1. Who is responsible
Meridiano is a working-time recording and rota app developed by Nova Romulus. Depending on whose data it is, two different roles apply:
- Employee data (clockings, shifts, absences and other data from the employment relationship): the controller is the company that registers you in Meridiano (your employer). Nova Romulus acts as processor and handles that data only on the company's instructions (Article 28 GDPR).
- Account data of employer users (the person who creates and manages a company in Meridiano): the controller is Nova Romulus.
Controller (for employer account data): Nohaila Lakroucha Arhlal, tax ID (NIF) 35755872A, address: Calle Bernat Amer 20, 3rd floor, 07001 Palma (Balearic Islands, Spain), trading as Nova Romulus (https://novaromulus.es). Contact: info@novaromulus.es.
If you are an employee and want to exercise your rights over your records, please contact your company first. We will assist them in handling your request.
2. What data we process
- Identification and account: name, email address and preferred language. Your password is managed by the authentication service and we cannot see it in clear text.
- Clockings and working time: date and time of clock-in, breaks and clock-out; corrections (who, when and why); shifts; absences and holidays; monthly sign-offs.
- Approximate location: only at the moment of clocking in or out, and only if you allow it on your device. It is stored with that clocking to work out the distance to the work site. It is optional and never prevents you from clocking.
- Kiosk PIN: if the company enables kiosk mode, we store only a hash of the PIN, never the PIN itself.
- Company data: name, work sites (address and radius), logo and brand colour.
We use no analytics and no advertising, we do not build profiles and we do not sell data.
3. Why we use it and on what legal basis
- Recording working time (clockings, corrections, reports): compliance with the employer's legal obligation, article 34.9 of the Spanish Workers' Statute (Article 6(1)(c) GDPR). Controller: the company.
- Shifts, absences and team management: performance of the employment relationship and the company's legitimate interest in organising its work (Article 6(1)(b) and 6(1)(f) GDPR). Controller: the company.
- Location when clocking: your permission on the device (Article 6(1)(a) GDPR), which you can withdraw at any time in your phone settings. Controller: the company.
- Employer account, support and service security: performance of the terms of use and our legitimate interest in keeping the service secure (Article 6(1)(b) and 6(1)(f) GDPR). Controller: Nova Romulus.
4. Who we share data with
- The company and its administrators can access their employees' records. Each employee sees their own records.
- Supabase (database and authentication), as a provider acting on our behalf. Data is hosted on servers in the European Union, Ireland region.
- Apple and Google distribute the app through their stores and process download data under their own policies.
- Authorities where the law requires it, for example the Labour Inspectorate through the company.
We do not pass data to third parties for commercial or advertising purposes.
5. International transfers
Meridiano data is hosted in the European Union. If a provider ever had to access data from outside the European Economic Area, we require the safeguards of Chapter V GDPR, such as standard contractual clauses.
6. How long we keep data
- Working-time records: 4 years, in line with article 34.9 of the Spanish Workers' Statute.
- User account: until it is deleted. When you delete it we erase your personal data; time records are kept by the company, under your name but no longer linked to any account, until the 4 years the law requires of the employer have passed.
- Location: kept with the clocking it belongs to, for the same period as that record.
7. Security
We apply appropriate technical and organisational measures: access restricted by company and role, kiosk PIN stored only as a hash, and tamper-proof time records with a trace of every correction.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@novaromulus.es. If your data is employee data, the responsible company will handle your request, with our assistance as processor.
Some rights may be limited by legal obligations, for example the 4-year retention of working-time records.
If you believe we are not handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with your local supervisory authority.
9. Deleting your account
You can delete your account in the app, under More → Account → Delete account. More information on the Delete account page.
10. Changes to this policy
If we change this policy we will publish the new version on this page and update the date above.
11. Contact
For any privacy question: info@novaromulus.es.