Privacy Policy

HygiControle is operated by OOPLab. For privacy-related questions, contact us at contact@ckhygiene.cloud.

When you use HygiControle as an employee or contractor of a food business, your employer (or the organization that invited you) generally acts as the data controller for operational records created in the app. We process that information on their behalf to provide the Services.

The data we collect depends on how your organization uses HygiControle and which features you access. This may include:

• Account information: name, email address, role, branch assignment, and authentication credentials.
• Attendance records: clock-in and clock-out timestamps. When your organization enables face verification, a punch photo and a face-match score may also be stored. Approximate GPS location is checked against the branch geofence at the time of the punch and is not stored with the attendance record.
• Operational and compliance records: photos, notes, temperatures, checklist answers, supplier and product details, barcode scans, certificates, audit findings, and related metadata submitted through app modules.
• Device and technical data: app version, device type, connection status, crash and error diagnostics (via Firebase Crashlytics on supported mobile builds), and limited logs needed to secure and maintain the Services.
• Website preferences: language choice stored in a cookie or local storage on ckhygiene.cloud.

We use personal information to operate, secure, and improve the Services, including to authenticate users, record hygiene and operations workflows, generate audit-ready records, sync data with your organization’s backend, troubleshoot issues, and comply with applicable law.

Face photos used for attendance verification (when enabled by your organization) are processed only to confirm identity at clock-in/out and to support your organization’s timekeeping controls.

We do not sell your personal information.

Where the GDPR or UK GDPR applies, we rely on one or more of the following: performance of a contract (providing the Services to your organization), legitimate interests (security, fraud prevention, service improvement), compliance with legal obligations, and consent where required (for example, certain device permissions). Biometric-related processing for attendance face verification is performed only when your organization enables that optional feature and remains your employer’s responsibility as controller. Your employer may have additional legal bases for workplace processing.

The mobile app may request access to your camera, photo library, location, local network (for label printing), notifications, and storage. You can manage many permissions in your device settings. Some features will not work without the permissions your organization requires for compliance workflows. Location is used for attendance geofencing when you clock in or out; camera access is required only when face verification is enabled for your organization.

We may share information with:

• Your organization and authorized administrators who manage your account.
• Infrastructure and service providers that help us host, secure, and maintain the Services (for example, cloud hosting, object storage, and—when face verification is enabled—facial comparison processing).
• Authorities or other parties when required by law or to protect rights, safety, and security.

We retain information for as long as needed to provide the Services, meet contractual and legal requirements, and resolve disputes. Retention periods for operational records are primarily determined by your organization’s policies and applicable food-safety or employment regulations.

Attendance punch photos (when face verification is used) are automatically deleted after a limited retention period configured for the platform (by default 90 days), while the underlying clock timestamps may be kept longer for payroll and compliance needs defined by your organization.

We use technical and organizational measures designed to protect personal information, including encrypted transport (HTTPS), access controls, and secure credential storage on supported devices. No method of transmission or storage is completely secure.

Your information may be processed in countries other than where you live, including where our servers or service providers operate. Where required, we use appropriate safeguards for cross-border transfers.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, and to data portability or withdrawal of consent where processing is consent-based.

Because workplace data is often controlled by your employer, please contact your organization first for requests related to operational records. You may also contact us at contact@ckhygiene.cloud and we will assist or redirect your request as appropriate.

The Services are intended for professional food-business use and are not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the revised version at https://ckhygiene.cloud/privacy and update the “Last updated” date above. Continued use of the Services after changes take effect constitutes acceptance of the updated policy where permitted by law.