Privacy policy
Version 1.1 ·
This privacy policy explains how CIAO Clean, the website ciao-clean.be and the related mobile application for attendance registration in the cleaning sector process personal data. It applies to website visitors, employers and clients using CIAO Clean, app users, workers, self-employed persons, contact persons and other data subjects.
1. Controller and contact
The controller for this website and service is:
NEM Software S.L.
Avenida Juan Carlos I 17 bis, of. 24
35019 Las Palmas de Gran Canaria
Spain
Enterprise number: ESB13777594
Email: [email protected]
For privacy questions or requests for access, correction, objection, restriction, portability or deletion, contact us at [email protected]. Please make clear that your request concerns privacy or data protection.
2. Personal data we process
Depending on how CIAO Clean is used, we may process the following categories of personal data:
| Category | Examples |
|---|---|
| Identification and account data | Name, email address, phone number, language, role, organisation, company details, user ID |
| Work and registration data | Employer, client, work site, schedule, check-in, check-out, timestamps, registration status, error messages and confirmations |
| Location data | The location at the moment of check-in or check-out, only to verify presence at or near a registered work site |
| Device and technical data | Device type, operating system, app version, IP address, log files, security and error logs |
| Communication data | Emails, support requests, demo requests, feedback and administrative correspondence |
| Website and cookie data | Necessary cookies, cookie preferences and, only after consent, limited website analytics |
CIAO Clean is not intended to process special categories of personal data such as health data, religious beliefs or biometric identification. Do not upload or register such data unless we explicitly request it and a valid legal basis exists.
3. Location use in the mobile app
The mobile app may request access to the device location. That location is used only when a user checks in or checks out, to verify that the registration belongs to the correct work site.
CIAO Clean does not use continuous background tracking and does not track users between registration moments. If location data is not technically or legally necessary for a specific registration, it is not used for other purposes.
The user can manage location permission in the iOS or Android settings. If location access is refused, some registration features may be limited or unavailable because presence cannot be verified automatically.
4. Why we process personal data
We process personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Creating and managing accounts, roles and organisations | Performance of a contract |
| Recording check-ins, check-outs and presence at work sites | Performance of a contract; legal obligations or legitimate interests of the employer/client |
| Sending, monitoring and storing registrations and confirmations for legal attendance registration | Legal obligation; performance of a contract |
| Security, fraud prevention, logging and troubleshooting | Legitimate interest |
| Support, communication, demo requests and administration | Performance of a contract; legitimate interest |
| Improving the website and service | Legitimate interest or consent where cookies/analytics require it |
| Complying with legal obligations and defending rights | Legal obligation; legitimate interest |
Where we ask for consent, for example for non-essential cookies or app permissions, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before the withdrawal.
5. Who we share personal data with
We do not sell personal data and do not use it for advertising purposes.
Personal data may be shared with:
- the employer, client or organisation for which the user works or registers;
- competent public authorities or official platforms, including the Belgian National Social Security Office (NSSO), where attendance registrations must legally be submitted or verified;
- technical service providers acting on our behalf for hosting, security, storage, support, email, logging, monitoring or analytics, including Crisp’s live chat, which is loaded only when you open the chat yourself;
- professional advisers, authorities or courts where required by law or necessary to protect our rights.
We enter into appropriate data processing agreements with processors. Third parties that access personal data must provide an equivalent level of protection and may process the data only according to our instructions or their own legal obligations.
6. International transfers
We aim to process personal data within the European Economic Area. If a service provider processes personal data outside the EEA, we do so only where a valid transfer mechanism exists, such as an adequacy decision, standard contractual clauses or other appropriate safeguards under the GDPR.
7. Security
We take appropriate technical and organisational measures to protect personal data, including access control, encrypted connections, logging, backups, restricted access rights and security checks. No system is completely risk-free, but we limit access to personal data to people and service providers who need it.
8. Retention
We do not keep personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is legally required or justified.
In general:
- account and organisation data is kept while the account or contract is active and afterwards for as long as needed for administration, evidence and legal obligations;
- attendance registrations, confirmations and audit logs are kept for as long as needed for legal compliance, inspection, disputes and evidence;
- support and communication data is kept for as long as needed to handle the request and document our service;
- technical logs are kept for a limited period, unless longer retention is needed for security, error analysis or legal reasons;
- website analytics data is kept according to the retention settings of the analytics system used and only where analytics is active.
When data is no longer needed, we delete or anonymise it.
9. Account deletion and data deletion
Users can request deletion of their account or personal data at [email protected]. We handle such requests under the GDPR.
When an account is deleted, we delete or anonymise personal data that is no longer needed. Some data cannot be deleted immediately where we or our customers must retain it for legal attendance registration, audit obligations, contractual obligations, security, disputes or accounting obligations. In that case, we restrict processing to those necessary purposes.
Employers or organisations using CIAO Clean may also have their own legal obligations to retain registration data. A worker may therefore also contact their employer about work-related data.
10. Your rights
Under the GDPR, subject to the legal conditions, you have the right to:
- request access to your personal data;
- correct inaccurate data;
- request deletion;
- restrict processing;
- object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent.
You can exercise these rights at [email protected]. We may ask you to confirm your identity before carrying out a request.
You also have the right to lodge a complaint with a data protection authority. In Belgium this is the Belgian Data Protection Authority; in Spain this is the Agencia Española de Protección de Datos.
11. Cookies and website analytics
The website uses necessary cookies for basic functions such as cookie preferences. Non-essential analytics runs only after you give consent through the cookie banner. You can change your choices through the cookie settings on the website.
More information is available in our cookie policy.
12. Children
CIAO Clean is a business service and is not directed at children. We do not knowingly collect personal data from children for marketing or consumer purposes. Where a minor is legally allowed to work and is registered through an employer, the processing takes place in the context of the employment relationship and applicable legal obligations.
13. Changes
We may update this privacy policy when our service, legislation or data processing changes. The date at the top of this document shows when this version was last updated.