← Back to sign-in

Privacy policy

This policy explains how Assessoria Tomàs processes the personal data of the people who use this time-tracking application, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

The data controller is Assessoria Tomàs, in its capacity as employer. For any question about your data, you can contact the company through the usual channels (administration or HR department).

2. Purpose

The data are processed in order to:

  • Keep the daily working-time record required by article 34.9 of the Spanish Workers' Statute (Royal Legislative Decree 2/2015), with the exact start and end time of each working day.
  • Managing requests for absences, leave and holidays, and the work calendar.
  • Recording the customer visits made by field staff.
  • Send the application notices related to these tasks (for example, password resets or notices about leave requests).

No automated decisions are taken and no profiles are built with these data.

3. Data processed

  • Identification and work contact details: first name, surname, username and e-mail address.
  • Working-time record: date and time of each clock-in and clock-out and, if given, the reason.
  • Geolocation when clocking in or out: if the browser allows it, the approximate coordinates of the device at the moment the clock-in or clock-out is recorded. Location is not tracked at any other time. To turn these coordinates into an approximate address, they are sent to the Google Maps geocoding service.
  • Absences and holidays: requested dates, type, reason and status of the request.
  • Customer visits: customer, date, time, notes and location at the moment the visit is recorded.

4. Legal basis

The processing is necessary to comply with a legal obligation applicable to the company (art. 6.1.c GDPR, in connection with article 34.9 of the Workers' Statute) and for the performance of the employment relationship (art. 6.1.b GDPR).

5. Retention period

Working-time records are kept for four years, as established by article 34.9 of the Workers' Statute. Other data are kept for as long as the employment relationship lasts and, afterwards, for the limitation periods of any legal liabilities that may arise.

6. Recipients and data processors

The records are available to the employee, to their legal representatives and to the Labour and Social Security Inspectorate, as provided by law. No data are disclosed to third parties unless required by law.

The following have access to the data, solely to provide the service to the company and under a data processing agreement:

  • The Fichaje Online service provider (fichajeonline.es), which hosts the application and the data on servers located in the European Union and sends its automated e-mails.
  • Google (Google Maps geocoding service), only for the clock-in coordinates. Any international transfers this may involve rely on the appropriate safeguards provided for in the GDPR (EU-US Data Privacy Framework and standard contractual clauses).

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to Assessoria Tomàs. Please note that working-time records cannot be erased while the legal retention obligation lasts.

If you believe the processing does not comply with the regulations, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

Access to the application is personal, with a username and password, and communications are encrypted (HTTPS). Keep your password secret and sign out if you use a shared device.

Last updated: 15 November 2026.