WTMS Privacy Policy
In brief:
- WTMS is a system for businesses. The employer (our Customer) is responsible for employee data in WTMS, and we process such data on its behalf.
- We decide ourselves about data on the wtms.app website, when a demo version is registered, and in sales contacts, billing and security.
- The WTMS mobile application does not track location in the background. It obtains the location only at the moment a photograph is taken and saves it in the photograph’s data.
- The WTMS servers are located in our server room in Poland.
- We do not sell data and do not use it for advertising.
1. Who is responsible for your data
WTMS is operated by inProjects spółka z ograniczoną odpowiedzialnością sp. k., with its registered office in Szczecin, ul. Harcerzy 3, 71-465 Szczecin, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000650754, NIP 854-240-20-87, REGON 321193708 (inProjects, we).
Contact: [email protected], tel. +48 91 886 18 38. We have appointed a Data Protection Officer, whom you can contact at [email protected] or in writing at our registered office address, marked “IOD” (Data Protection Officer).
Our role depends on the data concerned:
| Situation | Who is the controller | Our role |
|---|---|---|
| You browse the wtms.app website, write to us or schedule a meeting | inProjects | controller (section 2) |
| You register a demo instance | inProjects, with respect to registration data | controller (section 3) |
| You represent a Customer, are a contact person or pay for a subscription | inProjects | controller (section 2) |
| You work in WTMS as an employee or associate of a company that uses WTMS (working time, photographs, orders, equipment) | Your employer or principal (the Customer) | processor (section 4) |
| Your data (e.g. address, telephone) appear in an order because a company using WTMS is carrying out work at your premises | that company (the Customer) | processor (section 4) |
| Technical data on the use of the Platform, processed to secure it and to fix errors | inProjects | controller (section 2) |
2. Data we process as controller
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Providing the wtms.app website and securing it | IP address, date and time, address of the requested page, browser type (server logs) | Article 6(1)(f) GDPR: our legitimate interest in ensuring the operation and security of the website | up to 30 days, longer only in the event of an incident |
| Responding to a message sent via the contact form or by e-mail | first name and surname, e-mail, telephone, company, content of the message | Article 6(1)(f) GDPR (responding to an enquiry), and where the enquiry concerns the conclusion of a contract: Article 6(1)(b) GDPR | up to 12 months from the last contact, unless we enter into cooperation |
| Scheduling a meeting via the online calendar | first name and surname, e-mail, selected date and time, additional information provided in the form | Article 6(1)(b) GDPR (steps taken prior to entering into a contract) | up to 12 months from the meeting, unless we enter into cooperation |
| Conclusion and performance of the Agreement with the Customer, contact regarding the Agreement, technical support, complaints | data of persons representing the Customer and contact persons: first name and surname, position, e-mail, telephone; content of requests | Article 6(1)(f) GDPR: legitimate interest in performing the contract with the Customer you represent; where the Customer is a natural person conducting business activity: Article 6(1)(b) GDPR | for the term of the Agreement and until the limitation period for claims expires |
| Billing, invoicing and tax and accounting obligations | invoice data, payment history, transaction identifier at the Payment Provider (we do not store full card numbers) | Article 6(1)(c) GDPR (tax and accounting legislation) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Security of the Platform, detection of abuse, diagnostics of errors and performance | User and Organisation identifier, IP address, event logs, error reports (in the mobile application also the e-mail address and a screenshot taken at the moment of the error), performance and session flow data in the panel | Article 6(1)(f) GDPR: legitimate interest in ensuring the security and continuity of the service | error reports and telemetry data up to 90 days; security logs up to 12 months |
| Establishment, exercise and defence of legal claims | data necessary in the given matter | Article 6(1)(f) GDPR | until the limitation period for claims expires |
| Information about WTMS news sent by e-mail (only if you consent to it) | e-mail, first name | Article 6(1)(a) GDPR (consent) and Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej) | until consent is withdrawn |
Providing data is voluntary, but without some of them we will not be able to respond to an enquiry, set up a Demo or conclude the Agreement. The obligation to provide invoice data arises from provisions of law.
3. Demo instance (Demo)
Anyone can set up, free of charge, a time-limited, separate WTMS demo instance on the wtms.app website. This is how we process data related to the Demo:
| Data | Purpose | Legal basis |
|---|---|---|
| Company name, selected subdomain, business e-mail address; optionally telephone number and language | setting up and providing the Demo, creating the Demo administrator account, contact regarding the Demo | Article 6(1)(b) GDPR (contract for the provision of the Demo service); where you register the Demo on behalf of a company: Article 6(1)(f) GDPR |
| One-time verification code sent by e-mail | confirming that the e-mail address belongs to you. We store the code and the address only in the form of a cryptographic hash, for 15 minutes | Article 6(1)(f) GDPR (prevention of abuse) |
| IP address from which the registration was made, and time of registration | detecting abuse, enforcing registration limits, security | Article 6(1)(f) GDPR |
| Result of the anti-bot verification (Cloudflare Turnstile) | protecting the form against automated registration. Cloudflare analyses technical browser signals and the IP address | Article 6(1)(f) GDPR |
| Company name, Demo address, e-mail, telephone, language, time of registration (notification for the sales team) | sales contact regarding the Demo and a possible purchase of WTMS | Article 6(1)(f) GDPR (direct marketing of our own services to a company that has expressed interest). You may object at any time. |
- How long: the Demo lasts as standard 7 days from the setting of the password. Access is then blocked, and we retain the data for a further 90 days so that you can continue working after purchasing a subscription. After that time we permanently delete the entire Demo:
- registration data and IP address,
- Demo user accounts that do not belong to another organisation,
- all data and files entered.
- Do not enter personal data of employees or customers into the Demo. The Demo is intended exclusively for testing. If you nevertheless enter such data, your company is their controller, and we process them on its behalf until the Demo is deleted (section 4).
- If the e-mail address provided already has an account in WTMS, we do not create a Demo and we send information about the registration attempt to that address. In this way we do not disclose whether the address exists in the system.
- Demo pages are marked as not to be indexed by search engines.
4. Data in WTMS processed on behalf of Customers
Companies using WTMS (Customers) use it to organise the work of their teams. In this respect, the controller of the data is the Customer, e.g. your employer. The Customer decides:
- what data are collected,
- for what purpose and on what legal basis,
- who has access to them,
- how long they are retained.
inProjects processes these data only on the Customer’s instructions, on the basis of a data processing agreement (Article 28 GDPR) constituting Annex No. 2 to the Terms of Service.
Depending on the modules used by the Customer, the following may be processed in WTMS:
- account data: first name, surname, e-mail, telephone, role, team, supervisor, organisation membership;
- login data: password (in hashed form), QR login code (changed at each login), RFID card identifier, information about invitations;
- working time and attendance: records of clock-ins and clock-outs (including from the RFID kiosk), time spent on tasks, schedules, automatically calculated late arrivals, early departures and breaks, corrections;
- orders and tasks: assignments, statuses, forms, comments, change history;
- photographs and their metadata: the photograph, GPS location and altitude at the moment it was taken, time, camera model and parameters, and on some copies an overlaid caption with the date and coordinates. The image of persons may be visible in photographs;
- devices: identifier, model and operating system version of the phone used with the application;
- equipment, materials and warehouse: tool loans, material withdrawals, vehicles (including registration number);
- fuel and expenses: photographs of receipts, quantities, amounts, supplier data, invoice numbers;
- data of the Customer’s end customers: first name and surname or name, telephone, address and location of the work site, notes;
- change log (audit): who changed what in the data, and when.
If you are an employee or associate of a company using WTMS, full information about the processing of your data and the legal bases, e.g. for working time records or employee monitoring, is provided to you by your employer or principal. Please also address any requests concerning your data, including access, rectification and erasure, to them. If you write to us, we will forward your request to the relevant Customer.
5. WTMS mobile application
The WTMS mobile application (Android, iOS) is intended for Users to whom the Customer has granted access. The application requests the following permissions:
| Permission | What it is used for | When it operates |
|---|---|---|
| Camera | taking photographs documenting work, scanning the QR code to log in | only when you open the camera in the application; the application does not record audio |
| Location (precise and approximate) | saving GPS coordinates in the photograph’s data so that it can be shown on the map at the correct address | only at the moment the photograph is taken: a one-time position reading (up to approx. 8 seconds) or the last known position. The application does not track location continuously or in the background and does not record the route travelled |
| Access to photographs and to the location stored in photographs | adding a photograph from the gallery and reading the location stored in it | only for photographs you select yourself |
| Device storage (Android 9 and earlier) | saving the photographs taken | when a photograph is saved |
| Internet, vibration | communication with the Platform, signalling of events | while the application is running |
- You can revoke the permissions at any time in your phone’s settings. Without access to the camera and location, documenting work with photographs will be impossible or limited.
- Background and offline operation: photographs and data saved without internet access are stored locally on the phone and sent to the Platform when the connection is restored. Sending also takes place in the background, periodically (approx. every 15 minutes). This applies only to the transmission of data, not to the collection of location.
- We store on the device: the login token, the selected organisation and instance, the local database for offline mode and photographs until they are sent. Logging out or uninstalling the application removes these data from the device; the exception is photographs that you have saved in your phone’s gallery.
- Device identifier: the application transmits the device identifier, its model and operating system version so that the Customer can manage company devices.
- Error reports: when the application encounters an error, it sends a report to our diagnostic server. The report contains the User’s identifier and e-mail address, the organisation identifier, technical data of the device, the sequence of events and a screenshot taken at the moment of the error. The diagnostic server is located within inProjects’ infrastructure and is not made available to external entities. The reports are used solely to fix errors.
- The application contains no advertising or tracking tools for advertising purposes and does not use the advertising identifier.
- Account deletion: accounts in WTMS are created and deleted by the Customer (employer). To delete your account, contact the WTMS administrator in your company or write to us at [email protected]. We will forward the request to the Customer and confirm that it has been handled.
6. Cookies and browser storage
The WTMS panel uses only cookies and browser storage mechanisms that are strictly necessary to provide the service you request (an exception to the consent requirement under Article 399 of the Electronic Communications Law). They do not require consent. We do not use advertising cookies or third-party analytics tools.
| Name | Type | Purpose | Retention period |
|---|---|---|---|
sessionid | cookie | maintaining the session of a logged-in user | until logout or session expiry |
csrftoken | cookie | protection against CSRF attacks | up to 1 year |
wtms_access_token, wtms_refresh_token | sessionStorage | authentication of API requests | until the browser tab is closed (access token valid for 60 minutes, refresh token for 7 days) |
wtms.language, wtms.listMode and similar | localStorage | remembering the language, list view, number of items per page and calendar settings | until deleted by the user |
| diagnostic session identifier | sessionStorage | linking errors and performance measurements to a single panel session (monitoring on inProjects servers) | until the browser tab is closed |
| Cloudflare Turnstile | provider’s script and technical data | anti-bot verification in the Demo registration form | according to Cloudflare’s rules, usually for the duration of the verification |
The WTMS information page does not use cookies or analytics tools. We load embedded YouTube videos in privacy-enhanced mode (youtube-nocookie.com). Google may store data in the browser only once a video is started. Google’s privacy policy: policies.google.com/privacy.
You can delete or block cookies in your browser settings. Blocking strictly necessary cookies will make it impossible to log in to the panel.
7. Recipients of data and sub-processors
The WTMS production infrastructure is maintained in the inProjects server room in Poland. The following operate there:
- databases, files and backups,
- the mail server sending system messages,
- the map tile server,
- the error reporting and monitoring system.
We transfer data to other entities only to the extent necessary for specific functions to operate:
| Entity | Scope and purpose | Location / transfer basis |
|---|---|---|
| Cloudflare, Inc. | anti-bot verification (Turnstile) in the Demo form; DNS handling and traffic protection for Demo addresses | USA / EU-U.S. Data Privacy Framework, standard contractual clauses |
| Mapbox, Inc. | conversion of addresses into coordinates (geocoding) and static map previews. Addresses or coordinates are transferred, without User data | USA / EU-U.S. Data Privacy Framework, standard contractual clauses |
| OpenStreetMap Foundation | determining the address on the basis of the photograph’s coordinates (Nominatim) and base maps downloaded by the browser (tile.openstreetmap.org). The provider sees the browser’s IP address | United Kingdom / European Commission adequacy decision |
| MapTiler AG | terrain base map downloaded by the browser. The provider sees the browser’s IP address | Switzerland / adequacy decision |
| Google Ireland Ltd. / Google LLC | if the Customer enables the integration: storage of photographs in Google Drive and synchronisation of spreadsheets in Google Sheets. Where the integration operates on the Customer’s Google account, Google is the Customer’s provider, not ours | EU/USA / EU-U.S. Data Privacy Framework, standard contractual clauses |
| Payment Providers: Stripe Payments Europe Ltd. (Ireland), PayU S.A., PayPro S.A. (Przelewy24), Krajowy Integrator Płatności S.A. (Tpay), Autopay S.A. | handling payments for the subscription. The provider you choose processes payment data as a separate controller, in accordance with its own privacy policy | EU (Stripe may transfer data to the USA on the basis of standard contractual clauses) |
| Cal.com, Inc. | scheduling meetings via the online calendar on the website | USA / standard contractual clauses |
| Accounting firm, legal advisers, auditors | accounting, legal and audit services for inProjects | Poland |
| Public authorities | where an obligation to disclose data arises from provisions of law | in accordance with the law |
Customers and Users also have access to the data within the scope granted by the Customer. We inform Customers of changes to the list of sub-processors at least 14 days in advance (Terms of Service, Annex No. 2, point 5).
8. Transfers of data outside the EEA
We store data in Poland. Data leave the European Economic Area only in connection with the services listed in section 7, i.e. Cloudflare, Mapbox, Cal.com, Stripe and, optionally, Google. In each such case we apply the safeguards set out in Chapter V GDPR:
- a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework for certified entities),
- or standard contractual clauses.
You can obtain a copy of the safeguards by writing to [email protected].
9. How long we retain data
| Data | Period |
|---|---|
| Customer Data in the Platform (section 4) | for the term of the agreement, within the retention period resulting from the plan (e.g. 24 months) or the Customer’s settings. After the agreement ends: 30 days for export, followed by deletion within a further 60 days; from backups in accordance with their rotation cycle |
| Demo and Demo registration data, including the IP address | Demo period + 90 days, followed by permanent deletion |
| Notification of Demo registration for the sales team | up to 12 months from the end of the Demo, unless we enter into cooperation |
| E-mail verification code (hash) | 15 minutes |
| Information page server logs | up to 30 days |
| Error reports and telemetry data | up to 90 days |
| Security logs | up to 12 months |
| Enquiries and sales correspondence | up to 12 months from the last contact |
| Data of the Customer’s contact persons | term of the agreement + limitation period for claims |
| Billing documents | 5 years from the end of the year in which the tax payment deadline expired |
10. Your rights
With respect to data for which we are the controller, you have the right to:
- access your data and obtain a copy of them (Article 15 GDPR),
- rectification of your data (Article 16 GDPR),
- erasure of your data (Article 17 GDPR),
- restriction of processing (Article 18 GDPR),
- portability of data processed by automated means on the basis of a contract or consent (Article 20 GDPR),
- object to processing based on our legitimate interest, including to sales contact following Demo registration (Article 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the country of your habitual residence or place of work.
Send requests to [email protected]. We respond without undue delay and in any event within one month. Where necessary, we may ask you to confirm your identity.
With respect to data processed on behalf of Customers (section 4), you exercise your rights against the Customer, e.g. your employer. We assist the Customer in fulfilling them.
11. Security
We apply technical and organisational measures appropriate to the risk, in particular:
- each Customer has a separate instance with its own database,
- data transmission is encrypted (TLS),
- passwords are stored in the form of cryptographic hashes,
- QR login codes change at each login,
- we apply limits on login attempts and requests,
- permissions are role-based, and access by our personnel is limited to the necessary minimum,
- we keep a log of changes to data,
- we make backups, monitor errors and regularly update software.
Employees and associates of inProjects who have access to data are bound by confidentiality obligations.
12. Automated decision-making and profiling
We do not make decisions about anyone based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them (Article 22 GDPR), and we do not carry out profiling for marketing purposes.
WTMS automatically calculates, for example, working time, late arrivals or limit overruns. These are, however, calculations made available to the Customer. Any decisions based on them are made by the Customer.
WTMS is intended for businesses and is not directed at persons under the age of 16.
13. Changes to this policy
We update this policy when WTMS functions, the list of providers or the law change. We inform Customers of material changes by e-mail or in the Platform. This page always contains the current version with its effective date, and previous versions are available on request.