Privacy Policy

1. Data controller

Holder: Noah Merlijn Winkelman (trading as Selva Digital).

NIE Y4843247J.

Address: Avinguda Puigcerver 13, 17251 Calonge (Girona), España.

Data-protection contact: noah@selvadigital.eu.

2. Data we process

— Identification and contact data: name and email address.

— Time records: dates, start/pause/stop times and the duration of each work session.

— Geolocation data: device location recorded only while the timer is running (see section 5).

— Photos and notes that a worker attaches to a work entry.

— Technical data strictly necessary for the session (authentication cookie).

3. Purpose

We process this data to: record working hours and time spent on each project; comply with the legal obligation to keep a daily time record; manage project assignments; document work via photos; and prepare client invoicing.

4. Legal basis

— Performance of the employment contract and management of the employment relationship (Art. 6(1)(b) GDPR).

— Compliance with a legal obligation: the daily working-time record (Art. 6(1)(c) GDPR; Art. 34.9 of the Spanish Workers' Statute).

— The employer's legitimate interest in verifying work performance and location during working hours, with prior information to staff (Art. 6(1)(f) GDPR), applied proportionately.

5. Geolocation during working hours

Location is recorded only while the timer is running, including a periodic refresh (roughly every 60 seconds) for as long as the session stays active. We do not track your location outside working hours or while the timer is stopped.

The purpose is to evidence presence on site and the accuracy of the time record. The processing is proportionate to that purpose and the data is retained as described in section 7.

You may deny the location permission on your device; the session is still recorded, flagged as 'location not captured', which the company may take into account.

Before using the app you are informed of this processing and asked to acknowledge that you have been informed.

6. Recipients and processors

We do not sell your data. We share it only with providers acting as processors on the controller's behalf:

— Hosting and infrastructure (servers and database within the European Union).

— Transactional email delivery (invitations and password resets).

— Invoicing tool, to issue invoices to clients.

No international transfers outside the European Economic Area are foreseen; should any occur, they will be covered by appropriate safeguards under the GDPR.

7. Retention

Time records are kept for at least four years, in line with the legal working-time record obligation. Photos, notes and geolocation data are kept only for as long as necessary for the stated purpose and are deleted or blocked once no longer needed and after applicable limitation periods.

8. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to noah@selvadigital.eu. From your account you can also download a copy of your data and request deletion of your account.

You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the law.

9. Security

We apply technical and organisational measures to protect your data: passwords stored hashed, role-based access control, photos stored privately and served only to authorised users, and encrypted connections.