Privacy policy

1. Controller and contact

The controller is Chutis d.o.o., Dunajska cesta 56, 1000 Ljubljana, Slovenia. Send privacy questions, rights requests or account-closure requests to info@chutys.com or the postal address, marked ‘Privacy — Chuty’s Evidenca’.

Chutis uses the service for its employees and collaborators, including assignments at different Chuty’s, BaoHaus or TopDunajc workplaces. A workplace brand does not itself change your account’s controller. An authorised administrator provisions your account; there is no public registration.

2. Information and sources

Your employer or administrator provides your name, username, contact information, language, account role/status, employment type, employer, job role, workplaces, working-time targets and scheduling information. Passwords are salted hashes, not readable passwords.

At first login or profile completion in the mobile app or web mobile preview, you enter or confirm your phone number and date of birth. Both are required to complete initial setup; older accounts may have a time-limited transition to fill in missing information. These values are sent to the server and stored in your account-linked profile. The phone number is employee contact information; date of birth supports the minimum app-access age of 13 and scheduling safeguards for minors. Ask an administrator to correct confirmed information later. This check does not permit legally prohibited work.

The service processes shifts, arrivals/departures, time and workplace, registration method/reliability, corrections, unavailability, absence requests and decisions, leave allowances and usage. Information comes from you, confirmed automatic events or authorised staff. Gross hourly/monthly agreements are separate restricted administrative records, not displayed in the employee mobile app.

Sickness/care categories may reveal health information. Do not enter diagnoses, medical documents or unnecessary third-party information in comments. The app does not need your address book, photographs or microphone.

Operational/security information includes a random installation identifier, platform/app version, permission states, notification token/content/delivery/read status, activity, login attempts, operations and changes, time, outcome, IP address and limited diagnostics. The installation identifier is not an IMEI or advertising identifier.

3. Purposes and legal grounds

Statutory working-time records and employer duties rely on legal obligations, including Slovenia’s ZEPDSV and ZDR-1 (GDPR Article 6(1)(c)). Necessary contact, scheduling and agreement information supports the employment/collaboration contract (Article 6(1)(b)). Minimal health-revealing absence information is handled only for employment/social-security rights and duties subject to Article 9(2)(b).

Account protection, change accountability and troubleshooting serve the controller’s legitimate interest in a secure and reliable service (Article 6(1)(f)). Limited GPS workplace verification serves registration reliability. Before introducing GPS for employees, the controller must document necessity, proportionality and a balancing assessment for this basis, and provide a less intrusive alternative. This notice does not replace that assessment. A statutory attendance obligation does not authorise continuous movement monitoring. You may object to legitimate-interest processing.

Automatic GPS attendance is optional. Device permission is a technical requirement, not a legal basis for unlimited surveillance. Contact your manager or info@chutys.com for an alternative recording arrangement and verified administrative entry/correction if you cannot or do not wish to use your personal phone/GPS, or a reading is inaccurate. Schedules and eligible requests remain available without automatic GPS.

4. Location and your choices

Manual check-in/out obtains your current latitude, longitude and accuracy to validate the selected workplace radius. The server may retain these confirmation readings, time and distance linked to your account.

If you enable automatic attendance and background-location permission, the phone detects entry/exit from workplace geofences and obtains confirmation readings while backgrounded or locked. The server checks registration conditions; arrival may be checked within a permitted window before a published shift. Location checks therefore are not limited to already recorded working time.

Release 0.5.1 does not collect movement trails outside workplaces. Additional route collection is disabled in the mobile release and production server and cannot be enabled through a hidden setting. Location is not used for advertising or data sales.

Disable automatic attendance in the app or change permissions in device settings. GPS can be inaccurate or unavailable; a missing/incorrect reading alone does not prove you were not working. Request a correction in the app or contact the controller.

5. Access, providers and international processing

Authorised personnel receive access according to duties and assigned modules. Employees use their own profiles. Managers/administrators handle operational records and requests; pay agreements are restricted to superadministrators in the interface. Attendance-accounting exports exclude passwords, raw coordinates and pay agreements. An administrative title is not permission to reuse information for unrelated purposes.

Authorised technical providers support hosting, maintenance, recovery and support; current hosting uses Neoserv infrastructure. Necessary information may be shared with authorised accounting/service providers and competent authorities where legally required. Ask the controller for actual recipients and their roles.

Push notifications use Expo Push Service and Apple APNs on iPhone. Tokens, message contents and linking identifiers are transmitted; shift notifications may contain workplace/date/time and appear on a locked screen. Android push depends on FCM configuration and is not guaranteed in this release; notifications remain accessible in the app. You can disable push in device settings.

Administrative maps request OpenStreetMap tiles, disclosing the viewer’s network information and requested geographic area. Apple/Google and TestFlight also process information under their own terms. The app has no advertising SDK and does not send these records to generative AI.

International notification/distribution services may process information outside the EEA, including the United States. Expo (650 Industries, Inc.) states participation in the EU–US Data Privacy Framework for transfers covered by its certification. Apple identifies Apple Distribution International Limited in Ireland for EEA data and Standard Contractual Clauses for international transfers. Current policies are linked below. These mechanisms do not automatically cover every provider or imply EU-only processing; the controller must verify each transfer’s scope. Contact info@chutys.com for recipients, applicable safeguards or copies.

6. Retention and deletion

Attendance-confirmation coordinates/accuracy have a 60-day expiry in the primary database. An hourly cleanup removes expired fields; technical failures can delay physical deletion until a successful run. Time, workplace, registration method and other necessary attendance information remain; this is not anonymisation of the whole record.

Statutory working-time records follow ZEPDSV scope and retention requirements; documents covered by its Article 19 have permanent archival value. This does not justify permanent GPS or technical-data retention. Other employment records/agreements are kept for the relationship and applicable legal duties or specific claims.

For operational profiles, schedules, requests, notifications, devices and server logs, retention is determined by necessity for the relationship, handling a matter, security, evidence of a specific change or a legal obligation. This release has no universal automatic deletion period for these categories; the controller handles restriction/deletion according to category and purpose and explains the relevant period or continuing need on request. Account inactivity is not deletion.

The phone can hold up to 20 pending automatic events for retry. Entries older than 48 hours are removed when the local queue is processed and are rejected by the server. Local safe diagnostics hold up to 30 entries and remove entries older than seven days when the queue is used. Signing out clears local queues. These are not guaranteed deletion timers while the app remains unopened.

Backups and downloaded exports are separate copies. Primary-database deletion does not immediately erase every copy. Access is restricted and recovery needs, legal retention and deletion must be assessed; expired retention must be reapplied after restoration. Ask the controller about copies of your information and their specific retention.

7. Rights, account closure and security

Subject to GDPR conditions, you may request access/copies, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent where relied on. Email info@chutys.com; identity verification may be required. Requests are handled without undue delay, normally within one month; any lawful extension and reason will be communicated.

Use the same contact for account closure/deletion. The employer provisions accounts; there is no public mobile signup. Where a specific legal duty or claim limits erasure, the controller explains the information, reason and retention. Disabling GPS or signing out does not erase lawfully retained records.

You may complain to Slovenia’s Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

Service connections use HTTPS and access controls. Mobile login tokens use operating-system protected storage. Do not place credentials in comments or send them through insecure channels. Report security concerns to info@chutys.com. No system can promise zero risk.

8. Minors, human review and changes

The service is for authorised users aged 13 and over. This does not permit employment/prohibited work or replace Apple/Google account conditions or rules on children’s consent. The employer verifies account/work eligibility; the app does not publicly enrol children.

Software may draft schedules from configured rules, employment type, availability and priority; an authorised person publishes them. Automatic attendance can be reviewed/corrected. The app itself does not decide sanctions or payroll payments. Contact your manager or info@chutys.com for human review.

Material changes to purposes, information categories or operation require an updated notice before the new use. The date above identifies this version. A new function does not authorise covert monitoring.