Privacy policy
Last updated:
1. Who we are
The QRtimetrack website and platform are operated by NINE UNIT GROUP S.R.L., CUI 54549440, J2026027060009, București, Sector 1, Intrarea Gheorghe Simionescu nr. 19, ap. B26. For any question about your data, write to contact@qrtimetrack.com.
2. Presence checks, computer activity, team leads
If the employer turns them on: random presence checks for people working at a computer or from home (a selfie and a network/location check within 10 minutes); active time at the computer, meaning only whether the mouse or keyboard were used (via the Idle Detection feature in Chrome/Edge, with the employee's permission), without seeing apps, websites or content; a short report written by the employee when clocking out; presence confirmed by a team lead, with the location of the team lead's phone. Employees acknowledge this notice in the app before their first clock-in.
3. Two different roles
For website data (demo form, customer accounts, invoicing) we are the controller. For the data of our customers' employees (clock-ins, location at clock-in, selfie) the employer is the controller and we are the processor, under a data processing agreement (DPA) signed with each customer.
4. What data we process
Visitors: IP address and technical request data, kept in security logs. Demo form: name, company, email, phone, country, number of employees, message and visit source (UTM parameters). Accounts: name, email, role, password (stored only as a hash, never in plain text). Clock-ins: time, type (in, out, break), method (QR code, computer, tablet, remote), GPS location at clock-in and its accuracy, IP address for computer clock-ins, selfie (if the employer requires it) and Face ID / fingerprint confirmation.
5. What we do NOT process
We store no biometric data. Face ID and fingerprints are checked by the employee's phone; we only receive a cryptographic signature. We don't track employees' location between clock-ins.
6. Why and on what legal basis
To provide the contracted service (performance of a contract), for security and abuse prevention (legitimate interest), for legal obligations (invoicing) and, only with your consent, for visit statistics and to contact you after a demo request.
7. How long we keep data
Selfies are deleted automatically after 30 days. Clock-ins are kept while the employer's account is active or as long as the law requires for working-time records, then deleted at the employer's request. Demo requests are deleted after 12 months. Security logs are kept for up to 30 days.
8. Who we share data with
We use providers that process data on our behalf under contract: Supabase Inc. (database and files, EU region – Frankfurt, Germany); OVH SAS (dedicated application server, Gravelines, France – EU); Resend Inc. (service e-mails, USA; standard contractual clauses); Stripe Payments Europe Ltd. (payments, Ireland; customer billing data only); the phones' push notification services (Apple, Google, Mozilla), which only receive the notification text. Google Analytics is used on the website only, only with the visitor's consent, and receives no employee data.
9. How we protect data
Encrypted connections (HTTPS), per-company access separation in the database, hashed passwords, secret keys kept only on the server, request rate limiting and access logs.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time and the right to lodge a complaint with your data protection authority. Our customers' employees should first contact their employer.
11. Cookies
Details are in the cookie policy.
Terms and conditions · Cookie policy · Data Processing Agreement