Privacy policy

1. Who is who

AccessTime is a platform of ABARCANDO, S.L. (Spanish tax ID B88017173), C/ Casuarina 18, 7AD, 28044 Madrid (Spain), registered in the Madrid Companies Register (Volume 37133, Folio 40, Section 8, Sheet M-662775). Contact for anything related to your data: info@abarcando.com or the contact form.

There are two different roles in AccessTime, and it helps to know which one applies to you:

• Data of the workers each company records (clock-ins, absences, schedules, ID number, etc.): the client company is the controller and ABARCANDO acts as processor on its behalf, under the data processing agreement the company accepts when signing up. If you work for a company that uses AccessTime, your company decides what is recorded and must inform you; contact it first.
• Data of client companies and of whoever manages their account (sign-up, billing, acceptance of the terms), of anyone who writes to us through the contact form and of visitors to this website: here ABARCANDO is the controller.

2. What data is processed

• Account: name, email, language, role, company, department, workplace, job title and start date. The password is stored as an irreversible hash (bcrypt); nobody, including ABARCANDO, can read it. New accounts are activated with a single-use link: passwords are never sent by email.
• Worker's ID number (NIF/NIE), if the company records it. It is stored encrypted.
• Working time record: each clock-in (start, end, breaks) with the server time, the method (web panel, mobile app, QR-code kiosk or correction), the workplace, whether it is remote work, and the IP address and user agent of the device. For clock-ins made offline, the device time and the time the server received it are also stored.
• Geolocation: only if the company enables it and the device allows it, and only at the moment of clocking. There is no continuous tracking. Coordinates are deleted after 30 days.
• Phone verification when clocking: if the company uses the mobile app and the app sends it, each clock-in stores how the phone itself checked that it was the person (with the phone's biometrics —fingerprint or face—, with a PIN or the unlock code, or with no check) and whether the check succeeded. The check is done by the phone's operating system: AccessTime only receives that result, never the fingerprint, the face, the code or any other biometric data. It is kept with the clock-in and the person can see it in "My record".
• Corrections to the record: a clock-in is never overwritten. Every correction or cancellation adds a revision with the previous and the new value, who made it, with which role, when, why, and whether the worker agreed or was not asked (they are then notified and it is listed among their disagreements).
• Absences, holidays and leave, with their balances and supporting documents. They may contain health data (sick leave, medical certificates). The reason the worker writes and the supporting documents are stored encrypted, and colleagues only see "Absent", never the type of absence.
• Schedules, shifts, remote work, requests and approvals.
• Monthly hours closures (arts. 35.5 and 12.4.c of the Workers' Statute): each month's summary and its versions, when the notice was sent and the worker's acknowledgement of receipt (date, IP, browser, channel and, if they leave one, their comment).
• Access by legal representatives and the Labour Inspectorate: who has the legal representative flag and its scope (the whole company or some workplaces), the temporary links the company creates for the Inspectorate (request, period and validity) and every view and download made with them, with its IP address and browser.
• Audit log: for every change to the platform's data, it records who made it (name, email and role at that moment), when, from where (channel, IP and user agent), the previous and the new value, and the reason when the action asks for one (among others, corrections and cancellations of the working time record, absence balance adjustments, what someone records with no other approver, the recalculation of the theoretical working time, the links for the Inspectorate and support staff entering the company's account). Passwords, codes and secrets are never recorded, and the ID number is recorded masked (e.g. 12****78Z).
• Access: logins, failed attempts, open sessions and app devices with access to the account.
• Acceptance of the terms: which document and version was accepted, its fingerprint (SHA-256), the date, and the IP and user agent of the person who accepted.
• Client company billing: handled by Stripe. AccessTime only stores the Stripe customer ID, the card type and its last four digits; never the full number.
• Contact and support: name, email and the content of the messages.
• Website technical data: the technical cookies (see the cookie policy) and the data Google reCAPTCHA processes on the sign-up, login and password recovery forms.

No biometric data is processed (only the result of the phone verification is received) and no automated decisions with legal effects on people are taken. No profiles are built, there is no advertising, and data is not sold or disclosed to third parties for commercial purposes. No artificial intelligence is used to process workers' data.

3. Purposes and legal bases

As processor (workers' data), ABARCANDO processes data only to provide the service and following the client company's instructions (art. 28 GDPR). The legal basis is provided by the company as controller: the legal obligation to record working time (art. 34.9 of the Spanish Workers' Statute), the employment contract and, for health data in absences and supporting documents, art. 9.2.b GDPR and art. 9 LOPDGDD.

As controller, ABARCANDO processes:

• the data of the client company and of whoever manages its account, to provide the contracted service and invoice it (art. 6.1.b GDPR) and to comply with its legal obligations in tax and commercial matters (art. 6.1.c);
• access and audit logs, attempt limits and reCAPTCHA, based on the legitimate interest in protecting the platform and the data it holds and in being able to investigate and report a security incident (art. 6.1.f);
• contact and support messages, to answer your request (art. 6.1.b or 6.1.f). They are handled by the ABARCANDO support team, the same one for all the group's services, in the soporte@abarcando.com mailbox, which receives those sent to soporte@accesstime.app, including those from the contact form (section 5);
• the record of acceptance of the terms and the processing agreement, to be able to prove the contract (arts. 6.1.b and 5.2 GDPR).

4. How long data is kept

When the period ends, deletion is done with a purge procedure that only deletes what has reached its period and records what was deleted, when and why. ABARCANDO launches the purge manually after reviewing the monthly report of what would be purged, so an item may be kept a few weeks beyond its period. If the client company notifies a hold for litigation or inspection, nothing of that company is purged while it lasts.

5. Who else receives the data

Providers that process data on behalf of the client company (sub-processors):

The up-to-date list is part of the data processing agreement. Any change is notified to client companies in advance, and they can object.

Other recipients:

• Stripe Payments Europe, Ltd. collects subscription payments as an independent controller of its payment data.
• Google reCAPTCHA (Google Ireland Ltd.) protects the sign-up, login and password recovery forms against bots; Google processes browser technical data as controller of that service.
• Authorities: the Labour Inspectorate, courts or the Spanish Data Protection Agency (AEPD) when required by law. Workers' legal representatives and the Inspectorate access the time record through the client company, with the read-only access it grants them: the representatives, to the record within their scope (the whole company or some workplaces), with two-step verification and without ID numbers, contact details, the reason for absences or the free texts of reasons and explanations; the Inspectorate, with a temporary link per request that the company can revoke.

The service and the data are hosted in the European Union. The only transfers outside the European Economic Area are Google's, as indicated, covered by an adequacy decision (art. 45 GDPR).

6. How data is protected

• Encryption in transit (HTTPS with HSTS) and, at rest, of the ID number, absence reasons, supporting documents and backups.
• Strict isolation between companies and role-based permissions: each person only sees what they need (a worker, their own data; their manager, their department; HR and administration, their company; legal representatives, the record within their scope).
• Two-step verification mandatory for administration, HR, workers' legal representatives and AccessTime support staff; optional for everyone else.
• Login attempt limits, lock and notice to the account holder after several failed verification codes, and mobile app access that expires after 90 days and can be revoked from the profile.
• Tamper-evident record: the audit log and clock-in revisions are insert-only. Each entry is chained to the previous one with a cryptographic fingerprint (HMAC-SHA256), the database rejects changing or deleting them outside the legal purge procedure, and every hour a seal of the chains is stored outside the database (and daily, outside the server). A nightly check compares them with the latest seal outside the database and reports any alteration it finds; the daily seal outside the server also allows them to be checked manually.
• When AccessTime support staff enter a company to help it, the entry (with its reason or ticket), the exit and every change are recorded with their role. The exit is recorded when they leave, switch to another company or sign out; if the session ends in another way (for example, because it expires), their last request inside the company is recorded.
• Browser security policy (CSP) and protective headers.

7. Traceability of the working time record

For every clock-in and every change, who did it, with which role and when is recorded, as well as from where and, for corrections and the other actions that ask for a reason, why. Workers can see and download their own record with its revisions and who changed their data. Corrections are proposed by the worker or the company and never delete the original value: a revision is added, with the worker's agreement (or disagreement). If the company applies a change without it (after the worker rejected it; if they do not answer within the deadline they are given, 15 days, which they are reminded of before it ends; if they no longer have access after leaving; or when setting the real time of a clock-in whose device time was doubtful), it is marked as such, with who applied it and their justification, and listed among their disagreements. While they keep access after leaving, they can still accept or reject the company's proposals, and the company cannot withdraw that access before their deadline ends. The export for the Labour Inspectorate includes, for each clock-in, the original and the current time, its origin, the corrections and, if it was made with the app, the result of the phone verification.

8. Your rights

You can request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing, by writing to info@abarcando.com.

• If you work for a client company, your company is the controller: contact it. If you write to us, we will forward your request to it without delay and help it to answer. From the panel you can see and download your record ("My record").
• The working time record cannot be erased before its legal retention period ends, because the company is obliged to keep it; it is corrected, with its revision, if it is inaccurate.

If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

9. Security incidents

If a security breach affects a client company's data, ABARCANDO notifies it without undue delay, with the information it needs to meet its own 72-hour deadline before the AEPD and, where appropriate, to inform the people affected. If it affects data for which ABARCANDO is the controller, it notifies the AEPD within 72 hours.

10. Changes to this policy

Each version of this policy has a number and a date. Substantial changes are announced on the platform before they take effect, and each client company's administration sees them when entering the panel.