Privacy Policy

This Privacy Policy describes how Safepiens, NIPT M21704029F, located at Rruga Ferit Xhajko, Tiranë, Albania ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use the Safepiens platform and website (the "Service"). We are committed to protecting your privacy and processing your data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") where applicable.

1. Data Controller

The data controller responsible for processing your personal data is:

• Name: Safepiens
• Address: Rruga Ferit Xhajko, Tiranë, Albania
• NIPT: M21704029F
• Email: [email protected]

For customers using the Service to manage employee data, the Customer acts as the data controller and Safepiens acts as the data processor.

2. Categories of Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Data you provide directly

• Account information: name, email address, password (hashed), company name.
• Contact information: email address submitted through our website forms.
• Communication data: messages and correspondence sent to us.

2.2 Data processed on behalf of Customers (as data processor)

• Employee records: names, personal details, employment information, organizational data.
• Attendance data: clock-in/out records, schedules, leave requests and, where the Customer turns it on, the location of clock-ins, clock-outs and check-ins, with their addresses.
• Work activity data: task tracking, project assignments, activity logs.
• Organizational data: department structures, reporting hierarchies, compensation details.
• AI assistant conversations: the questions managers ask the AI assistant, its answers and, for 30 days, the records it looked up to write them.

2.3 Data collected automatically

• Technical data: IP address, browser type and version, device information, operating system.
• Usage data: pages visited, features used, timestamps, referral sources.
• Cookie data: see our Cookie Policy for details.

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and under the following legal bases:

Purpose	Legal Basis (GDPR Art. 6)
Providing and operating the Service	Performance of contract (Art. 6(1)(b))
Account creation and authentication	Performance of contract (Art. 6(1)(b))
Processing employee data on behalf of Customers	Performance of contract (Art. 6(1)(b))
Responding to inquiries and support requests	Legitimate interest (Art. 6(1)(f))
Sending service updates and notifications	Legitimate interest (Art. 6(1)(f))
Analytics and service improvement	Legitimate interest (Art. 6(1)(f))
Marketing communications (newsletter)	Consent (Art. 6(1)(a))
Legal compliance and fraud prevention	Legal obligation (Art. 6(1)(c))

4. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with the following categories of recipients only when necessary:

• Hosting and infrastructure providers: to store and serve your data securely.
• Payments and billing (Merchant of Record): Paddle.com Market Limited acts as our Merchant of Record and processes all subscription payments, invoices, sales taxes, and refunds on our behalf. When you subscribe, Paddle collects your name, email, billing address, and payment method details directly through its secure checkout. Safepiens does not receive or store your full card number. See Paddle's privacy notice at paddle.com/legal/privacy.
• Analytics services: to understand usage patterns and improve the Service (e.g., Google Analytics).
• Advertising (Meta): only if you allow Marketing cookies on our website, the Meta Pixel sends Meta Platforms Ireland Limited the pages you visit, your IP address and browser details, so we can measure our ads on Facebook and Instagram.
• AI assistant provider: when a manager asks the AI assistant a question, the question and the Customer Data needed to answer it are sent to OpenAI, which writes the answer. Only data that the manager can already see in the Service is sent. Document files and their contents, GPS coordinates, home addresses, phone numbers, dates of birth and salaries are never sent, and email addresses only when the manager asks for them. OpenAI does not use this data to train its models.
• Email service providers: to send transactional and marketing communications.
• Legal and regulatory authorities: when required by law or to protect our rights.

All third-party processors are bound by data processing agreements and are required to implement appropriate security measures in accordance with applicable data protection laws.

4.1 Sub-processors

The following sub-processors may process personal data on our behalf:

Sub-processor	Purpose	Location
Paddle.com Market Limited	Merchant of Record: subscription billing, tax, and refunds	United Kingdom & United States
Google LLC (Analytics)	Anonymous website usage analytics	United States
OpenAI, L.L.C.	AI assistant: answering managers' questions	United States
Hosting provider	Application and data hosting	European Union

5. International Data Transfers

Your data may be processed in countries outside your country of residence. When transferring personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission (including the 2021 EU SCCs) — used for transfers to our payments provider Paddle, to Google Analytics and to our AI assistant provider OpenAI.
• Adequacy decisions by the European Commission (for example, the UK adequacy decision applicable to Paddle.com Market Limited).
• Other legally recognized transfer mechanisms.

Copies of the applicable SCCs and transfer impact assessments are available on request at [email protected].

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: retained for the duration of your account and up to 30 days after termination.
• Customer Data (employee records): retained for the duration of the Customer's subscription and up to 30 days after termination, unless the Customer requests earlier deletion.
• Contact form submissions: retained for up to 24 months.
• Analytics data: retained in aggregated form for up to 26 months.
• Legal compliance records: retained as required by applicable law.

After the retention period expires, data is securely deleted or anonymized.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, aligned with ISO 27001 principles, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and role-based permissions.
• Regular security assessments and monitoring.
• Secure password hashing (bcrypt).
• Multi-tenant data isolation ensuring each customer's data is logically separated.
• Regular backups and disaster recovery procedures.

While we take reasonable precautions, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your credentials confidential.

8. Your Rights

Under applicable data protection laws, including the GDPR, you have the following rights:

• Right of access (Art. 15): obtain confirmation of whether we process your data and request a copy.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data under certain conditions.
• Right to restrict processing (Art. 18): request limitation of processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent.
• Right to lodge a complaint: file a complaint with the relevant supervisory authority.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

For employees whose data is managed through the Service by their employer, please direct your data subject requests to your employer (the data controller), who will coordinate with us as needed.

9. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected data from a child, please contact us immediately so we can take appropriate action.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. The AI assistant only answers managers' questions with figures and records from the Service; it does not make or recommend decisions about individuals.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and indicating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: [email protected]
• Address: Rruga Ferit Xhajko, Tiranë, Albania
• NIPT: M21704029F