Privacy policy

1. Data controller

The controller of the personal data collected through the MAINWORK website and the MAINWORK application is Geoplan S.r.l., registered office at Via Cacciatori delle Alpi, 11 — Perugia (IT), VAT no. IT03080240546.

For any matter concerning personal data you can write to info@geoplansrl.com.

2. Personal data processed

Depending on how the website and the application are used, we process the following categories of data:

• App account data: first and last name, email address, company, role, access credentials and records of the activities carried out in the application.
• Data of the employees and collaborators registered by customer companies: name, attendance, clock-ins, hours worked, jobs, activities performed and photographs attached to daily reports.
• Data provided in quote or contact requests: name, company, email, optional phone number, plan of interest and message content.
• Technical operating data: IP addresses, device and browser information, access and security logs, necessary to provide the service and prevent abuse.

3. Roles in the processing of employee data

Attendance, hours and daily reports of employees are entered into the application by the customer company that employs the people concerned. For this data the customer is the controller and decides the purposes and methods of recording; Geoplan S.r.l. acts as processor under art. 28 of Regulation (EU) 2016/679, processing the data only to provide the requested service.

Requests concerning this data (access, rectification, erasure) should therefore be addressed first to the employer, which may involve us in handling them.

4. Purposes and legal bases

• Provision of the service, management of accounts and licences: performance of a contract or pre-contractual steps (art. 6(1)(b) GDPR).
• Answering quote and information requests: pre-contractual steps taken at the data subject's request (art. 6(1)(b) GDPR).
• Tax, accounting and legal obligations: legal obligation (art. 6(1)(c) GDPR).
• Service security, prevention of abuse and protection of rights: legitimate interest of the controller (art. 6(1)(f) GDPR).
• Promotional communications, where requested: consent of the data subject (art. 6(1)(a) GDPR), which may be withdrawn at any time.

5. Whether data is required

The data requested to create an account or to send a quote request is necessary to follow up on the request: without it the service cannot be activated and we cannot reply. Optional data, such as the phone number, may be omitted.

6. Processing methods and security

Data is processed with IT tools and with technical and organisational measures suitable to protect it against unauthorised access, loss and disclosure: encrypted connections, personal credentials, separation of data between customer companies, access logging and backups.

Access to data is limited to authorised personnel and to the providers delivering services necessary for the operation of the application.

7. Recipients and processors

Data may be disclosed to infrastructure service providers (hosting, database, email, technical support) appointed as processors under art. 28 GDPR, as well as to tax and accounting advisers for legal obligations. The updated list of processors is available on request by writing to the controller.

Data is not sold or transferred to third parties for their own purposes.

8. Transfers to third countries

Processing takes place mainly within the European Union. Where a provider involves a transfer to a third country, this is based on an adequacy decision of the European Commission or on standard contractual clauses, with the safeguards set out in articles 44 et seq. of the GDPR.

9. Retention period

• Account data: for the duration of the contractual relationship and for 12 months after its termination, unless legal obligations require otherwise.
• Data entered in daily reports and attendance records: for the period established by the customer as controller, according to its contractual, tax and legal obligations.
• Quote requests: for the time needed to handle the request and any resulting relationship, and in any case no longer than 24 months from the last contact, unless consent has been given otherwise.
• Technical security logs: for the period strictly necessary for security and troubleshooting.

10. Rights of the data subject

In the cases and with the limitations set out in articles 15 to 22 of the GDPR, the data subject may ask the controller to:

• access their personal data and obtain a copy of it;
• rectify inaccurate data or complete incomplete data;
• erase the data, where no obligation requires its retention;
• restrict the processing;
• receive the data provided in a structured, readable format (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing already carried out.

11. Complaints to a supervisory authority

The data subject has the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the supervisory authority of their country of residence, without prejudice to any other administrative or judicial remedy.

12. Changes to this policy

This policy may be updated to reflect legal or organisational changes. The version published on this page, with its last-updated date, is the one in force.