Privacy policy
Version of 16 September 2026
Quathos Clock records working time. That means processing data about identified people, under the employer's legal obligation — this document says which data, for how long, and who can reach it.
Draft under review: the Brazilian entity behind the product is still being incorporated and the data protection officer has not been appointed. The practices described here are the ones the system already applies; the final version follows legal review and full identification of the controller.
Who is who
The employer is the controller. They decide to record working time, for whom and why — the obligation is theirs. Quathos is a processor: it handles the data on the employer's behalf, within the contract, and never for its own purposes.
What we process
| Data | Why |
|---|---|
| Name, national ID, badge number, hire date | To tell whose punch is whose — the national ID is required in the Brazilian statutory file. |
| PIN (stored hashed) | To tell one worker from another on a shared device. It cannot be read back, not even by us. |
| Punches: date, time, timezone, device, source | The time record itself. Immutable by construction. |
| Device location at the moment of a punch | Optional, one-off, and only where the employer requires it. Never continuous, never in the background. |
| Phone and email, where they exist | Receipts and notices. Most workers have neither, and the product works without them. |
| IP, browser and access time | Session security and an audit trail of who read or changed what. |
| Correction requests and their decisions | To show who authorised each adjustment, with reason and date. |
No biometric data is processed in this version. When it is, it will require written, recorded consent, per worker — and where local law does not allow it, the module stays off.
Legal basis
- Legal obligation for the time record and the files inspection may demand.
- Performance of the employment contract for hour calculation and the timesheet.
- Consent only for what is optional — non-essential cookies and, later, biometrics.
How long
Five years for punches, receipts and statutory files, counted from the end of employment — the same window in which these records can be demanded of you. Sessions and access logs: twelve months.
Who can reach it
Each organisation is isolated at the database level by row-level security — not an application filter, a database rule, and it holds even for a query written by mistake. Inside the organisation, access follows each person's role.
Your rights
Access, correction, portability, information on sharing, and review of automated decisions. In Quathos Clock no decision about your working time is automated: the engine calculates, and a named person approves or rejects every correction, with a recorded reason. Write to privacy@quathos.com.
Security
Every punch is signed on the device and hash-chained to the previous one: altering one breaks the chain, verifiably from outside the system. Record tables are append-only in the database. Passwords and PINs are stored hashed. Report an incident to security@quathos.com.