Template notice: staff data and work tools

1. Controller and contacts

The employer identified in the company notice is controller. MT Digital Services LLC supplies KlyraOS as processor. Provider requests: admin@mtdigitalservices.net; employer privacy and any DPO contact must be supplied before delivery.

2. Purposes, bases and required data

The employer identifies each function’s basis: work organization, contract, payroll/social or food-safety duties, or assessed legitimate interests. State required data and consequences of absence. Blanket app consent does not justify monitoring or health data; Article 9 conditions and local rules apply.

3. Data and sources

Identity, contact, contract, pay and document identifiers; shifts, breaks, attendance, leave, attachments and corrections; signatures/evidence, HACCP authors and times, messages/files. Sources are individuals, employer, authorized users or imports. Collect only necessary data, not unnecessary diagnoses.

4. Clock-in, images, voice and location

Depending on tools, an event may include time, site, photo, signature and coordinates/accuracy; not all clock-ins occur at a dedicated station. Explain when required and who sees them. The Fleet module receives vehicle tracker position, speed, ignition and mileage that can be linked to the driver: it needs specific information and the legal conditions on remote monitoring, beyond a generic attendance notice.

Audio/photos may be submitted for assistance, scans and attachments. Biometric unlocking is separate: the provider receives the result, not OS fingerprints/facial templates. Do not use this template to claim absence of all remote monitoring.

5. Documents, AI and decisions

Enabled modules may analyze contracts, images and audio with Google Gemini/OpenAI, including personal data in files. Explain use, necessity and recipients, avoid unauthorized special-category data and review outputs. The platform is not intended to autonomously decide hiring, penalties or dismissal. Disciplinary use requires legal conditions and specific information.

6. Access and transfers

Authorized people according to site/task, necessary providers and legally required parties have access. Actual integrations/services and safeguards outside the EEA must be identified in the employer notice; general list at /legal/privacy. Published links/files may be reachable by recipients and must be limited.

7. Retention and security

The employer must set and disclose periods for attendance, contracts, absence, health documents and checks by purpose/law. “As necessary” without criteria is insufficient. Closing access does not automatically erase mandatory records, attachments or copies; deletion must be assessed/documented. Access restrictions and protected transmission apply; devices/exports must be secured.

8. Rights and complaints

Contact the employer for access, rectification, erasure, restriction, objection and portability where applicable, optional-consent withdrawal and complaints to the competent authority. Personal export is available in the profile. Provider: admin@mtdigitalservices.net; employment requests are coordinated with the controller. Response normally within one month, with a reasoned extension of up to two further months.