Legal

Privacy Policy

Last updated: June 1, 2026 · Effective immediately

1. Overview

HRX Avatar ("we", "our", "the Service") is an HRX Detector–based attendance tracking platform operated by HRX Avatar. This Privacy Policy explains how we collect, use, and protect personal data when you use our mobile application, admin dashboard, and associated services.

We are committed to GDPR compliance (Regulation (EU) 2016/679). Your organisation acts as the data controller; we act as the data processor on your behalf.

2. Data We Collect

Account data

Email address, name, role, organisation ID — provided at registration.

Attendance events

Clock-in/out timestamps, site ID, detector ID, proximity signal strength, device ID. Generated automatically by the mobile app.

Device data

Mobile device identifier (UUID), app version, OS type. Used for device-binding security.

Usage data

Error logs and crash reports (anonymised). No keystroke or screen recording.

Billing data

Handled exclusively by our payment processor. We store only subscription identifiers — never card numbers.

3. How We Use Your Data

Provide and operate the attendance tracking service
Generate payroll-grade attendance reports for export to HR systems
Enforce security (device binding, role-based access control)
Send transactional notifications (clock-in confirmations, reminders)
Debug and improve the service using anonymised diagnostic data
Process subscription payments

We never sell personal data. We never use attendance data for advertising.

4. Data Retention

Attendance events and session data are retained for the duration of your active subscription plus 12 months. Upon account closure, all personal data is deleted within 30 days. Anonymised aggregate statistics may be retained indefinitely.

Audit logs are retained for 36 months to satisfy labour law traceability requirements.

5. Data Storage & Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Attendance exports are cryptographically signed to guarantee integrity. Access is restricted by role-based authentication tokens validated on every request.

Data is stored in EU-based cloud infrastructure. We use reputable sub-processors subject to data processing agreements and EU Standard Contractual Clauses where applicable. A full list of sub-processors is available upon request.

6. Your Rights (GDPR)

As a data subject, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion ("right to be forgotten")
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interests
Restriction — restrict processing in certain circumstances

Submit requests to: privacy@hrxavatar.com. We respond within 30 days.

7. Contact

Data Protection contact: privacy@hrxavatar.com

HRX Avatar, France