Privacy policy

This policy summarizes how the pontaj.eu application (web, Android and iOS, and desktop) collects, uses and protects personal data. The data controller is the employer (the company you work for) that uses the platform; pontaj.eu acts as a service provider (authorized) for the management of the pontaj, and the data operator undertakes to inform and obtain all necessary consents for the relations thus born.
pontaj.eu is offered by GlobalEX Software SRL, CUI 25202471.

1. What Data We Collect

• Identity data: name, first name, brand, CNP, function/job.
• Account data: user, email, password -stored encrypted-.
• Profile picture - only if you upload it, optionally, not being an element that could affect the functionality of the services.
• Time attendance data: arrival/departure times, breaks, holidays, company documents.
• Technical data (minimum required for operation): device authentication token, push notification token (Firebase, for delivering notifications), login IP address, device identifier, operating system model and version, application version.
• If you use pontaj.eu desktop (installed on a computer and not in the browser / web), depending on the pontaj method (with fingerprint or face, not rfid), the application will store a template of them locally, without transmitting it to the pontaj.eu cloud server (more details here: https://pontaj.eu/gdpr)

The mobile application NO collects location (GPS) -unless the administrator decides this (more details here https://pontaj.eu/gdpr)-, no needs microphone or camera rights (except when you choose to add/change your profile picture or when you receive computer files from or transmit them through your employer), NO needs address book or calendar access, NO needs storage rights (except for changing profile picture or downloading/uploading HR files - permissions you decide), NO needs phone or messaging access, NO needs access to health apps.
note for reiteration: pontaj.eu will request access to files or camera exclusive when you choose to upload such files (profile picture or HR documents: employment contract, internal regulations, salary flyers, etc.).

Desktop application NO collects location (GPS), does not needs microphone or camera rights (unless you are using facial recognition time attendance), NO needs address book or calendar access, NO needs storage rights (unless you receive computer files from your employer or transmitted through it), NO needs access to phone or messaging, NO needs access to health apps.
note for reiteration: pontaj.eu will request access to files or camera exclusive when you choose to upload such files (profile picture or HR documents: employment contract, internal regulations, salary flyers, etc.).

Traffic statistics (analytics)
To understand how the site is used, we collect access statistics in aggregate, without cookies and without third-party tracking tools. At each access we record: date and time, accessed page, source of origin (reference domain), browser type, preferred language, approximate country and a pseudonymous identifier that changes daily.
The IP address is not stored. It is currently used on our server only to determine the approximate country and to generate a pseudonym (hash) code that changes every day, used exclusively to estimate the number of unique visitors. We do not profile, display advertising, or sell or share this data.
Country determination is done locally on our server using an offline database - your IP address is not sent to any third party for this purpose.
Legal basis: our (GlobalEX Software SRL) legitimate interest (art. 6 para. (1) letter f of the GDPR Regulation) to maintain and improve the site. Retention period: statistical data is kept for a maximum of 24 months.
IP geolocation: DB-IP database (CC BY 4.0 license).

2. Purpose and legal basis

The data are processed for the management of the employment relationship (records of working time, holidays, documents) - grounds: the execution of the employment contract and the legal obligations of the employer, according to Regulation (EU) 2016/679 (GDPR), art. 6 para. (1) lit. b) and c). For biometric data (where the employer chooses attendance by fingerprint or facial recognition on the desktop application), the special basis is art. 9 para. (2) lit. b) GDPR. Law 53/2003 (Labor Code) and related legislation also apply.

3. How we protect data

• All application traffic is encrypted (HTTPS/TLS).
• The authentication token is stored in the secure area of the device (Keychain/Keystore).
• Uploaded photos are re-processed on the server to remove hidden content.
• Data access is strictly isolated to the user's company.
• The desktop application is signed with a digital certificate.

4. Data sharing

We do not sell or share data with third parties for marketing purposes. The data is visible to your employer (company administrators) and can be processed by: the infrastructure provider hosting the service (strictly for IT purposes and only on demand) and the Google Firebase service, exclusively for the delivery of push notifications (device token). The data can be communicated to public authorities (e.g. Labor Inspection, ANAF, courts) only on the basis of a legal obligation.

5. Data Retention

The data is kept for the duration of the employment relationship and subsequently according to legal archiving obligations, after which it is deleted or anonymized. The obligation to keep data and generate PDF reports falls on the beneficiary (employer).
Per a contrario, GlobalEX Software SRL has no obligation to keep data. After the end of the economic relations between GlobalEX Software SRL and the beneficiary company, it can delete the data.

6. Your rights

You have the right of access, rectification, deletion, restriction, opposition and data portability, as well as the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP). More details here https://pontaj.eu/gdpr.

7. Contact

To contact us, use https://pontaj.eu/contact