Data Processing Terms for Lemorange Attendance

1. Roles

The customer is the controller. Lemorange is the processor. This covers the data of the customer's staff, its visitors and other people whose data the customer puts into Attendance, or that Attendance collects for the customer.

Lemorange is the controller of its own business data, such as enquiries, billing and security logs. The Privacy Notice explains this.

2. What we do and for how long

Lemorange processes personal data to provide Attendance to the customer: to store and show it, to calculate working time and pay, to send notifications, invites and messages, to run doors, kiosks and intercoms that the customer has connected, and to support and secure the service. Processing lasts for the term of the customer's agreement, plus the return and deletion period in section 10.

3. Instructions

Lemorange processes personal data only on the customer's documented instructions. The customer's agreement, its settings in Attendance and its use of the features are its instructions. If Lemorange thinks an instruction breaks the law, it will tell the customer. Lemorange may refuse or pause that instruction until it is clarified.

4. Confidentiality

Everyone at Lemorange who can see customer personal data is bound by a duty of confidentiality and has access only when the work needs it.

5. Security

Lemorange must apply risk-based security measures under Article 32. Annex B lists the measures that apply. A change must not reduce agreed protection.

6. Sub-processors

The customer gives general permission for sub-processors only when the initial register is agreed. Lemorange must bind each authorised sub-processor by a written contract imposing the same relevant data-protection duties and remains responsible for their performance.

Lemorange will give notice of a new or replacement sub-processor at least 30 days before it starts to process customer data. Notice is given by updating the list and by email to the customer's administrator. The customer may object within that time, on reasonable data-protection grounds. If the parties cannot agree, the customer may end the affected service and receive a refund of fees paid for the period after that.

The initial register must identify each actual legal entity, service, country, data category and safeguard. Objections raised within the 30-day notice period must be resolved before disclosure.

7. International transfers

Hosting and support locations, including any access outside the EEA, are identified in the sub-processor register. Before a restricted transfer, the parties identify the importer, country, data, onward access and valid Chapter V mechanism. An EU endpoint does not settle all processing. Annex D records the approved transfer terms.

8. Helping the customer

Lemorange will help the customer, taking account of the nature of the processing and of the information Lemorange has:

• to answer requests from people about their data. Attendance has tools for this, such as export, correction and deletion, and deletion of visitor records by the customer's managers. If a person asks Lemorange directly, Lemorange will pass the request to the customer without undue delay;
• with data-protection impact assessments and prior consultation, for example where the customer uses biometrics, location, cameras, Safety check or intercom images;
• with the customer's own security and breach duties.

A direct request is forwarded without undue delay with its original receipt date. The controller decides the response; forwarding does not restart its statutory period. Lemorange assists with recipient notices, restriction and safeguards concerning significant automated decisions where applicable.

9. Personal-data breaches

Lemorange informs the customer without undue delay after becoming aware of a personal-data breach affecting customer data, with available information supplied in stages. It does not wait for final confirmation of cause or affected-person count. Incident contact: support@lemorange.com or 80012900.

Initial notice must not wait for a final investigation or full affected-person count. Further details, including likely effects and mitigation, are supplied in stages. Incident contact: support@lemorange.com or 80012900.

10. Return and deletion

During the agreement the customer can use available export functions. At the end, Lemorange returns or deletes covered data at the customer’s choice, unless Union or Member State law requires specified storage. Active copies, backups and device or gateway copies within its control follow the completed retention and deletion schedule. For the export format, deadlines and backup cycle that apply, write to support@lemorange.com.

The customer choice covers existing copies held by Lemorange and its sub-processors, including devices, gateways and backups under their control. During agreed deletion periods, copies must be restricted from ordinary use; a restored backup must receive the deletion instruction again. Statutory retention must identify the actual law and affected data. For the export format and backup cycle that apply, write to support@lemorange.com.

11. Audit

Lemorange will give the customer the information needed to show that these terms are met, and will allow audits, including inspections, by the customer or an auditor the customer names, with reasonable notice, in business hours, no more than once a year unless there has been a breach, and subject to confidentiality. The customer bears the cost of an audit, unless the audit shows a material breach by Lemorange.

Routine notice, frequency and costs cannot make an audit ineffective or delay an urgent incident or regulatory investigation. Necessary information and corrective evidence must remain available.

12. The customer's duties

The customer must have a lawful basis for the data it gives Lemorange. It must give people the information the law requires, including to visitors, and to staff about Safety check, kiosks, doors, intercom and payroll. It must keep access permissions, retention settings and credentials under control, and must not put in data that Attendance does not need.

13. Liability

Each party's liability under these terms is subject to the limits in the customer's agreement with Lemorange.

Annex A. Details of the processing

Subject and nature. Hosting and processing of workforce, visitor, access and payroll data in Attendance, as described in section 2.

Data subjects.

• Customer staff, managers and contractors, including people who appear in Team Moments photos.
• Visitors and other non-employees invited to the customer's sites.
• Customer administrators and other users.

Types of personal data.

• Identity and contact: name, employee code, email, phone, job title, department, site.
• Attendance and scheduling: clock-in and clock-out records, rosters, leave, hours, approvals, audit history.
• Credentials: terminal PINs (not hashed; visible only to administrators who manage people), RFID or NFC card numbers, QR codes.
• Mobile and device: identifier, push token, app version and, if enabled, location and network evidence during attendance checks, including clock-out.
• Visitor records: name, email, phone, company, host, visit times and pass token.
• Safety check: who was on site, the answers "Safe" or "Need help" with times, drill results.
• Kiosk data and reception calls, if supplied; including any media and recording.
• Door access and intercom: door decisions, entry logs, intercom snapshots and photos (visible to managers, to the staff an intercom call rings or is transferred to, and to the person who answers it, as the customer's settings allow).
• Payroll (Cyprus): salary and rates, tax and social insurance details, deductions, payslip results, bank details.
• Team Moments: photos (EXIF and GPS removed), captions, reactions, comments, reports and moderation actions, with who and when. Photos may show people other than the poster.
• Fleet positions, trips, driver links, private-trip metadata, fuel and receipts where ordered.
• Phone and terminal punch photos, work messages, notification previews and configured System inputs.

Special categories. Leave evidence may reveal health information; a safety answer may reveal a health or safety need; and biometric identification may use face or fingerprint templates. A photograph is not automatically special-category biometric data. The customer must identify the Article 6 basis, any Article 9 condition and necessary safeguards for each use.

Retention schedule. The customer decides the lawful retention period for each row, subject to any legal hold.

Retention defaults. These apply unless the customer sets another period where the product allows it.

Duration. The term of the agreement and the period in section 10.

Annex B. Security measures

• Hosting in EU data centres with network and physical protection by the hosting provider.
• Encryption in transit (TLS) for the web app, the mobile app, kiosks and calls. Encryption at rest.
• terminal PINs are stored so that the terminal can check them and are visible only to administrators who manage people; app invitation codes are stored hashed. Visitor pass tokens that cannot be guessed.
• Separation between customer workspaces. Role-based access. Safety check answers, intercom images and payroll data limited to named roles.
• Audit history of changes and of support access. Logged and limited support access.
• Controls against repeated and malicious requests.
• Backups, and a tested restore process.
• A process for security incidents and breach notice.
• Testing and backup data flows are covered by the sub-processor register.

For details of hosting regions, encryption by path, support access, recovery tests and deletion evidence, write to support@lemorange.com.

Annex C. Sub-processors

The register is at attendance.cy/sub-processors. The notice and objection process in section 6 applies to changes.

Annex D. International transfers

Any restricted transfer requires documented instructions, the applicable executed mechanism and assessment before access. This page does not itself execute standard contractual clauses or approve an unverified recipient.

Annex E. Records and completion

Each party keeps the Article 30 records required for its role, including instructions, recipients, transfers and general measures. The processor assists with security, breach assessment, impact assessments and prior consultation as far as its information allows. Neither a private liability cap nor an audit fee removes mandatory data-protection duties.

The customer agreement records, for each customer, the controller and any upstream controller, the modules and purposes, the people and special categories, retention, incident contacts, export format and deletion of device, gateway and backup copies. Provider entities and countries are in the sub-processor register, and transfer instruments are put in place under Annex D. Details not yet recorded do not authorise unassessed processing.