Legal
Privacy Policy
This policy explains how Leratech Solutions S.R.L processes personal data in connection with the Timetrackr service and this website. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), which applies in Norway through the EEA Agreement.
1. Two different roles
The distinction below decides who is responsible for what, so it comes first.
- We are the controller for data about visitors to this website and people who contact us or sign up for a subscription. We decide why and how that data is processed, and this policy governs it.
- We are a processor for the content inside a customer’s Timetrackr tenant — their tickets, time entries, screen recordings, client records and staff accounts. The customer is the controller of that data. We process it only on their documented instructions under a Data Processing Agreement, and their own privacy notice governs it, not this one.
2. Controller and contact
- Controller: Leratech Solutions S.R.L, Strada di Paderna 2, 47895 Domagnano, Republic of San Marino, registration number COE SM31912
- Privacy contact: privacy@timetrackr.it
- Data Protection Officer: Not appointed. We have assessed that Article 37 does not require one; the privacy contact above handles all data protection enquiries.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (Art. 6) | Retention |
|---|---|---|---|
| Name, work email, company, billing address | Creating and administering a subscription, invoicing | 6(1)(b) contract | Duration of contract + 5 years (Norwegian Bookkeeping Act) |
| Email address and message content | Answering sales and support enquiries | 6(1)(b) pre-contractual steps, or 6(1)(f) legitimate interest | 24 months from last contact |
| Payment and billing records | Processing subscription payments via Stripe | 6(1)(b) contract; 6(1)(c) legal obligation | 5 years (statutory accounting retention) |
| Server logs, IP address, user agent | Security, abuse prevention, availability | 6(1)(f) legitimate interest in a secure service | 90 days |
| Cookie and consent preferences | Remembering your choice and evidencing consent | 6(1)(c) with ePrivacy; strictly necessary | 12 months |
We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you (Art. 22).
4. Recipients and sub-processors
We use a small number of vendors to host, bill and support the service. Each is bound by a written contract meeting Article 28. The current list, with locations and transfer mechanisms, is on the sub-processors page.
5. International transfers
Timetrackr can be deployed entirely within an EU region, and customers choose their data residency at provisioning. Where a vendor processes data outside the EEA, we rely on the European Commission’s Standard Contractual Clauses, supplemented by encryption in transit and at rest. Customers who select local AI models keep ticket content inside their own network, with no transfer to any AI provider.
6. Artificial intelligence
Timetrackr includes AI features, some of which process content that may contain personal data. How those systems work, what they are used for, what they are not suitable for, and how human oversight is maintained is set out separately in our AI transparency statement, which also covers our position under the EU AI Act.
7. Your rights
Under the GDPR you may request access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and you may object to processing based on legitimate interests (Art. 21). Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Write to privacy@timetrackr.it. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. There is no charge unless a request is manifestly unfounded or excessive.
If your data sits inside a customer’s Timetrackr tenant, we are the processor. Send your request to that organisation as the controller — if it reaches us first, we will forward it and tell you we have done so.
8. Complaints
You can lodge a complaint with a supervisory authority, in the EEA state where you live or work. Ours is TODO — San Marino supervisory authority, pending confirmation — . We would rather hear from you first, but that is your right and not a precondition.
9. Security
We apply the measures in Article 32 appropriate to the risk: encryption in transit and at rest, role-based access control, single sign-on through Microsoft Entra ID, server-side enforcement of authorisation, audit logging of privileged and AI-initiated actions, and separation of tenants. Report a suspected vulnerability to security@timetrackr.it.
10. Changes
We will update this page when our processing changes and move the date at the top. Material changes affecting customers are notified by email in advance.