1. About this policy

This policy explains how personal data is processed when you use HT Vahetus (the "Platform"), available at https://clock.htvahetus.eu and, when published, through the HT Vahetus app for Android and iOS. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act (isikuandmete kaitse seadus).

In this policy, "Organisation" means the company or other entity that has set up a workspace on the Platform and invited you to it, and "we" or "us" means Humanos Tech OÜ.

2. Who we are and how to contact us

Humanos Tech OÜ, registry code 17179670, VAT number EE102831229, registered address Meistri tn 6, 13517 Tallinn, Estonia.

E-mail for all data protection questions and requests: privacy@humanostech.com.

We have not appointed a data protection officer. Our privacy contact above handles all requests.

3. Who is responsible for your data

For data that an Organisation manages about its own team on the Platform (for example time records, schedules, absences, requests, disputes, attachments, documents and their read confirmations, contracts and returned contract e-mails, holiday balances, open shifts and shift swaps, alerts about working hours and rest periods, reminders, location data and notices about the devices used to clock in), that Organisation decides why and how the data is used and is the controller. Humanos Tech processes that data on the Organisation's behalf, as its processor under Article 28 GDPR, and only on its instructions.

For data needed to run the Platform itself (your account and sign-in, security, acceptance of our Terms, our service messages, reports of illegal content, error reports and the technical operation of the Platform), Humanos Tech is the controller.

If Humanos Tech itself uses the Platform as an Organisation for its own team, Humanos Tech is also the controller of that team's data.

For questions about data controlled by your Organisation, please contact your Organisation first. You can also write to us and we will pass your request on and help the Organisation to answer it.

4. Where the data comes from

Most data comes from you, when you use the Platform. Some data comes from your Organisation, for example your e-mail address, role, job title, team, projects and, for freelancers, the details needed to prepare a contract. Some data is created by the Platform, for example timestamps, audit records, fingerprints of documents, certificates of completion of contracts, alerts, reminders and error reports. Some data comes from your device, for example its time when you clock in or out without an internet connection.

5. What data is processed

Account data: e-mail address, role, job title (if provided), Organisation and team, Account Manager, projects, preferred language, account status and dates of invitation, password creation, first and last sign-in.
Sign-in and security data: password (stored only as a one-way hash), two-step verification secret (encrypted), passkey public keys, session tokens, failed sign-in counters, and one-time codes sent by e-mail.
Device data used when you clock in: a one-way hash of the device identifier created by the Platform on your device, first and last use, number of uses, last IP address and browser or device information (user agent). Your Account Manager is informed when you clock in from a new device or when one device is used by more than one person. This is only a notice and never blocks your time recording.
Time and work data: clock-in and clock-out times, breaks, projects, shifts and schedules, absence requests (type, dates, notes and decision), correction requests and their reasons, flags, disputes, decisions, comments and attachments uploaded as evidence, reports and period closures. For records made in the mobile app without an internet connection: a marker showing this, the time of your device when you made the record and the time our server received it.
Open shifts and shift swaps: your requests for open shifts, the shift swaps you propose, accept or decline, the notes you add, and the decisions with their reasons.
Holiday balance (employees only): yearly entitlement, start date of employment, the balance calculated from the approved absences, and manual adjustments made by an Admin, with the number of days, the reason, who made them and when. Freelancers have no holiday balance.
Alerts and reminders: alerts sent when the hours worked in a day, a week or any 24 hours exceed the limit set by your Organisation, or when the rest between two shifts is shorter than the minimum (hours worked or rest taken, the limit and the period concerned), reminders to clock in or out according to your schedule, and reminders to read Organisation documents (how many were sent and when).
Audit data: a record of who did what and when on the Platform.
Documents: documents published by your Organisation and your confirmations that you have read them (date and time, IP address, device information and file fingerprint).
Contract data (freelancers): full name, type and number of identity document, address, language, rates, weekly hours, payment method chosen, the signed documents, and signature evidence (date and time, IP address, browser and device information, confirmation text and document fingerprints), the deadline for signing, the reminders sent, the reason if you decline to sign, a record of each contract e-mail (recipient address, message identifier and, if the e-mail is returned undelivered, the reason given by the receiving mail server) and the certificate of completion described in section 7. Bank details and wallet addresses are not entered on the Platform.
Terms acceptance data: version, language, date and time, IP address, user agent and fingerprint of the accepted text.
Location data: only if you allow it, see section 9.
Notification data: your e-mail and notification preferences and, if you turn on push notifications, the push subscription of your browser or device.
Reports of illegal content: the content of the report and the contact details of the person reporting.
Error reports: when an error occurs on our server or in the app, a description of the error, technical details (the part of the program concerned and, for server errors, the address of the request, the response code, the app version and the platform), how many times and when it occurred and, if you were signed in, your account and Organisation. Passwords, codes and session tokens are removed, and these reports do not contain your IP address, what you typed or the content of your requests.
Language: messages from the Platform, including error messages, in-app notifications and e-mails, are written in the preferred language of your account. Before you sign in, the app sends the language of its interface with each request so that our server can answer in that language; this information is not stored.
Technical data: server logs with IP address, time, requested address and error information.

Absence requests of the type "sick" may reveal health information. Please do not write diagnoses or other health details in notes or attachments unless your Organisation asks for them through an appropriate channel and the law allows it.

6. Purposes and legal bases

Processing for which Humanos Tech is the controller:

To create and manage your account, let you sign in and provide the Platform under our Terms: performance of a contract (Article 6(1)(b) GDPR).
To keep the Platform and accounts secure, prevent fraud and abuse, and detect and fix errors: our legitimate interest in a secure and reliable service (Article 6(1)(f)).
To keep reports of errors that occur on our server and in the app, so that we can analyse and fix them: our legitimate interest in a reliable service (Article 6(1)(f)). Only Humanos Tech sees these reports.
To write messages, including error messages, in your language: performance of a contract (Article 6(1)(b)).
To record your acceptance of our Terms and send you a copy: performance of a contract and our legitimate interest in being able to prove what was agreed (Article 6(1)(b) and (f)).
To send service messages by e-mail and, if you turn them on, push notifications: performance of a contract (Article 6(1)(b)).
To handle reports of illegal content, statements of reasons and requests from authorities: compliance with legal obligations, including the EU Digital Services Act (Article 6(1)(c)).
To establish, exercise or defend legal claims: our legitimate interest (Article 6(1)(f)).
To answer requests to exercise your rights under the GDPR and keep a record of them: compliance with legal obligations (Article 6(1)(c)).

Where we rely on legitimate interest, you may object at any time, see section 12.

Processing for which your Organisation is the controller:

Your Organisation decides the purposes and legal bases, which typically include managing the work or services relationship, recording working time, including records made without an internet connection, planning schedules, including open shifts and shift swaps, keeping holiday balances, alerts about working hours and rest periods and reminders, handling absences and requests, preparing and signing contracts, preparing reports and invoices, and keeping tamper-evident records. Typical legal bases are performance of a contract (Article 6(1)(b)), legal obligations such as working-time and accounting rules (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)). Absence data that reveals health information may be processed where employment law allows it (Article 9(2)(b)). Location data is processed only with your consent (Article 6(1)(a)). Your Organisation should give you its own information about this processing.

7. Who can see your data

Other users of your Organisation, according to their roles: Account Managers see the data of the people they manage, and Admins see the data of their Organisation, including whether, when and in which language you accepted the current Terms. Account Managers and Admins also receive the alerts about the working hours and rest periods of the people they manage and see their holiday balances.
Other people who record time on the same project: if you propose or offer a shift swap, or if you can receive a shift that someone else offers, they may see your e-mail address, the shift concerned and the note you add.
The other party to a contract (freelancers): when all parties have signed, each party receives the signed documents and a certificate of completion showing, for each signer, the name, e-mail address, date and time, IP address and browser or device information, and the steps of the signing process (sending, opening of the documents, reminders and signatures). If you decline to sign, your Organisation receives the reason you give.
Authorised Humanos Tech staff, only when needed to operate, support and secure the Platform, under a duty of confidentiality. Error reports are seen only by the Humanos Tech staff who administer the Platform, and never by Organisations.
Our service providers (processors), only to provide their services to us and under contract:
- OVHcloud, server and database hosting, data centre in Frankfurt, Germany.
- Hostinger, e-mail delivery and storage of encrypted backups, in the European Union.
If your Organisation sets up its own e-mail account for sending contracts, those e-mails are sent through the e-mail provider chosen by your Organisation. If the Organisation also allows it, the Platform automatically reads new messages in the inbox of that account (IMAP), without marking, moving or deleting them, only to recognise notices that a contract e-mail could not be delivered. Other messages are checked only in memory and are not stored.
Providers you or your browser choose:
- Push notification services operated by the maker of your browser or device (for example Google, Mozilla, Microsoft or Apple), only if you turn on push notifications. The content of each notification is encrypted while it passes through these services.
Public authorities and courts, when the law requires it.

We do not sell personal data and do not use it for advertising.

8. Transfers outside the European Economic Area

We store and process the Platform's data in the European Union. A transfer outside the European Economic Area can happen only through the push notification services described in section 7, whose providers may process data in other countries, including the United States. Those providers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards.

9. Location (GPS)

Location is optional. If your Organisation uses it, the Platform asks for your permission before the first reading. If you agree, the Platform reads the position of your device only when you clock in and when you clock out, and stores latitude, longitude, accuracy, time of reading and quality indicators (for example low accuracy or simulated location). It never reads your position in the background or at any other moment. If you clock in or out in the mobile app without an internet connection, the position read at that moment is kept with the record, encrypted on your device, until it is sent to our server.

Legal basis: your consent (Article 6(1)(a) GDPR), recorded with the date and the version of the text.
Your choice: saying no never prevents you from recording your time.
Who sees it: the Account Manager responsible for you and the Admins of your Organisation.
Security: the position is stored encrypted.
Retention: the position is deleted automatically 90 days after the start of the shift. The shift itself is kept.
Withdrawal: you can withdraw your consent at any time in your account settings. Readings then stop and the positions already stored for your shifts are deleted. Withdrawal does not affect the lawfulness of processing before it (Article 7(3) GDPR).

10. How long data is kept

We keep personal data only for as long as it is needed for the purposes in section 6 or required by law. The Platform applies the periods below automatically, unless stated otherwise. A period counted from the end of a financial year starts on 31 December of that year.

Account data (e-mail address, role, job title, team, language and account status): while your account is active and for 7 years after it is deactivated. The account is then anonymised automatically: the e-mail address and job title are removed, the password is made unusable and stored devices, passkeys and push subscriptions are deleted. An Organisation may anonymise an account earlier, for example when it approves your request to close your account. Records that must still be kept stay linked to an internal identifier until their own period ends, and some of them (for example contracts, notes or comments) may still contain your name.
Time records and the records that support them (clock-in and clock-out times, breaks, the device time and time of receipt of records made without an internet connection, corrections and correction requests, flags, disputes with their decisions, comments and attachments, schedules, including approved open shift requests and shift swaps, and period closures), and the audit records about them: 7 years from the end of the financial year in which they were made, and then deleted. For employees, these records support the record of working time and wages (Estonian Employment Contracts Act, töölepingu seadus, section 28(2)(4) and section 29(9)); for freelancers, they support invoices. In both cases they are accounting records under section 12 of the Estonian Accounting Act (raamatupidamise seadus). Because the Platform started in 2025, no record can reach the end of this period before 1 January 2033. These records are protected by a cryptographic chain, and their deletion will keep the remaining records verifiable.
Signed contracts, their documents, signature evidence and certificate of completion (freelancers), and documents sent for signature that were declined, expired or cancelled, with the reasons given: 7 years from the end of the financial year in which the contract ended or the sending was closed (Accounting Act, section 12), and then deleted.
Absences: free-text notes are deleted 3 years after the end of the absence, which is the period for wage claims (Employment Contracts Act, section 29(9)). The rest of the record (type, dates and decision) is deleted 7 years after the end of the financial year in which the absence ended.
Acceptance of the Terms and confirmations that you have read a document: while your account is active and for 3 years after it is deactivated, and then deleted. 3 years is the limitation period for claims arising from a transaction (General Part of the Civil Code Act, tsiviilseadustiku üldosa seadus, section 146(1)). The IP address and browser information stored with these records and in audit records are deleted 3 years after the event; the date, version and fingerprint are kept.
Records of contract reminders: 3 years after the documents were signed, declined, expired or cancelled; for signed contracts, the reminders remain listed in the certificate of completion. Records of contract e-mails (recipient, message identifier and the reason for any return): 90 days after the e-mail was sent, once the documents no longer await signature.
Open shift requests and shift swaps that did not change the schedule (rejected, withdrawn, declined or cancelled, or still pending long after the shift): 3 years after they were closed or, if they were never closed, after the start of the shift, which is the limitation period mentioned above.
Holiday balance (employees): manual adjustments are deleted 7 years after the end of the year to which they apply; your own entitlement and start date of employment, 7 years after your account is deactivated.
Alerts about working hours and rest periods: the record that an alert was sent is deleted 12 months after it was sent. Records of reminders to read a document: 90 days after the last reminder, once you have read the document, the document has been archived or your account has been deactivated.
Error reports: 90 days after the error is marked as resolved, and in any case 1 year after it first occurred.
Records made without an internet connection that are still waiting on your device: deleted from the device as soon as our server accepts or rejects them, see the Cookie and Local Storage Policy.
Location data: 90 days after the start of the shift, or earlier if you withdraw consent.
Device data used when you clock in: the IP address and browser information are deleted 90 days after the device was last used, and the device record 12 months after it was last used.
In-app notifications: 90 days after you read them, and in any case 12 months after they were sent.
Links and codes to create or change a password: 30 days after they are used or, if they are not used, 90 days after they expire. Session tokens: no later than 7 days after they expire or are revoked. Failed sign-in counters and one-time codes: minutes to hours.
Push subscriptions: until you turn push notifications off or your browser cancels the subscription, and in any case 30 days after your account is deactivated.
Reports of illegal content and requests to exercise your rights: 3 years after the matter is closed, so that we can show how it was handled.
Backups: encrypted backups are deleted after 14 days on the server and after 56 days in off-site storage, so data deleted from the Platform disappears from all backups within 56 days.
Server logs: kept in limited space and overwritten automatically, normally within a few weeks.

A record may be kept longer only where it is needed for a pending dispute, a legal claim or a request from an authority, and only for as long as that lasts. Your Organisation, as controller, may instruct us to delete its data earlier where the law allows it.

11. Is providing data required

You need an e-mail address and must accept our Terms to have an account. Without them you cannot use the Platform. Other data depends on how your Organisation uses the Platform. Location is always optional.

12. Your rights

Under Articles 15 to 22 GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict processing, to receive your data in a portable format, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw consent at any time. You can ask for your account to be closed through the option in your account settings or by writing to privacy@humanostech.com.

Send requests about data controlled by your Organisation to your Organisation, and other requests to privacy@humanostech.com. We answer within one month, which may be extended by two further months for complex requests, in which case we tell you why. We may need to confirm your identity first. Some rights are limited where data must be kept by law or for legal claims (Article 17(3) GDPR).

13. Complaints

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee, info@aki.ee, or to the supervisory authority of the EU or EEA country where you live, where you work or where you think the infringement took place (Article 77 GDPR). A list of authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to deal with your concern first.

14. Automated decisions

The Platform does not take decisions about you based solely on automated processing that produce legal effects or similarly significant effects (Article 22 GDPR). Automatic functions, such as reminders, alerts about working hours and rest periods, flags for missing records, checks of location quality or the recognition of returned e-mails, only inform people, who then decide. Some steps follow rules set in advance: documents sent for signature expire when the deadline set by the Organisation passes without all signatures, an open shift may go to the first person who asks for it if the Organisation has chosen this rule, and a record made without an internet connection is not accepted if it arrives more than 72 hours late, is dated in the future or does not fit the existing records. In these cases the Organisation can send the documents again or decide otherwise, and you can ask for your records to be corrected.

15. Security

We use appropriate technical and organisational measures, including:

encrypted connections (HTTPS) for all traffic;
passwords stored with a strong one-way hash, optional or mandatory two-step verification, passkeys and short-lived session tokens;
encryption of particularly sensitive items, such as location data, two-step verification secrets, contracts, certificates of completion, Organisation documents and the passwords of e-mail accounts connected by Organisations;
in the mobile app, records made without an internet connection are kept in the secure storage of your device (Android Keystore or iOS Keychain) until they are sent;
separation of each Organisation's data at database level, and access by role;
tamper-evident time records protected by a cryptographic chain, and audit and signature records that cannot be altered;
encrypted daily backups stored off-site, limited server access and regular security updates.

No system is completely secure. If a personal data breach is likely to result in a high risk to you, we or your Organisation will inform you as required by Article 34 GDPR.

16. Children

The Platform is a work tool and is not intended for children. Users under 18 may use it only for work they are legally allowed to do and with the consent of their parent or legal representative. We do not knowingly process data of children under 13.

17. Cookies and local storage

The Platform stores only what is strictly necessary on your device. Details are in the Cookie and Local Storage Policy.

18. Changes to this policy

We may update this policy when the Platform or the law changes. The date of the last update is shown at the top. We will inform you in the Platform of significant changes, and we will ask for your consent again where the law requires it.

These texts apply to the HT Vahetus application. The policies of this website are linked in the footer.

Privacy Policy