Privacy Policy

1. Two distinct roles: controller and processor

Totalis processes personal data in two different contexts, with a different role under Regulation (EU) 2016/679 (the GDPR) and, where you or your organisation are in the United Kingdom, the UK GDPR (the GDPR as it forms part of UK law under the Data Protection Act 2018):

• As controller: the data of the person who creates the account and of the contracting organisation (name, login email, billing details for the subscription contract).
• As processor: the data of the employees your organisation enters into Totalis (records, contracts, time entries, absences, documents). Your organisation is the controller of that data; Totalis processes it only on your instructions, in line with Article 28 GDPR/UK GDPR and the applicable data processing agreement.

If you are an employee whose data has been entered into Totalis by your employer, you should direct requests about that data to your employer directly, as the controller.

2. What data we process

• Account data: name, email, password (hashed), role, and organisation.
• Employee data (on behalf of your organisation): records, contracts, compensation, documents, reporting lines.
• Time and absence data: clock-ins, project assignment, holiday and leave.
• Invoicing data: quotes, invoices, clients, and numbering series.
• Technical data: IP address, access logs, and service usage, for security and support purposes.

3. Purpose and legal basis

• To provide the contracted service (performance of a contract, Art. 6(1)(b)).
• To comply with legal obligations, e.g. employment and tax law (Art. 6(1)(c)).
• Security, fraud prevention, and technical support (legitimate interest, Art. 6(1)(f)).
• Service communications (updates, incidents) where you have consented or where necessary for the service itself.

4. Retention

We retain data for as long as the account is active. After the contract ends, your organisation's data is deleted within 30 days, except where we are legally required to retain it for longer (for example, employment or tax rules requiring longer retention).

5. Who we share data with

We do not sell personal data. We share data only with providers we need to run the service (cloud hosting, transactional email, payment processing), subject to confidentiality and data processing agreements, and where the law requires it.

6. Security

We apply reasonable technical and organisational measures (encryption in transit, role-based access control, per-organisation data isolation) to protect personal data against unauthorised access, loss, or alteration.

7. Your rights

If you are the account holder or represent the contracting organisation, you can exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to legal@totalis.ltd. If you are in the United Kingdom, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO, ico.org.uk); if you are in the EU/EEA, you may complain to the Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) or your own local supervisory authority.

If you are an employee of an organisation using Totalis, direct these requests to your employer, unless they concern your own login account data.

8. International transfers

Totalis is operated from Spain (EU/EEA), so data from UK users flows to and from the EU/EEA, and vice versa. Both jurisdictions currently recognise each other's data protection framework through mutual adequacy decisions, so these transfers do not require additional safeguards. Where a subprocessor is located outside the UK and the EU/EEA, we ensure the transfer is protected by appropriate safeguards (for example, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, as applicable).

10. Changes to this policy

We may update this policy by notifying you by email or on the website. Continued use of the service constitutes acceptance of the version in force.