This policy explains how Gatula Time handles personal data when operating accounts, providing the service and supporting customers.
Gatula ehf., registration number 450526-1850, Bíldshöfði 16, 110 Reykjavík, Iceland, operates Gatula Time.
For account, commercial, website, security and support data, Gatula may act as a controller. For employee and workforce data entered by a customer, Gatula generally acts as a processor on that customer’s documented instructions.
Depending on the context, processing may be necessary to perform a contract, comply with a legal obligation, pursue legitimate interests in secure service operation, or rely on consent where consent is the appropriate basis.
The customer is responsible for identifying and documenting the lawful basis for workforce processing it controls, including any optional monitoring or location features.
Customer administrators determine which users may access company data and which features are enabled. Gatula personnel access customer data only where necessary for service operation, support, security, legal compliance or documented customer instructions, subject to access controls and confidentiality obligations.
Data may be processed by vetted infrastructure, hosting, storage, email, monitoring, support and security providers required to deliver the service. Gatula does not sell workforce personal data.
Where data is transferred outside the EEA, Gatula will use an available lawful transfer mechanism and appropriate safeguards.
Data is retained for the duration needed to provide the service, meet the customer’s configured retention requirements, maintain security and audit evidence, resolve disputes and comply with law. Backups may retain deleted data for a limited recovery period before rotation.
Customers should define retention periods appropriate to employment, payroll, accounting and legal obligations. Gatula will delete or return processor data according to the applicable agreement, subject to lawful retention requirements.
Gatula uses measures designed to protect confidentiality, integrity and availability, including authenticated sessions, role-based access, company isolation, audit logging, protected secrets and controlled storage. No system can guarantee absolute security.
Employees should normally direct requests about work records, schedules, approvals and employer policies to their employer, which determines the purpose and use of that data. Gatula will assist the customer with verified data-subject requests where contractually and legally required.
Gatula Time uses strictly necessary authentication and security cookies to maintain signed-in sessions and protect access. Non-essential analytics or marketing technologies should not be enabled without appropriate notice and choice where required.
When a customer enables GPS verification, Gatula Time is designed to capture foreground location evidence at Clock In and/or Clock Out according to the configured company policy. The Core does not continuously track employees in the background.
Geofence checks compare the captured position with customer-configured work locations. Location evidence is stored separately from the core Time Entry, access is permission-restricted, and the customer must configure an appropriate retention period and employee notice.
This policy may be updated when the service, legal requirements or processing practices change. The current version and update date will be published on the website.
Privacy questions and verified rights requests may be submitted through the contact details published on the Gatula Time website.
