Our Commitment
Qrew is built with privacy by design. We comply with the EU General Data Protection Regulation (GDPR 2016/679) and the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018).
Data Controller
Arcanode di Alessandro Pasqualetti — trading as Qrew, registered office at Via Corte, Panicale — 55041 Camaiore (LU), Italia, VAT number IT02755170467 — is the data controller. Data-protection requests go to [email protected]. No DPO is appointed (Art. 37 GDPR does not require one for this business).
Lawful Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Time-tracking service delivery | Contract performance (Art. 6(1)(b)) |
| Payroll calculations | Contract performance + legal obligation |
| GPS geofencing | Legitimate interest — fraud prevention (Art. 6(1)(f)) |
| Photo verification | Consent (Art. 6(1)(a)) — tenant opt-in; workers upload photos at clock-in/out only |
| Push notifications | Consent (Art. 6(1)(a)) |
| Audit logging | Legitimate interest — compliance evidence |
| Server access & security logs (IP address, request metadata) | Legitimate interest — operating and securing the service and investigating abuse (Art. 6(1)(f)); legal obligation for the audit trail |
| Aggregate website traffic measurement (AWStats, from server logs) | Legitimate interest — service improvement (Art. 6(1)(f)). Runs server-side and cookieless: visitor addresses are hashed and only country-level geolocation is resolved locally. |
| Device fingerprinting | Legitimate interest — anti-spoofing (Art. 6(1)(f)). Signals collected: canvas hash, WebGL vendor/renderer, AudioContext fingerprint, screen resolution, timezone, hardware concurrency, installed fonts, browser plugins. No cookies are set for this purpose. The hash is used solely to verify that the clock-in originates from a known device and to assign a trust score; it is not used for profiling, advertising, or cross-site tracking. |
Data Subject Rights
You have the following rights under the GDPR:
- Access (Art. 15): Request a copy of your personal data.
- Rectification (Art. 16): Correct inaccurate data.
- Erasure (Art. 17): Request deletion (“right to be forgotten”).
- Restriction (Art. 18): Limit how we use your data.
- Portability (Art. 20): Receive your data in a machine-readable format.
- Object (Art. 21): Object to processing based on legitimate interest.
Submit requests to [email protected]. We respond within 30 days.
Data Retention
Operational personal data (profile, sessions, GPS coordinates, device fingerprints, photos) is retained for the duration of the worker's active employment plus 30 days. Payroll-relevant records are retained for 10 years as required by Italian employment law (Art. 2949 Codice Civile). Audit logs are retained for 10 years for tribunal-ready compliance. Other personal data is deleted within 30 days of account closure or upon the data subject's erasure request, whichever comes first.
International Transfers
All data is stored in EU data centres. Sub-processors and infrastructure:
- Stripe (payments) — maintains EU Standard Contractual Clauses for any sub-processing outside the EEA.
- WAHA / WhatsApp (messaging) — Meta Platforms Ireland Ltd. Data processed under Meta's EU Data Processing Addendum.
- Cloudflare (CDN and reverse proxy, security) — terminates TLS at its edge and filters abusive traffic in front of qrew.it, app.qrew.it and api.qrew.it.
- Contabo (hosting) — our VPS, application and database are located in Germany (EU); database files sit on encrypted-at-rest volumes.
- AWStats (traffic measurement) — free, open-source software we run on our own server. It is not a third-party recipient: it processes our access logs locally, sets no cookies and hashes visitor addresses.
Data Breach Notification
In the event of a personal data breach, we will notify the supervisory authority (Garante per la protezione dei dati personali) within 72 hours and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Records of Processing Activities
We maintain detailed records of all processing activities as required by Art. 30 GDPR. These records are available to the supervisory authority upon request.