Privacy Policy and Personal Data Protection

1. Introduction

This Privacy Policy and Personal Data Protection Policy (hereinafter: the "Privacy Policy") explains how personal data is collected, used, processed and protected within the Atendo software platform, including the web application and the mobile application.

The Atendo platform is provided by Nik-Com, Company ID: 60422664, Episkopa Visariona 5, 21000 Novi Sad, Republic of Serbia ("Nik-Com", "Atendo", "we", "our").

This Privacy Policy applies to all users of the Atendo platform, including employees, associates, and administrative or authorized users of organizations that use the Atendo system.

2. Roles in data processing (important note)

In most cases the following applies:

• Customer — a legal entity, entrepreneur or other business subject that uses the Atendo platform under a valid subscription and that, with respect to the personal data it processes through the platform, generally acts as the data controller.
• End user — an individual to whom the Customer has granted access to the platform.
• Nik-Com — the data processor, which processes data exclusively on the Customer's documented instructions as controller.

With respect to the personal data the Customer processes through the platform, the Customer generally acts as the data controller and Nik-Com as the processor.

Nik-Com does not independently decide the purpose or means of processing employees' personal data; it processes data solely in accordance with the instructions of the organization using the Atendo system.

For questions concerning the processing of their data, employees and end users should primarily contact their employer as the data controller.

3. What personal data we process

Depending on the platform settings defined by the Customer, Atendo may process the following categories of personal data:

• first and last name
• business email and contact details
• job position, department and organizational affiliation
• attendance and working time records
• data on shifts, breaks and work schedules
• location data, only if activated by the user
• device identifiers and technical logs
• other data entered into the system by the Customer or end user

Nik-Com does not collect data that is not necessary for the Atendo platform to function.

4. Data collected via the mobile application and device permissions

For the mobile application to function properly, Atendo may use the following device features and permissions, exclusively for clearly defined purposes:

4.1 Location (GPS)

Location data is used exclusively in connection with attendance recording and verification of field activities, in accordance with the settings defined by the Customer.

Location data is collected at the moment of clock-in and clock-out to verify presence at the approved location. Additionally, during an active work session (i.e. while the user is clocked in), location data may be used to verify whether the user is within a predefined zone (geofence).

The application does not continuously track location outside an active work session. Location data is not collected when the user is not clocked in and is not used for background tracking unrelated to time and attendance recording.

Location data is not used for marketing, analytics or commercial purposes.

Use of location services and geofence functionality depends exclusively on the settings defined by the Customer.

4.2 Bluetooth (BLE) and NFC

Bluetooth Low Energy (BLE) and NFC technologies are used exclusively to:

• identify proximity to authorized locations or devices
• verify employee attendance

Atendo does not use Bluetooth or NFC to track users, map movement, or collect data outside the purpose of attendance recording.

4.3 Camera (QR code)

The device camera is used exclusively to scan QR codes for clocking in and out.

Atendo:

• does not take photographs
• does not store images or video recordings
• does not use the camera for any other purpose

5. Purposes of data processing

Personal data is processed exclusively for the following purposes:

• recording employees' working time and attendance
• managing shifts and work schedules
• tracking field activities
• technical operation and security of the system
• customer support and platform maintenance
• fulfilling the controller's legal obligations

Data is not used for marketing, user profiling, or automated decision-making.

For business customers using the Atendo system to manage employee working time and attendance, the processing of personal data is additionally governed by a Data Processing Agreement (DPA) between Nik-Com, as processor, and the Customer, as controller.

6. Legal basis for processing

The legal basis for processing personal data is determined by the Customer as controller, and may include:

• fulfilment of legal obligations under labor law
• performance of an employment contract
• the Customer's legitimate interest
• the employee's consent (where applicable)

Nik-Com processes data exclusively within the stated legal bases.

7. Who may receive the data

Personal data may be made available to:

• authorized persons at the Customer
• Nik-Com's technical staff, to the necessary extent
• authorized distributors and partners involved in implementation, configuration and customer support for a specific business customer, exclusively to the necessary extent and subject to appropriate contractual data-protection obligations
• sub-processors (e.g. hosting and cloud providers), subject to appropriate contractual data-protection obligations

Data is not sold or shared with third parties for marketing purposes.

8. International data transfer

Where data is processed or stored outside the Republic of Serbia or the European Union, appropriate safeguards are applied in accordance with applicable regulations, including standard contractual clauses.

9. Data security

Nik-Com applies appropriate technical and organizational security measures, including:

• access control
• data encryption
• logging of security events
• regular system maintenance and monitoring

System security is continuously improved in line with best practice.

10. Data retention

Personal data is retained for as long as necessary to achieve the purpose of processing, in accordance with the Customer's instructions and applicable regulations.

Upon termination of platform use, data is deleted or returned to the controller, unless there is a legal obligation to retain it.

11. Rights of data subjects

In accordance with applicable regulations, users have the right to:

• access their data
• correct inaccurate data
• erasure of data (where applicable)
• restriction of processing
• data portability
• object to processing

Requests should primarily be addressed to the employer as data controller.

11.1 Exercising your rights

As a data subject, you have the following rights under applicable personal data protection regulations:

• the right to request access to your personal data and information about its processing
• the right to request correction of inaccurate or incomplete data
• the right to request erasure of personal data, where the legal conditions for this are met
• the right to request restriction of the processing of your personal data
• the right to data portability, i.e. to receive the data you provided in a structured, commonly used, machine-readable format, and to transmit that data to another controller
• the right to object to the processing of personal data, in accordance with applicable regulations

Requests to exercise the above rights should primarily be addressed to the employer or the organization using the Atendo system, as data controller.

Where necessary, you may also contact Nik-Com as data processor using the contact details given in this Privacy Policy.

Requests to exercise these rights will be answered without undue delay, and no later than the deadline prescribed by applicable personal data protection regulations.

11.2 Right to object and to withdraw consent

Where processing of personal data is based on the controller's legitimate interest, you have the right to object at any time to such processing, on grounds relating to your particular situation.

You also have the right to object to the processing of your personal data for direct marketing purposes, where such processing applies.

Where the legal basis for processing is your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

11.3 Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data has been carried out contrary to applicable regulations, you have the right to lodge a complaint with the competent supervisory authority for personal data protection, in accordance with the regulations of the country of your residence, place of work, or the place where the alleged infringement occurred.

Additional information on the rights of data subjects is available in Articles 12–23 of the General Data Protection Regulation (GDPR).

12. Changes to this Privacy Policy

Nik-Com reserves the right to amend this Privacy Policy in the event of legal, technical or organizational changes.

Users will be notified of material changes via the platform or the official website.

13. Contact

For questions regarding this Privacy Policy or the processing of personal data, you may contact us:

Nik-Com
Email: [email protected]
Address: Episkopa Visariona 5, 21000 Novi Sad, Republic of Serbia