Data processing agreement

This agreement is made, under Article 28 GDPR, between the company that creates a HorarioWeb account (the controller) and Laboratorio Web Soluciones, S.L. (the processor), tax ID B13704515, Avd. de Burgos 56, 3B, 26007 Logroño, Spain, info@horarioweb.es.

Acceptance at signup, or a later acceptance inside the application, records the date, this version, and the account.

The subject matter is the working-time record: clock-ins, breaks, corrections, history, and reports of the client company's workers.

The agreement lasts as long as the account. When the account closes, the retention period below applies.

Data subjects: the client company's workers and the person who administers the account.

Data: company name, name and email of the administrator and of invited people, time entries (clock-in, clock-out, breaks, and modality), corrections and history, reports, and technical data of the access session (IP address and browser). The time entry itself does not store the IP address.

The client company relies on the legal duty in Article 34.9 of the Spanish Workers' Statute. The processor's basis is this agreement.

The processor handles the data only to provide working-time records and for what this page authorises. It does not use the data for advertising and does not sell it.

The company authorises the processor to keep, in its TalentoHQ CRM, the company name, the administrator's email, and two aggregate figures: active employees and number of entries. That record does not include time entries or identifying data of the workforce.

The notice for people is in the privacy policy.

• Process the data only on these instructions and on further instructions the company documents in writing.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply security measures: access separated by company, encrypted connection (HTTPS), tamper-resistant time entries, and copies on the same hosting server.
• Not engage another processor without informing the company. The current list is on this page. A new sub-processor changes the version and requires a new acceptance.
• Help the company respond to its workforce's rights.
• Notify the company of a personal-data breach without undue delay.
• When the service ends, return the data through the export the company requests, or delete it once four years have passed from each working day. Until that period ends, access is blocked and the entries are kept.

• Hetzner Online GmbH (Nuremberg, Germany): hosting of the application and the database.
• Amazon Web Services EMEA SARL, Amazon SES, region eu-central-1 (Frankfurt, Germany): transactional email for verification, invitations, and password resets.

Both are in the European Union. Through these sub-processors, working-time records do not leave the EU. No international-transfer safeguard is required for them.

If the company asks, the processor provides reasonable information to demonstrate compliance with this agreement, including an agreed review. That review does not give access to other companies' data.

This agreement is governed by the GDPR, Spain's LOPDGDD, and the rest of Spanish law. The parties submit disputes to the courts of Logroño.