Privacy policy

This policy explains how personal data is processed when you use WFSuite — the web platform at www.wfsuite.it and the WFSuite mobile app for Android and iOS — to record working time and manage leave, shifts and workplaces.

1. Who is responsible for your data

WFSuite is used by companies (our customers) to manage their employees' working time. Two roles apply:

• Your employer is the data controller for the data about you as an employee (profile, punches, leave, shifts). It decides why and how that data is used — for example which punches need a photo or a location check.
• DevSoft Express SRL is the data processor for that data: we host and run WFSuite on your employer's behalf, under a data processing agreement (art. 28 GDPR), and use the data only to provide the service.
• DevSoft Express SRL is the data controller for customer accounts (the company administrators who sign up and manage the subscription), for support requests and for visitors of this website.

If you use WFSuite as an employee, questions about how your employer uses your data are best addressed to your employer; we help it answer.

2. What data we process

WFSuite is not meant for special categories of data such as health data. Please don't enter them in free-text fields such as the reason for a leave request.

3. The mobile app

• Location is read only at the moment you clock in, clock out or take a break, and only while the app is open — never in the background. It is attached to that single punch so your employer can check it was made at the workplace.
• The camera is used to scan QR codes (your sign-in badge, workplace and zone codes) and, when your employer requires it, to take a photo at clock-in. The photo is sent to your employer's account and then deleted from the phone.
• The app keeps on your phone only what it needs to work: your sign-in tokens in the encrypted system store (Android Keystore / iOS Keychain), your language and theme, and punches made without a connection until they are sent.
• The motion sensor is used only on the phone, for a small visual tilt effect; nothing is recorded or sent.
• The app contains no advertising and does not track you across other apps or websites. The QR scanner is built on Google ML Kit: codes are read on the phone and neither the images nor the content of the codes are sent to Google, but ML Kit sends Google technical diagnostics (device and app information, an identifier, performance and error data) that Google uses to maintain the component.

Every permission is explained on the App permissions page.

4. Why the data is processed, and on what legal basis

• Providing WFSuite to your employer — attendance records, leave, shifts and notifications. Your employer relies on its legal obligation to record working time (art. 6(1)(c) GDPR), on the employment contract (art. 6(1)(b)) and, for checks such as location and photo at clock-in, on its legitimate interest in accurate time records free of fraud (art. 6(1)(f)). We process this data on its instructions.
• Security of the service — protecting accounts, preventing abuse and investigating incidents (legitimate interest).
• Customer accounts and billing — managing the subscription and invoices (contract; legal accounting obligations).
• Support — answering your requests (contract or legitimate interest).

We do not use your data for advertising, we do not sell it and we make no automated decisions that have legal effects on you.

5. Who receives the data

• Your employer — its administrators and managers, according to the roles it assigns in WFSuite.
• Our service providers (sub-processors), bound by data processing agreements:
  • the provider hosting our servers, in the European Union;
  • Aruba S.p.A. (Italy) — delivery of the emails the platform sends;
  • Anthropic PBC (USA) — only when an administrator uses an AI-assisted feature (importing employees from a spreadsheet, drafting a work schedule): the content of that request is processed to produce the result and is not used to train AI models.
• Systems chosen by your employer — if your employer connects WFSuite to its payroll or another system (for example to export punches), the data flows there under its responsibility.
• Google — only the technical diagnostics of the mobile app's QR scanner, described in section 3.
• Public authorities, when the law requires it.

6. Where the data is stored

WFSuite data is stored on servers in the European Union. Data leaves the European Economic Area only in the two cases described above — AI-assisted features (Anthropic) and the QR scanner's diagnostics (Google) — and only with the safeguards the GDPR requires: the Standard Contractual Clauses approved by the European Commission or the EU–U.S. Data Privacy Framework.

7. How long the data is kept

• Attendance, leave and schedule records are kept while your employer uses WFSuite and for the periods it must keep them by law (labour, tax and social-security rules). When the contract ends we delete or anonymize them, unless your employer asks us to return them first.
• Photos taken at clock-in are kept as long as your employer keeps the related punches; on the phone they are deleted as soon as they are uploaded.
• When an account is deleted, its profile and sign-in data are removed; records your employer must keep by law are retained without the sign-in data.
• Technical and security logs are kept for a limited period and then deleted.

8. Security

Connections are encrypted (HTTPS/TLS); passwords are stored only as salted hashes; access uses short-lived tokens that can be revoked; each company's data is kept apart from the others'; access within a company follows the roles its administrators assign; and administrators' changes are recorded in an audit log.

9. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw any consent you gave. As an employee, send your request to your employer (the controller) or to us: we forward it and help your employer answer within one month.

You can also lodge a complaint with a data protection authority — in Romania the ANSPDCP (dataprotection.ro), in Italy the Garante per la protezione dei dati personali (garanteprivacy.it) — or with the authority of the country where you live or work.

10. Deleting your account

How to ask for your account and data to be deleted, and what is kept, is explained on the Delete your account page.

11. Cookies

This website uses only the technical cookies it needs to work and to remember your choices. There are no analytics, advertising or third-party cookies.

The mobile app does not use cookies.

12. Children

WFSuite is a workplace tool and is not intended for children. Where an employer enrols workers under 18 as the law allows, the employer remains responsible for that processing.

13. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the last revision; we inform customers of substantial changes in advance.

14. Contact

For any question about this policy or your data, write to devsoftexpress@gmail.com.