1. Who is controller and who is processor
We are controllers of the data of those who subscribe to the Platform: account registration, billing, access records and support.
We are processors of the data you enter into the Platform to run your business: your team members, the clients you register, the time entries, rates and costs. For that data, you are the controller.
In practice, that means data subject requests relating to your business's data should be directed to you. If they reach us, we forward them and provide the necessary support.
2. What we do as processors
We process data only in line with your instructions and as needed to deliver the contracted service.
We keep each account's data isolated from other accounts, by system design rather than by configuration.
We do not use our customers' time entry data to train artificial intelligence models and we do not sell it.
3. Your rights as a data subject
Confirmation that we process your data, and access to it.
Correction of incomplete, inaccurate or outdated data.
Anonymisation, blocking or deletion of unnecessary data or data processed unlawfully.
Portability of the data to another provider, upon express request.
Information about who we share your data with.
Withdrawal of consent, where that is the legal basis used.
To exercise any of these, write to privacidade@wisedatatime.com.
4. Account and data deletion
Account deletion can be requested from within the Platform itself.
Removal is comprehensive: it reaches records created during use, not just the main registration. Deletion respects the applicable statutory retention periods, in particular tax periods and the access-log period set out in Brazil's Internet Civil Framework.
Before permanent deletion there is a window to export your content, stated at the time of the request.
5. Security and access to business-sensitive data
Encrypted traffic, passwords stored with a key derivation algorithm, two-factor authentication available and logging of security events.
Hourly cost — which in practice is salary in the open — has its own permission, separate from the others. Those without it don't receive the figure on screen, in reports or in exports.
Every change to a cost is recorded, identifying who made it.
6. Security incidents
If an incident occurs posing relevant risk to data subjects, we will notify those affected and Brazil's National Data Protection Authority within the timeframes and in the manner required by the LGPD, describing what happened, the data involved and the measures taken.
7. Contact channel
privacidade@wisedatatime.com — data subject requests and data protection matters.
We may ask for additional information to confirm your identity before acting, which is a protection for you.