Privacy policy
Who processes your data?
The company that invited you to Ponto is the controller of your data. AdoptIA SRL (Nivelles, Belgium, BE 1040.194.346), which provides the Ponto service, is its processor within the meaning of Article 28 GDPR and processes your data only on its instructions.
What for?
Managing your account; recording your hours; proving your presence on site; photo reports and site messaging; invoicing the services to the site's client; keeping the service secure. AdoptIA also counts, without names, the company's billable hours to invoice it for the service, on its instructions.
What data?
- Your professional identity: name, email, phone, job title.
- Your clock-ins: arrival and departure times, site, breaks.
- If you consent, the distance between you and the site at the exact moment you clock in or out.
- The photos and messages you post.
- Security logs: sign-ins, IP address, sensitive actions.
Geolocation
Ponto never tracks you. Your position is read once, when you clock in or out, to calculate the distance to the site; it is not kept. Only the distance and the inside/outside result are recorded. You can withdraw your consent at any time and clock in with the site's QR code; withdrawal does not affect processing already carried out.
On what legal basis?
Performance of the contract with your employer or the company that engages you; the legal obligations to record working time and to invoice, where they apply to that company; your consent for geolocation, which you can refuse or withdraw by clocking in with the QR code; legitimate interest for security and reporting. The company that invited you chooses and documents these bases.
For how long?
The distance to the site and the position check result are deleted after 90 days by default, photos and messages after two years, the security log after three years; the company can adjust these periods. Hours are kept for the legal period (5 years) and invoices for 10 years. Your account exists until it is closed.
Who has access?
The company's administrators. For the sites that concern it, the client where you work sees your presence and hours, your photos and, if the company turned it on, the messages of the shared thread; it sees neither your position nor the perimeter check result. AdoptIA and its hosts (OVH, France). The company's accounting software, for invoices only. Your data stays in the European Union; it is neither sold nor used for advertising.
How is it protected?
Encrypted connections and files, hashed passwords, two-step verification, strict separation between companies and logged access.
Is it mandatory?
Your name and email are needed to use Ponto. Geolocation is optional. No decision with legal effects is taken in a fully automated way: a clocking refused outside the perimeter can always be made with the QR code or corrected by the administrator.
Your rights
You can access your data and receive a copy in a reusable format, have it corrected or erased, restrict its processing, object to processing based on legitimate interest and withdraw your consent, from My account or by writing to the company.
Cookies
Ponto uses only what is strictly necessary: session cookie (12 h), request-forgery protection (1 h), confirmation message (1 min) and language (1 year, if you choose one); your theme choice, kept in the browser; clockings made offline, kept on the device until sent. No analytics or advertising cookies.
Complaints
You can lodge a complaint with the Data Protection Authority (Belgium, dataprotectionauthority.be) or the authority in your country of residence.