Version: 2026.08.1

Privacy Policy

This Privacy Policy describes personal data processing on the WorkToCloud platform, owned by Worktocloud S.L. (Tax ID B66295445), Avda. Santa Eulalia, 367, 08224 Terrassa (Barcelona), Spain. It applies Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and digital rights guarantee (LOPDGDD).

1. Data controller

Worktocloud S.L. is the controller for registration, billing, contracting, support and client relationship data (managers). Privacy contact: rgpd@worktocloud.es and info@worktocloud.es.

For worker monitoring data (screenshots, activity, geolocation, call metadata, NFC, etc.), the client (manager/company) is the controller and Worktocloud S.L. acts as processor under documented client instructions and the service agreement.

2. Principles

We process data lawfully, fairly, transparently, with purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability (GDPR Art. 5).

3. Data categories

• Identity and contact (name, email, phone, job title).
• Company data (legal name, tax ID, address, sector).
• Billing and payments (invoices, IBAN/card token, payment history).
• Org chart, roles and user permissions.
• Desktop monitoring: screenshots, keyboard/mouse activity level (not content), active window titles, applications.
• Mobile data: geolocation, call metadata (not content), NFC reads.
• Cookies, session tokens, technical identifiers, logs, IP address, OS and device information.
• Labor management (if enabled): agreements, contracts, public holidays, calendars, incomplete-data alerts.
• E-invoicing and Verifactu: data required by tax regulations.

4. Licenses, add-ons and scope of processing

Personal data categories processed depend on the license and add-ons contracted and activated for each client. The client determines which modules and permissions apply to each worker or user.

• Office: desktop monitoring (screenshots, keyboard/mouse activity level without content, active window titles, applications, comments, OS and device information).
• Security / Sales (mobile): geolocation, call metadata (not content), NFC reads.
• CRM Pack (wtccrm): commercial and customer management data; enables Verifactu Basic compatibility.
• Verifactu Basic / Verifactu Pro: e-invoicing data required by Spanish tax regulations (AEAT); Verifactu Pro adds, as contracted, applications, templates, languages and API quotas.
• Labor management: collective agreements, employment contract metadata, public holidays and calendars, multi-site territories, incomplete-data alerts (authorized managers and middle management only) and labor identifiers configured by the client.

Data is not processed for purposes inherent to an inactive or non-contracted module. For employee monitoring data and the Labor management module, Worktocloud S.L. acts as processor under client (manager/company) instructions, who is responsible for the applicable lawful basis.

General lawful bases for the Service: contract performance for SaaS provision; legal obligation for tax and labor retention; legitimate interest for platform security and B2B client relationship. The basis for employee monitoring rests with the employer/client.

Irreversibly anonymized data may be kept in aggregated form for internal Service improvement, quality and security without reasonable re-identification. Worktocloud S.L. does not disclose identifiable personal data to third parties for their own purposes unrelated to the Service.

5. Purposes

• Provision of contracted SaaS and technical support.
• Billing, collection, accounting and tax compliance (AEAT).
• Security, fraud prevention and service improvement.
• Operational, contractual and, where applicable, commercial communications.
• Compliance with commercial, labor and tax obligations.
• Processing client employee data when acting as processor.

6. Legal bases

• Contract performance (Art. 6(1)(b) GDPR): Service, account, billing.
• Legal obligation (Art. 6(1)(c)): tax and commercial retention, working-time records (Workers' Statute, RD 8/2019).
• Legitimate interest (Art. 6(1)(f)): platform security, technical improvement, B2B relationship management, balanced against data subject rights.
• Consent (Art. 6(1)(a)): where required for worker monitoring, primarily the employer/client must inform workers and obtain the appropriate basis under labor and data protection law.

7. Processors

We may use providers including Google Cloud, Strato, OVH, payment providers (tokenization and collection) and Gestoría Tormat for tax/accounting. Art. 28 GDPR agreements are in place.

8. International transfers

If a provider processes data outside the EEA, appropriate safeguards apply (Standard Contractual Clauses, adequacy decisions or other GDPR-recognized measures).

9. Retention periods

• Operational productivity/monitoring data: up to 12 months after cancellation or contract end, unless otherwise required.
• Tax and billing data: 4 years (AEAT obligations).
• Commercial/accounting records: 6 years (Commercial Code Art. 30).
• Working-time and labor records: applicable statutory periods (Workers' Statute, RD 8/2019).
• Irreversibly anonymized data: aggregated retention for internal Service improvement, quality and security without reasonable re-identification (see section 4).

10. Data subject rights

You may exercise access, rectification, erasure, objection, restriction and portability by contacting rgpd@worktocloud.es with proof of identity. Monitored workers should primarily contact their employer (controller) and, where applicable, Worktocloud as processor via the client. You may lodge a complaint with the AEPD (www.aepd.es).

11. Security

We apply appropriate technical and organizational measures: access control, encryption in transit, environment segregation, backups and access auditing.

12. Cookies

We use strictly necessary cookies and local storage for authentication, session preferences and security. You may manage cookies in your browser; disabling them may limit functionality.

13. Client duty to inform employees

The client must inform workers about monitoring data processing, purposes, recipients, retention and rights under GDPR Arts. 13–14 and applicable Spanish labor law.

14. No sale or disclosure of identifiable data

Worktocloud S.L. does not sell personal data to third parties nor disclose identifiable personal data to third parties for their own purposes unrelated to the Service.

15. Versioning and acceptance

Versioned policies may require explicit acceptance on login for manager users. Material changes will be communicated with reasonable notice.

16. Changes

We may update this policy to reflect legal or Service changes. The current version will be available on the platform.