Privacy

Privacy policy.

At Woblip we take the protection of your personal data seriously. This policy explains how we process the information you provide through woblip.com and the Woblip mobile app, in accordance with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).

Data controller

  • Company name: Grumpy Software SLU
  • Tax ID (CIF): B75756668
  • Registered address: Camino de Turriana 695, Reboria, 33697, Asturias, Spain
  • Contact email: hola@woblip.com
  • Data Protection Officer (DPO): Not designated as the cases in article 37 GDPR do not apply. For any privacy matter you can write to hola@woblip.com.

Purposes of processing and legal basis

We process your personal data for the following purposes and on the following legal bases:

  • Handle enquiries and information requests: reply to messages sent through the contact form or by email. Legal basis: consent (art. 6.1.a GDPR) and, where applicable, pre-contractual measures requested by the data subject (art. 6.1.b GDPR).
  • Manage demo requests and commercial processes: arrange demos, send quotes, proposals and follow up on commercial conversations related to Woblip. Legal basis: pre-contractual measures (art. 6.1.b GDPR).
  • Provide the Woblip service to companies and their workers: enable access to work accounts, clock-ins, shifts, absences, documents, notifications, kiosk mode and technical support. When Woblip processes data on behalf of a client company, that company acts as data controller and Grumpy Software SLU acts as processor under the applicable data processing agreement (art. 28 GDPR).
  • Record working time and operational evidence: keep clock-in records, schedules, incidents and data needed to comply with applicable employment obligations or to allow the client company to comply with them. Legal basis: compliance with legal obligations and performance of the relevant employment or contractual relationship.
  • Optional geolocation for clock-ins: when the company enables it and the user chooses to clock in without QR, the app may request precise location to verify the clock-in at the workplace. Legal basis: service provision, legitimate interest in preventing time fraud and compliance with employment obligations, as determined by the controller company.
  • Notifications and security: register device identifiers, notification tokens and technical information to send alerts, maintain sessions, prevent unauthorised access and ensure service availability.
  • Product analytics: measure aggregated use of the app and website to improve stability, performance and features. We do not use this data for behavioural advertising or share it with data brokers.
  • Manage the newsletter: store your email and send product updates, guides and Woblip-related content when you expressly subscribe. Legal basis: consent (art. 6.1.a GDPR).
  • Comply with legal obligations: retain accounting, tax or administrative documentation as required by applicable regulations. Legal basis: compliance with a legal obligation (art. 6.1.c GDPR).
  • Send electronic commercial communications: only when there is a prior client relationship regarding similar products or services (art. 21.2 LSSI), or when you have given express consent. Legal basis: legitimate interest (art. 6.1.f GDPR) or consent (art. 6.1.a GDPR), as the case may be. You may object or unsubscribe at any time.

Categories of data processed

Depending on the channel and purpose, we may process the following categories of data:

  • Identifying data: first and last name.
  • Contact data: email address and, where applicable, phone number.
  • Professional data: company, role and activity sector when you provide them.
  • Work account data: user identifier, role, assigned store or workplace, organisation, language preferences and account status.
  • Employment and operational data: shifts, schedules, clock-ins, absence or swap requests, documents linked to the employment relationship, statuses, approvals and incidents.
  • Location data: latitude, longitude, accuracy and associated workplace only when a feature requires location, such as clocking in without QR.
  • Technical identifiers: installation identifier, device identifiers, push notification tokens, IP address, device type, operating system, app version and session data.
  • Usage and diagnostic data: screens visited, interaction events, errors, performance and technical data needed to improve and protect the service.
  • Communication content: message, enquiry or information you voluntarily share.
  • Technical and browsing data: IP address, device type, browser and website usage data. See our cookie policy for more detail.

We do not request special categories of data to browse the website. In the app, the client company may configure absence or documentation flows where the user or organisation includes specially protected data, for example medical information linked to an absence. In those cases processing is carried out under the controller company’s instructions and with the safeguards required by GDPR. Please do not send sensitive information through general forms or contact email unless strictly necessary to handle your request.

Retention periods

  • Data provided through contact or demo request forms will be kept for the time needed to handle your request and, unless you object, for a maximum of 2 years for commercial follow-up.
  • Newsletter subscription data will be kept while your consent remains active or until you request unsubscribe or deletion.
  • Work accounts in the mobile app are managed by the client company or organisation. If a user stops using Woblip or requests account closure, access may be suspended or deactivated by the organisation.
  • Working time records, clock-ins and associated evidence are retained for 4 years where necessary to comply with Spanish working-time record obligations, or for the period required by the law applicable to the client.
  • Location data associated with a clock-in is retained only when it forms part of clock-in evidence or an employment obligation, applying the same retention and blocking criteria as the record to which it is linked.
  • Technical identifiers, notification tokens and session data are kept while needed to provide the service, maintain security or until the account or installation is no longer active.
  • If we enter into a contractual relationship, data will be kept while it is in force and afterwards for the periods legally required to address potential liabilities (commercial, tax, accounting, etc.).
  • Data processed on the basis of your consent will be kept until you withdraw it.

Once the applicable periods have elapsed, the data will be deleted or, where appropriate, duly blocked under article 32 LOPDGDD.

Recipients and international transfers

We do not share your data with third parties unless legally required. We do use providers acting as data processors on our behalf and under contract pursuant to article 28 GDPR, in categories such as:

  • Web hosting and cloud infrastructure.
  • Form and email reception and routing.
  • Productivity, CRM and commercial support tools.
  • Authentication, secure storage, push notification, product analytics, technical monitoring and maps/geolocation services needed to provide the app.

Some of these providers may be located outside the European Economic Area. In that case, international transfers are made under the safeguards in Chapter V of GDPR: European Commission adequacy decisions, Standard Contractual Clauses approved by the Commission and, where necessary, additional measures ensuring an equivalent level of protection. You can request more information about these safeguards by writing to hola@woblip.com.

User rights

As a data subject, the data protection regulations grant you the following rights, which you may exercise free of charge:

  • Access: know what data we are processing about you and obtain a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request the deletion of your data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
  • Objection: object to the processing of your data in the cases provided by law, in particular for marketing purposes.
  • Restriction: request that we limit processing in the cases set out in GDPR.
  • Portability: receive the data you provided in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.
  • Not to be subject to automated decisions with significant legal effects, except in the cases legally allowed.

To exercise these rights you can write to hola@woblip.com stating the right you wish to exercise and attaching, if necessary, a document proving your identity. If your request concerns a work account managed by your company, we may route or coordinate it with the controller organisation. Erasure will not affect data that must remain blocked due to a legal obligation, such as certain working-time records. We will respond within the legal deadlines.

Claim before the supervisory authority

If you believe that the processing of your data does not comply with the regulations, or that we have not properly handled the exercise of your rights, you can file a claim with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, through their electronic site at www.aepd.es.

Data security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR, including encryption in transit, access controls and periodic review procedures.

Changes to the privacy policy

We may update this policy to adapt it to legislative or judicial developments or changes in our practices. Any changes will be published on this same page, indicating the date of last update.