Privacy at work, explained.

The employer or organisation that creates an Attendance.cy workspace normally decides why employee data is used, which features are enabled, who may access the records and how long they are retained. It is the controller of that workforce data.

Lemorange Ltd, based in Nicosia, Cyprus, provides and secures Attendance.cy as a processor under the customer's instructions and agreement. Lemorange is separately responsible for its own website enquiries, support and business records. We do not make employment or pay decisions about workers.

Attendance.cy uses the data to provide secure sign-in, schedules, attendance, shift-cover messages, hours and approvals selected by the customer; to protect the service; and to support a documented request or correction. The employer must identify the lawful basis for its workforce processing and inform its workers.

Access is limited to authorised people in the customer's workspace and Lemorange personnel who need it for service delivery, security or support. Hosting, notification and technical providers process only what is needed for their role. An HR, payroll or access-control integration receives data only when authorised by the customer. We do not sell workforce data or use it for advertising profiles.

If processing outside the European Economic Area is required, Lemorange and the customer use the applicable legal transfer safeguards. The customer agreement may describe a particular deployment and provider arrangement.

Production communications are encrypted in transit. Attendance.cy separates customer workspaces, restricts access by role and records relevant changes in an audit history. No online system is completely risk-free; organisations must protect their own accounts, devices and networks too.

Workforce records follow the customer's documented retention settings and instructions. On termination, data is returned or deleted as agreed. Attendance, payroll, tax, security or dispute records may need restricted retention for a legal obligation or claim. Limited protected backup copies can remain until the normal backup cycle overwrites them. There is no single fixed period for every customer or record type.

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, or object to processing. Some rights are subject to legal obligations. For workforce data, contact the employer controlling your workspace; Lemorange cannot erase it on a worker's direct instruction without involving that customer unless law requires otherwise.

Signed-in employees can open Your data rights in the Attendance.cy app's Settings, submit an account-and-data deletion request, and follow its status and response. If you cannot sign in, contact your employer or email [email protected] so we can direct the request appropriately. Do not email a password, PIN or QR code.

Requests are reviewed without undue delay and normally within one month after identity and authority are confirmed. We explain any data that cannot be removed and why. The steps and retention limits are set out on the Attendance.cy data-deletion page.

You may complain to the Cyprus Office of the Commissioner for Personal Data Protection or the authority where you live or work.