Privacy policy

This is an informative translation. The legally binding text is the Spanish version.

Last updated: August 2026 · Contact: paconavarro.fsn@gmail.com

1. Who processes the data

Francisco Navarro Hernández (“SignaPlan”) processes personal data:

• As controller for the commercial website, account signup and the contractual relationship with the customer company (administrator contact data, billing where applicable).
• As processor for worker and collaborator data that each customer company enters in its isolated workspace (planning, leave, clock-ins, vehicles, etc.). See the data processing addendum.

2. What data we process

• Account data: company name, subdomain, administrator email and password.
• Worker data provided by the customer: identification (name, ID number when supplied), role, site assignments, leave, working-time records, clock-in PIN (stored irreversibly/hashed) and, if the customer enables it, geolocation tied to the clock-in.
• Technical data: IP address, access logs and essential session and security cookies.

3. Purposes and legal basis

• Providing the SaaS (performance of the contract / pre-contractual steps).
• Service security (legitimate interest: preventing abuse and improper access).
• Complying with legal obligations (e.g. tax or replies to authorities).
• Support communications related to the account.

Geolocation at clock-in is only used if the customer enables it in their settings and under their own legal basis towards their workers.

4. Retention

Account data are kept while the relationship is active and afterwards for the legal billing and civil-liability periods. Working-time records and related events are kept under applicable labour rules (indicatively up to four years for the working-time record) and the customer’s instructions, unless a longer legal duty applies.

5. Recipients and processors

Hosting, database, email and, where applicable, payment providers may intervene under contract with equivalent duties. Data are not sold to third parties for commercial purposes. If the customer connects an ERP (e.g. Odoo), processing in that system remains the customer’s responsibility.

6. International transfers

We prefer infrastructure in the European Economic Area. If a provider ever processes data outside the EEA, GDPR safeguards will apply (standard clauses or other adequate measures).

7. Rights

You may request access, rectification, erasure, restriction, portability and objection, and withdraw consent where the basis is consent, by writing to paconavarro.fsn@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

If your company entered your data in SignaPlan, in many cases you should first exercise your rights with that company (controller). SignaPlan will assist as processor.

8. Minors

The service is aimed at companies. It is not intended for signup by people under 18.