• Controller: the customer organization that subscribes to Shukkin (the Customer).
• Processor: Antonino Dell'Albani, NIE Y0718688K, of Carrer del Trencapinyons, 7, 07817 Sant Jordi de ses Salines, Illes Balears, Spain (Shukkin).

Shukkin processes the data only to provide the subscribed service: working-time records, schedules, shifts, absences, documents and notifications. The processing consists of collecting, recording, storing, consulting, modifying, exporting, disclosing to the Customer itself and erasing data, by automated means, plus technical support.

This agreement lasts as long as the service, plus the export and blocking periods in clause 12.

Data subjects: the employees, managers, administrators and external advisers (such as the accountant) the Customer adds.

Data: as listed in the privacy policy, section “Data we process on your employer's behalf”. Shukkin does not need special categories of data. If the Customer includes them, for example in a document supporting a sick leave, it is responsible for that processing being lawful.

Shukkin processes the data only on the Customer's documented instructions. The Customer's configuration and use of the service are those instructions. If Shukkin believes an instruction infringes data protection law, it will tell the Customer immediately.

The people authorised to access the data commit in writing to keep it confidential, also after the processing ends, and only access it when needed to support or maintain the service.

Shukkin applies the technical and organisational measures of article 32 GDPR described in annex I, and reviews them as the service evolves.

The Customer gives Shukkin general authorisation to use the subprocessors in the subprocessor list. Shukkin will email the organization's owners at least 15 days before adding or replacing one. If the Customer objects on reasonable data protection grounds and no solution is found, it may terminate the service without penalty. Shukkin imposes the same data protection obligations as this agreement on each subprocessor and remains liable for their compliance.

Shukkin only transfers data outside the European Economic Area with the safeguards of chapter V GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. Today the only subprocessor that stores data outside the EEA is Loops (United States), under standard contractual clauses; web traffic passes through Cloudflare's global network under the same safeguards.

If a data subject contacts Shukkin to exercise their rights, Shukkin will pass the request to the Customer within two working days and will not answer it itself. Shukkin helps the Customer respond with the service's own tools (viewing, correcting and exporting data) and, if needed, with direct assistance.

Shukkin will notify the Customer of any personal data breach without undue delay and in any case within 48 hours of becoming aware of it. The notice will include the information in article 33.3 GDPR that is available, and Shukkin will work with the Customer to contain it and, where needed, report it to the authority and to those affected.

When the service ends, the Customer has 90 days to ask for a full export of its data. After that, Shukkin erases it, with one exception: working-time records are kept blocked (art. 32 LOPDGDD) until four years have passed since each clock-in, the period in article 34.9 of the Spanish Workers' Statute, only to make them available to the Customer, the Labour Inspectorate or the courts. They are then erased.

The Customer may ask in writing for everything to be erased at once, taking on the retention of the working-time record itself. Backups are deleted 35 days after rotation.

Shukkin helps the Customer comply with articles 32 to 36 GDPR, including impact assessments and prior consultations, and provides the information needed to show compliance with this agreement, for example by answering security questionnaires.

The Customer, or an auditor it appoints under confidentiality, may carry out an audit with 30 days' notice, during business hours, at its own cost and at most once a year, unless there has been a breach.

Shukkin keeps a record of the categories of processing activities it carries out on behalf of its customers (art. 30.2 GDPR).

This agreement is governed by Spanish law and, for any dispute, the parties submit to the courts of Eivissa (Ibiza). On data protection matters, it prevails over any other term of the service.

• Encryption in transit (TLS) for all traffic between browsers, kiosks and servers.
• Servers in data centres in Germany, with a database replica in a second data centre for disaster recovery.
• Database reachable only from the private network, never from the internet.
• Daily backups with hourly incrementals, encrypted with AES-256 before leaving the server and stored under EU jurisdiction.
• Data separated between organizations in every query.
• Role-based access within each organization, passwords and PINs stored hashed, and kiosks paired explicitly by an administrator.
• Audit log of changes to the data.
• Error monitoring without names or emails, only internal identifiers.

The current list is on the subprocessors page.