1. Who we are
Rayz Infotech, a partnership firm at 6F-10, Mahima Trinity Mall, Swej Farm, Sodala, Jaipur, Rajasthan 302019, India. Contact: info@arbeitsuhr.com.
2. Our two roles
| Data | Our role | Who decides how it is used |
|---|---|---|
| Website visitors, people who contact us, account owners, billing contacts, marketing contacts | Controller (GDPR) / Data Fiduciary (DPDP) | Rayz Infotech, under this policy |
| Employee and workplace data that a customer organization enters or collects through ArbeitsUhr (attendance, location, HR, bank, salary, tax and similar records) | Processor (GDPR) / Data Processor (DPDP) | The customer organization (your employer). Its privacy notice applies. |
If you are an employee using ArbeitsUhr through your employer, your employer controls your data. Please send requests about that data to your employer. If you contact us, we will forward your request to them.
3. Data we collect as controller
3.1 Website visits. When you visit arbeitsuhr.com, our servers log your IP address, browser and operating system, referring page, pages viewed and time of access. We use these logs to deliver the site, keep it secure and find errors. We keep logs for up to 30 days, unless needed to investigate an incident.
3.2 Contact and demo requests. Name, email, phone number, company and message content, used to reply to you and, if you ask, to arrange a demo.
3.3 Organization registration and account. Organization name, business address, business phone, administrator name, email and password (stored as a hash, never in plain text), and one-time passwords (OTPs) for login and verification.
3.4 Billing. Billing contact, address, tax ID and payment history. Payments are made through the payment platform integrated in the app. That platform handles card and bank details, and we do not store full card numbers.
3.5 App and technical data. Device type, operating system, app version, browser, IP address, error and crash logs, and security logs such as login times and failed attempts.
3.6 Communications and marketing. If you subscribe, we send product updates and newsletters. You can unsubscribe at any time with the link in each email.
4. Data we process for customers (as processor)
Depending on the features a customer uses, ArbeitsUhr may hold the following about its employees and contacts. We process it only on the customer's instructions, under our Data Processing Agreement.
| Category | Examples |
|---|---|
| Identity and profile | Name, salutation, title, initials, gender, date of birth, photo, employee ID |
| Contact | Work and private email, work and private phone, home address, emergency contact |
| Employment | Department, role, supervisor, workplace, joining date, contract details, qualifications and training |
| Attendance and time | Clock-in and clock-out times, breaks, shifts, projects and tasks, attendance corrections and requests |
| Location | GPS latitude and longitude, accuracy and place name captured at clock-in or clock-out, if the customer enables it and the user grants permission |
| Device data on attendance | IP address, device, operating system and browser used to record attendance |
| Leave and absence | Leave type, dates, status and reason given |
| Financial | Bank name, account holder, account number, salary information |
| Tax, insurance and ID | Tax information, health-insurance details, government ID document reference |
| Customer business contacts | Names, emails and phone numbers of the customer's own clients and project contacts |
ArbeitsUhr does not track location continuously or in the background. Location is captured only at the moment an attendance action is recorded.
5. App permissions
The mobile app may request the following permissions. Each one is optional, and you can withdraw it in your device settings at any time.
- Location: to record where clock-in or clock-out happens, if your employer has enabled location-based time tracking. Without it, location-based clock-in may not work.
- Camera and photos: to upload a profile photo or documents.
- Notifications: for reminders such as clock-out, shift or leave approval.
App stores (Apple App Store, Google Play) collect their own data when you download the app. They are responsible for that processing.
6. Why we use data, and our legal bases
| Purpose | Legal basis under GDPR | Basis under DPDP Act |
|---|---|---|
| Provide the Service, accounts and support | Contract (Art. 6(1)(b)) | Consent / legitimate use under Sec. 7 |
| Security, fraud prevention, logs | Legitimate interests (Art. 6(1)(f)) | Legitimate use |
| Billing, tax and accounting | Legal obligation (Art. 6(1)(c)) | Compliance with law, Sec. 7 |
| Product improvement with aggregated data | Legitimate interests | Consent, or anonymized data outside the Act |
| Newsletters and marketing | Consent (Art. 6(1)(a)) or legitimate interests for existing customers | Consent |
| Non-essential cookies | Consent | Consent |
Providing personal data is generally voluntary. Without certain data, such as an email for login, we cannot provide the Service.
8. International transfers
Rayz Infotech is based in India, and data may be stored or accessed in India and in the countries where our hosting providers operate their data centres. India does not have an EU adequacy decision. For personal data from the EU, EEA, UK or Switzerland, we use the European Commission's Standard Contractual Clauses (and the UK Addendum) with appropriate safeguards. Transfers out of India follow any restrictions notified by the Government of India under Section 16 of the DPDP Act.
9. How long we keep data
| Data | Retention |
|---|---|
| Account and organization data | For the subscription, then deleted within 90 days of termination |
| Customer data (as processor) | As instructed by the customer; deleted within 90 days of termination |
| Invoices and tax records | As required by Indian tax law (currently 8 years) |
| Server and security logs | Up to 30 days, longer only for incident investigation |
| Marketing contacts | Until you unsubscribe or withdraw consent |
| Contact and demo requests | Up to 2 years after our last contact |
10. Security
We use reasonable security practices in line with the SPDI Rules 2011 and GDPR Art. 32. These include HTTPS/TLS encryption in transit, password hashing, role-based access control, organization-level data separation, OTP verification and restricted staff access. If a personal data breach occurs, we notify affected customers, the Data Protection Board of India and other regulators as the law requires.
11. Your rights
Depending on where you live, you may have the right to:
- access your personal data and get a copy;
- correct inaccurate or incomplete data;
- delete your data ("right to erasure");
- restrict or object to processing, including direct marketing;
- data portability (GDPR);
- withdraw consent at any time, without affecting earlier processing;
- nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
- complain to a supervisory authority: the Data Protection Board of India, your local EU or UK data protection authority, or another competent regulator.
To exercise these rights, email info@arbeitsuhr.com. We may need to verify your identity. We respond within 30 days, or sooner where local law requires. Employees should contact their employer first (see Section 2).
12. Children
ArbeitsUhr is a business tool and is not directed at children under 18. We do not knowingly collect children's data. If an employer lawfully employs a minor, the employer is responsible for any required parental consent.
14. Grievance Officer
Under the Information Technology Act 2000 and the rules made under it, our Grievance Officer is:
Chandra Prakash Jangid, Rayz Infotech, 6F-10, Mahima Trinity Mall, Swej Farm, Sodala, Jaipur, Rajasthan 302019, India · Email: info@arbeitsuhr.com
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.
15. Changes to this policy
We may update this policy. We will post the new version with its effective date and, for material changes, notify account owners by email or in the Service.
16. Governing law and jurisdiction
This Privacy Policy is governed by the laws of India. The courts at Jaipur, Rajasthan, India have exclusive jurisdiction over any dispute about it. This does not remove any right to complain to a data protection authority that mandatory law gives you.