Privacy Policy

1. Introduction

At Norkent ("we", "our", "the Platform"), owned by Thiago Silveira Machado, we value your privacy and are committed to protecting your company's and employees' information. This Policy is governed primarily by the legislation of the Oriental Republic of Uruguay, in particular Law No. 18,331 on the Protection of Personal Data and Habeas Data Action, its implementing regulations (Decree 364/010, Decree 64/020 and resolutions of the Regulatory and Control Unit for Personal Data - URCDP), without prejudice to the application of other international rules that may apply.

This Policy explains what data we collect, how we use it and the applicable rights. As the account administrator, you are responsible for adequately informing your employees about the processing of their data through our platform.

2. Data We Collect

3. Purposes of Processing

We use the data to:

• Provide and maintain the attendance management service
• Manage personnel clock-in and clock-out records
• Generate attendance reports and analytics for the company
• Manage shifts and work schedules
• Prevent fraud and ensure the integrity of the control system
• Comply with legal and tax obligations
• Improve our services through anonymized usage analysis

The legal basis for processing employees' data is the company's legitimate interest in managing the employment relationship, in accordance with article 9 of Law No. 18,331 and current labor regulations, while complying with the obligation to inform employees about such processing.

4. Sharing Data with Third Parties

Your data is not sold. We only share information with:

• Service providers:
  • Supabase: Secure cloud data storage with encryption at rest and in transit
  • Cloudinary: Storage of images (company logos and profile or avatar photos)
  • Vercel: Application hosting and content delivery
  • Resend: Sending of transactional emails (account verification, welcome, notifications and contact form replies)
  • Auth.js: Secure user authentication
  • Identity providers (Google, GitHub): Sign-in through third-party accounts
  • Google Analytics and PostHog: Usage analytics and service improvement
  • Payment processors: To manage subscriptions and recurring charges (Commet, etc.)
• Legal requirements: When required by law, court order or legal proceeding
• Business transfers: In the event of a merger, acquisition or sale of assets, we will notify users

All of our providers meet the required data security standards and have contracts that guarantee equivalent protection.

5. Data Security

We implement advanced technical and organizational measures:

• Encryption: Sensitive data encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Secure authentication: Implemented through Auth.js with industry-grade standards
• Restricted access: Two-factor authentication available for administrators (optional)
• Monitoring and backup: Backups managed by the infrastructure provider and service availability monitoring
• Secure storage: Supabase for structured data and Cloudinary for images
• Periodic assessments: Periodic review of security configuration and access permissions

Employees' identity documents are stored encrypted and are only used to verify identity during QR attendance registration.

6. Cookies and Similar Technologies

We use these technologies in accordance with applicable regulations:

You can manage cookies from your browser settings.

7. Data Protection Rights

In accordance with Law No. 18,331 on the Protection of Personal Data and Habeas Data Action and other applicable regulations, data subjects have the right to:

• Access: Request information about what data is being processed
• Rectification: Update inaccurate or incomplete information
• Erasure: Request the deletion of data when it is no longer necessary
• Objection: Object to the processing of data for specific purposes
• Portability: Receive the data in a structured format
• Restriction: Request the restriction of processing in certain cases

To exercise these rights:

1. Employees must first contact their employer (the account administrator)
2. The administrator can handle requests through the panel or by contacting info@norkent.com
3. We will respond within a maximum period of 30 days

8. Data Retention

We keep the data for:

• Active accounts: As long as you keep your account active
• Employee data: Up to 6 months after an employee stops being part of the company, unless the company requests to retain it for longer for legal purposes
• Billing data: 10 years under tax obligations
• Attendance records: As required by applicable labor legislation (usually between 2-5 years)

Technical logs and QR scan audit records: the retention period for technical logs and QR scan audit records will depend on the type of plan contracted by the client, as detailed in the corresponding plan documentation. In all cases, the minimum periods required by current legislation in the Oriental Republic of Uruguay will be kept and, where no legal minimum applies, for a reasonable period to guarantee security, fraud detection and the integrity of the attendance control system.

Once these periods have elapsed, the data is anonymized or securely deleted.

9. International Transfers

We transparently declare that the information and databases processed through the platform are stored and processed on servers located outside the Oriental Republic of Uruguay, mainly in the United States of America (among others, Supabase's Oregon region and Cloudinary's services), as well as on Vercel's global content delivery network, through cloud infrastructure providers and ancillary services.

These international data transfers are carried out in compliance with article 23 of Law No. 18,331 and its implementing regulations, relying on adequate safeguards ensuring a level of protection equivalent to that provided by Uruguayan law, namely:

• The signing of Standard Contractual Clauses (SCCs) with our providers, in accordance with the models approved by international data protection regulations.
• The engagement of providers offering guaranteed security standards and recognized transfer mechanisms (such as the certification of applicable adequacy frameworks) that ensure an equivalent level of protection.
• Data protection impact assessments where applicable and monitoring of the measures adopted by each processor.

Supabase and Cloudinary, as well as the rest of the providers located outside Uruguay, comply with international data protection standards and keep in force the contractual guarantees necessary to enable such transfers.

Where the legislation of the country of destination of the data does not offer a level of protection equivalent to the Uruguayan one, we will implement additional safeguard mechanisms, in accordance with the provisions of the URCDP and applicable regulations.

10. Administrator Responsibilities

As the account administrator, it is your responsibility to:

• Adequately inform your employees about the processing of their data through Norkent
• Obtain the necessary authorizations under applicable labor legislation
• Handle your employees' data protection rights requests
• Properly configure permissions and access within the platform
• Notify us when an employee leaves the company so we can disable their access

We provide resources and templates to help you comply with these obligations in the administration panel.

11. Changes to the Policy

We will update this policy when:

• Our data processing practices change
• Applicable laws are modified
• We introduce new services or technologies

We will notify important changes through:

• Email notification to account administrators
• Prominent banner on the platform for 15 days
• Updating the date on this page

Continued use after changes implies acceptance of the new policy.

12. Contact and Supervisory Authority

For questions or to exercise your rights:

You can also contact us through our contact form.

If you believe that your rights have been violated, you may file a complaint with the Regulatory and Control Unit for Personal Data (URCDP) of the Oriental Republic of Uruguay, or with the competent data protection authority in your country.