on objection
Cookie analytics (non-essential)	Consent (ePrivacy) — blocked until you Accept

5. Cookies & tracking — your choice on first visit

On your first visit we show a cookie banner (see bottom of every page). You can Accept all / Reject all / Customize.

Type	Name / Provider	Purpose	Duration	Needs consent?
Necessary	chegatta-cookie-consent, NEXT_LOCALE	Remember consent choice + language	12 months	No (strictly necessary)
Functional	device_fingerprint (hashed)	Prevent buddy punching (Shift/KioskSession)	Per shift	No — service operation
Analytics	Umami Cloud (cookieless by default, no cross-site tracking)	Pages visited, time on site, referrer (aggregate)	Session — only if you Accept analytics	Yes
No advertising	—	We use no third-party ad cookies, no data-broker sharing	—	—

Withdraw or change at any time: footer Cookie Preferences or clear chegatta-cookie-consent in your browser.

6. How we share — subprocessors (Art. 28)

We do not sell personal data. Sharing only with:

• Hosting & infra: AWS EU (eu-west-1, Ireland) — TLS in transit + encryption at rest, s3:GetObject for deploys.
• Email: Resend (transactional + opted-in/newsletter mail, Art.28 DPA; US processing under SCCs).
• SMS: Vonage (one-time codes & notifications to your phone number, Art.28 DPA).
• Push: Firebase Cloud Messaging / Expo Push (shift reminders to your device token, Art.28 DPA).
• WhatsApp (onde ativo): Meta Platforms (notificações de turno + mensagens de picagem, Art.28 DPA).
• Analytics (if you consent): Umami Cloud EU (cookieless, DPA).
• Legal / safety: when required by law or to protect rights.

Full subprocessor list on request: privacy@chegatta.com. We sign DPAs with each.

7. International transfers

Primary storage EU (Ireland). Email (Resend), SMS (Vonage), push (Google/Expo) and WhatsApp (Meta) process contact details in the US under SCCs (Art.46) + encryption. If support accesses from outside EEA, same safeguards. No transfer of attendance data outside EEA without your instruction.

8. Retention — how long we keep it

Data	Retention	Legal note
Account	While active + 12 months after deletion (to handle disputes)	Then deleted or anonymized
Attendance / Shifts / KioskSessions	Per your setting, or PT 5 years / ES 4 years (labour law)	Art. 334 PT, Art.34.9 ES
Payslips / SEPA runs / Audit chain	Same as attendance — locked runs immutable, new version on edit	Hash-chain re-verifiable
IP / raw device fingerprint / User-Agent	Anonymized after 90 days (truncated, hashed) — kept as anomaly stats only	GDPR minimization
Fotos de entrada/saída	Apagadas automaticamente após 365 dias pelo trabalho diário de privacidade	Prova enquanto recentes, depois minimização
Fotos de perfil	Duração do vínculo; apagadas ao substituir, remover explicitamente ou anonimizar na saída	Identidade nas vistas de equipa
Evidência de assinatura	Guardada com o contrato como registo legal; IP e dispositivo anonimizados após 90 dias; link público de verificação revogável pelo empregador	Prova de autoria e integridade
Support tickets / Leads	24 months
Conteúdo de mensagens WhatsApp	Apagado após 90 dias (datas, estados e turnos mantidos com a assiduidade)	Minimização RGPD
Outreach contacts (public B2B)	Deleted within 30 days of objection or after 24 months of no reply	Suppression list (email only) kept to honour opt-outs
Backups	Daily, retained 14 days, encrypted	Then overwritten

9. Security

• TLS 1.2+ in transit, encryption at rest, SHA-256 device + document hashing, hash-chained ContractAuditEvent (tamper-evident), daily encrypted backups, role-based access (KioskPolicy, SiteManagerGrants), rate limiting (clock-by-id 10/min).

See Security page /en/security.

10. Your rights (GDPR Art.15-22 + CCPA)

For EEA/UK (GDPR) and California (CCPA — “Do Not Sell” — we don’t sell), you can:

• Access — copy of data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete (subject to 5y/4y labour retention)
• Restriction — limit processing
• Portability — CSV/JSON of your data
• Object — to legitimate-interest processing
• Withdraw consent — for marketing/analytics (doesn’t affect prior lawfulness)
• Complain — to your DPA (PT: CNPD, ES: AEPD, EU) or AG in California

Exercise: email privacy@chegatta.com — we reply within 30 days. For ATTENDANCE data where you are the Controller, we forward the request to your HR admin as Processor.

No automated decision-making with legal/significant effects (Art.22) — managers approve overtime/anomalies.

11. Children

Service not directed to children under 16. We do not knowingly collect their data. If you believe a child’s data was provided, contact us for deletion.

12. Changes to this policy

Material changes posted here with new Last updated date + banner in dashboard. Continued use after changes = acceptance. For major changes we email account owners.

13. Contact — Controller

• Controller: Muhammad Uzair, sole proprietor trading as Chegatta (Portugal) — privacy@chegatta.com
• Postal: on request via privacy@
• Contact form: /en/contact

14. Consent banner — how to manage

Your choice is stored as chegatta-cookie-consent = {necessary:true, analytics:false/true, marketing:false/true} in localStorage. Change anytime:

• Click Cookie Preferences in the footer, or
• Clear site data in browser → banner reappears.

Analytics and marketing cookies/scripts are blocked until you click Accept.

---

If you are a customer, this policy is supplemented by your Subscription Agreement + DPA. For the staffing-agency Controller/Processor split, see Multi-Company docs.