Privacy Policy

1. Data controller

The data controller is TimePax, located at Sos. Mihai Bravu 123-135 Bl. D11 Sc. B Et. 1 Ap. 4 Sector 2, 021314 Bucuresti, Romania. For privacy inquiries contact office@timepax.com or +40 729 153 071.

Where our business customers upload employee data, the customer is typically the data controller for employee personal data and TimePax acts as a data processor, as described in our Data Processing Agreement.

2. Legal basis and GDPR compliance

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018 implementing GDPR. Processing is based on one or more of the following: contract performance, legitimate interests, legal obligation, or consent where required.

3. Categories of data processed

• Identity and contact data: name, email, phone, company details.
• Account and billing data: login credentials, subscription, invoices, payment references processed via payment providers.
• Workforce data uploaded by customers: employee profiles, attendance records, location verification events, schedules, and related HR data.
• Technical data: IP address, device type, browser, logs, cookies, and security records.
• Communication data: support tickets, contact form messages, and email correspondence.

4. Purposes of processing

• Providing and securing the Service.
• Customer account administration and billing.
• Customer support and service communications.
• Compliance with tax, accounting, and legal obligations.
• Analytics and product improvement, using aggregated or anonymised data where possible.
• Marketing communications only where permitted by law and, where required, based on consent.

5. Data retention

We retain personal data only as long as necessary for the purposes above, for the duration of the contractual relationship, and as required by applicable law. Customer account data may be deleted or anonymised after termination subject to statutory retention periods for financial records.

6. Recipients and international transfers

Data may be shared with trusted subprocessors such as hosting providers, email delivery services, payment processors, and support tools, under data protection agreements. A current subprocessor list is available on request.

If data is transferred outside the European Economic Area, we implement appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Security measures

We apply technical and organisational measures including encryption in transit, access controls, logging, backups, and staff confidentiality obligations. No method of transmission or storage is completely secure; please use strong passwords and protect your credentials.

8. Your rights

Under GDPR, data subjects may request access, rectification, erasure, restriction, portability, and objection to processing, as well as withdraw consent where processing is consent-based. You may lodge a complaint with the Romanian Supervisory Authority (ANSPDCP) at www.dataprotection.ro.

Requests may be sent to office@timepax.com. We respond within one month, extendable where permitted by law.

9. Children

The Service is not directed at children under 16. Workforce accounts for minors, if any, must be created by employers in compliance with labour law.

10. Changes

We may update this Privacy Policy to reflect legal or operational changes. Material updates will be published on http://www.timepax.com with a revised date.