Privacy & Data Protection Policy
Comprehensive compliance with GDPR (EU 2016/679), Spanish LOPDGDD (Organic Law 3/2018), Workplace Digital Rights, and international privacy frameworks.
At SekiaHR, we protect personal and employment data with bank-grade encryption (AES-256 at rest and TLS 1.3 in transit), strict multi-tenant company isolation, and 100% European Union-hosted infrastructure. We never sell data to third parties or use employee documents or information to train external AI models.
1. Role Delineation: Data Controller vs. Data Processor
In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), SekiaHR operates in two distinct legal capacities depending on the nature of the data processed:
SekiaHR as Data Controller (Art. 4.7 GDPR)
With respect to contact details, billing information, administrator accounts representing the Customer Company, and visitors to our commercial website (sekiahr.com), SekiaHR acts as Data Controller to manage the B2B contractual relationship, invoicing, platform security, and commercial inquiries (Art. 6.1.b, 6.1.c, and 6.1.f GDPR).
SekiaHR as Data Processor (Art. 4.8 & 28 GDPR)
With respect to personal and employment data of workers onboarded by the Customer Company (time-tracking records, shifts, absences, medical leave certificates, payslips, signed documents, expenses, and whistleblowing reports), the Customer Company is the sole Data Controller and SekiaHR acts exclusively as Data Processor following its documented instructions under the Data Processing Agreement (Art. 28 GDPR DPA) integrated into our Terms.
2. Specific Workplace Safeguards & Special Categories of Data
Real Decreto-ley 8/2019 & Art. 34.9 ET
Mandatory 4-Year Retention & Immutability: In compliance with Article 34.9 of the Spanish Workers’ Statute (RDL 8/2019), daily time-tracking records are preserved intact, unalterable, and auditable for four (4) years at the disposal of workers, their legal representatives, and the Labor and Social Security Inspectorate.
Art. 20 bis ET & Art. 90 LOPDGDD
Point-in-Time Non-Invasive Geolocation: When the Customer Company enables geolocated clock-in, the app captures GPS coordinates solely at the exact instant of registering clock-in, break, or clock-out. SekiaHR guarantees by technical design (Privacy by Design) that it never performs continuous tracking or background monitoring of the employee’s device, respecting workplace privacy and digital disconnection rights (Arts. 87, 88, and 90 LOPDGDD).
Art. 9.2.b GDPR — Medical Leave Certificates & Health Justifications
Special Categories of Data & Reinforced Document Audit Trail: When employees or administrators upload medical leave certificates (sick leave, confirmation, or discharge notes), absence justifications, or health-related documents, the lawful basis rests with the Customer Company to fulfill its employment and Social Security obligations (Art. 9.2.b GDPR). SekiaHR enforces strict storage segregation and records an immutable audit log (acting user, timestamp, and IP address) on every document upload, view, download, or deletion.
Ley 2/2023 & Directiva (UE) 2019/1937
Internal Information System (Whistleblowing Channel): Reports submitted through the ethics channel are processed with reinforced encryption, access restricted exclusively to the designated System Officer, and full anonymity options. Under Art. 24 of Spanish Law 2/2023, personal data is purged from the active system three (3) months after receipt unless retention is strictly necessary to evidence compliance model operation.
RDL 8/2019 & Art. 28.3.g GDPR — Offboarding, Data Export & Encrypted Backup Purge (60 Days)
Distinction Between Subscription Cancellation & Irreversible Account Deletion: Canceling a subscription preserves read and export access until the end of the billing cycle plus an additional 30-day export window. Conversely, if the Customer Company requests permanent account deletion, erasure from production is irreversible, and the Customer Company bears sole responsibility for exporting its 4-year time-tracking records beforehand (RDL 8/2019). Residual data in encrypted backups is automatically overwritten and purged within a maximum of sixty (60) days.
3. Exercising Data Subject Rights & Contacting the DPO
Any data subject may exercise their rights of Access, Rectification, Erasure, Objection, Restriction of processing, Data Portability, and not to be subject to automated individual decision-making without human intervention (Arts. 15–22 GDPR). Employees of a Customer Company should direct requests primarily to their employer (Data Controller), without prejudice to SekiaHR promptly forwarding any received request to the employer and providing technical assistance. Data subjects may also lodge a complaint with the Spanish Data Protection Agency (AEPD — www.aepd.es) or their national supervisory authority.
Direct mailbox of our Data Protection Officer (DPO) & Privacy Team:
4. International Privacy Compliance (UK, USA, Brazil)
UK GDPR
Full compliance with the UK GDPR and the Data Protection Act 2018 for organizations or employees in the United Kingdom, maintaining European adequacy standards and approved safeguards.
US / CCPA
Compliance with the California Consumer Privacy Act (CCPA / CPRA): SekiaHR acts strictly as a “Service Provider,” never sells or shares personal information for cross-context behavioral advertising, and upholds non-discrimination rights.
Brasil / LGPD
Compliance with Brazil’s Lei Geral de Proteção de Dados (Law No. 13.709/2018 — LGPD): full protection of Art. 18 LGPD data subject rights and technical governance safeguards.
To exercise privacy rights or contact our DPO, please write to dpo@sekiahr.com.
Version v2.0 · Last updated: October 2026