1. Purpose
This document explains the data protection roles and responsibilities applicable to NFC Employee Tracker. The purpose of this document is to clarify the relationship between Customers and COCOA 87 j.d.o.o. under the General Data Protection Regulation (EU) 2016/679 ("GDPR").
2. Data Controller
The Customer acts as the Data Controller. The Customer independently determines:
- What personal data is collected
- Which employees are entered into the Platform
- Whether photographs are collected
- Whether GPS attendance is enabled
- How attendance records are used
- How long personal data is retained
- The legal basis for processing
The Customer is solely responsible for ensuring compliance with:
- GDPR
- Employment laws
- Labor regulations
- Employee notification requirements
- Any applicable local laws
3. Data Processor
COCOA 87 j.d.o.o. acts as a Data Processor. The Company provides:
- Cloud infrastructure
- Workforce management software
- Data storage services
- Attendance tracking tools
- Administrative functionality
- Technical support
The Company does not determine the purposes for which Customer data is processed.
4. Customer Responsibilities
Customers are responsible for:
- Determining lawful processing grounds
- Providing employee privacy notices
- Obtaining consent where legally required
- Ensuring lawful GPS usage
- Ensuring lawful employee photography
- Responding to data subject requests
- Defining retention periods
- Managing employee rights
5. Company Responsibilities
COCOA 87 j.d.o.o. shall:
- Process data only as required to provide the Service
- Maintain reasonable security measures
- Restrict access to authorized personnel
- Support Customers where reasonably possible
- Notify Customers of relevant security incidents where legally required
6. Access to Customer Data
The Company does not routinely review Customer data. Access may occur only where reasonably necessary for:
- Technical support
- Troubleshooting
- Security investigations
- System maintenance
- Customer-requested assistance
7. Employee Data
Employees whose information is stored in the Platform should direct privacy-related requests to their employer. The employer is the Data Controller and remains responsible for responding to such requests.
8. Data Subject Requests
Where COCOA 87 j.d.o.o. receives a request concerning Customer-controlled data, the request may be referred to the relevant Customer.
9. Changes
This document may be updated periodically. Continued use of the Service constitutes acceptance of any updates.