Privacy Policy

1. Introduction

This Privacy Policy describes how Sked Solve processes the personal data of users of the website, the web application, the mobile applications and the related services.

Sked Solve is a platform for managing the organisational activities of companies, associations and other bodies, including, depending on the features enabled, shift planning, availability, absences, requests, clock-in and clock-out, communications, hours management, certifications and documents.

Sked Solve's role in the processing depends on the specific activity carried out, as described below.

2. Data controller

For processing relating to the creation and management of the Sked Solve account, the commercial management of the service, platform security, support and the other purposes determined directly by Sked Solve, the data controller is:

Cristian Borelli
VAT number IT07566550484
Registered office: Via Pietro Francavilla 8a, 50142, Firenze, Italy
Email: support@skedsolve.com
PEC: cristian.borelli@pec.cloud

3. Data processed on behalf of organisations

When Sked Solve is used by a company, association or other body to manage its employees, collaborators or volunteers, the organisation determines the main purposes and means of processing their personal data.

In these cases:

• the organisation normally acts as data controller;
• Sked Solve processes the data on behalf of the organisation as data processor, following the instructions received and in accordance with Article 28 GDPR.

The relationship between Sked Solve and the organisation is also governed by a specific Data Processing Agreement.

For requests about data entered or managed by their organisation, data subjects may also contact the organisation directly.

4. Categories of personal data processed

Depending on the features used, Sked Solve may process:

Identification and contact data, such as first name, last name, email address, profile picture and information associated with the account.

Organisation-related data, such as the organisation the user belongs to, work location or service, role, job and permissions.

Scheduling data, such as shifts, working hours, availability, work preferences, shift swap requests and assignments.

Absence and request data, including absence types and any information entered by the user or the organisation.

Attendance data, such as date and time of entry and exit, the location associated with the clock-in, any anomalies and other information needed to manage attendance.

Certification, qualification and document data, such as certification type, issuing body, issue and expiry dates, verification status and any copy of the certificate or document.

Technical and security data, such as IP address, device and browser information, session tokens, access logs, application and diagnostic logs.

Notification data, including the technical identifiers needed to send push notifications.

Service usage data, used for security, support, analysis of how the service works and product improvement.

Advertising identifiers, only where the user has given the specific consent requested.

5. Source of the data

Data may be:

• provided directly by the user;
• entered by the organisation or its authorised users;
• generated while using the service;
• collected automatically from the device when needed for a requested feature;
• received from authentication services the user chooses to use.

Where data are not collected directly from the data subject, they may therefore come from the organisation the data subject belongs to.

6. Purposes and legal bases

Sked Solve processes personal data for the following purposes.

Providing and managing the service
Account creation, authentication, use of the features and management of the contractual relationship.
Legal basis: performance of a contract or pre-contractual measures.

Commercial and administrative management
Management of subscriptions, payments, invoicing and related obligations.
Legal basis: performance of a contract and legal obligations.

Security and abuse prevention
Account protection, prevention of unauthorised access, error analysis and protection of the platform.
Legal basis: Sked Solve's legitimate interest in the security of the service.

User support
Handling support requests and solving problems.
Legal basis: performance of a contract and legitimate interest in the proper management of the service.

Product analysis and improvement
Analysis of feature usage and service performance, using aggregated or pseudonymised information where possible.
Legal basis: legitimate interest, or consent where required by law.

Promotional communications and remarketing
Only where required by law and with the user's prior consent.
Legal basis: consent.

For data processed by Sked Solve on behalf of the organisation, the legal bases are determined by the organisation as controller.

7. Special categories of data

Some features may involve processing information that falls within the special categories of data under Article 9 GDPR.

This may happen, for example, when information about sickness, injury, medical fitness or documents containing health information is recorded.

When such information is handled as part of the organisation's activities, Sked Solve does not determine its purposes and processes it on behalf of the organisation as data processor.

The organisation is responsible for determining the applicable legal basis, limiting the data collected to what is necessary and authorising only the people who need access to it.

8. Geolocation and clock-in

When the organisation enables clock-in with location check, the app may request access to the device's location at the moment the user clocks in or out.

The location is used to check that the clock-in takes place at or near the expected work location.

Together with the clock-in, the app records the coordinates detected at that moment, the distance from the work location, the result of the check, the associated location or zone, the date and the time. These data are visible to the organisation's users authorised to manage attendance.

If the user does not grant access to the location, the clock-in is recorded without coordinates and flagged to the organisation as having no location.

Sked Solve does not use this feature to continuously monitor the user's movements: the location is not detected outside the clock-in or while the app is in the background.

9. Certifications and documents

Organisations may use Sked Solve to record their users' certifications, qualifications, certificates and their expiry dates.

The information may be entered directly by the data subject or by the organisation and may be verified by authorised users of the organisation.

Sked Solve provides the technical tools to manage this information but does not itself certify the legal validity of the uploaded certificates, nor does it replace the checks that are the responsibility of the organisation or the competent bodies.

10. Automatic shift generation

Sked Solve may use automated systems to produce scheduling proposals based on the information and constraints configured by the organisation, such as availability, coverage, roles, working hours and other organisational rules.

The generated schedules are proposals that authorised users of the organisation can review, change and publish.

Sked Solve does not itself take decisions about the data subject's employment or working relationship.

11. Processing methods and security

Data are processed electronically, with technical and organisational measures appropriate to the risk, including access control, protection of communications, permission management, logging of security events and backup and restore procedures.

Access to personal data is limited to users, authorised personnel and the providers who need it to deliver their services.

12. Providers and sub-processors

To provide the service, Sked Solve may use providers carrying out activities such as:

• hosting and IT infrastructure;
• data storage and backup;
• authentication;
• sending emails and notifications;
• payment management and electronic invoicing;
• automatic reading of uploaded documents, such as imported schedules, through artificial intelligence services;
• maps, addresses and geolocation;
• support and communications;
• technical monitoring and error management;
• analysis of service usage;
• advertising services, only where permitted.

These parties are appointed as processors or sub-processors where required by law.

The up-to-date list of the main sub-processors, with the countries where they process data, is available on request by writing to support@skedsolve.com.

13. International transfers

Some providers used by Sked Solve may process personal data outside the European Economic Area.

In such cases Sked Solve checks that an adequate mechanism under the GDPR is in place, such as an adequacy decision of the European Commission or the Standard Contractual Clauses adopted by the European Commission, together with any supplementary measures needed.

Information about the main providers and the countries where they process data is available in the list of sub-processors mentioned in section 12.

14. Data retention

Personal data are kept for the following periods or according to the following criteria:

• account data (profile, credentials, devices and sessions): for as long as the account exists. When users delete their account from the app, these data are deleted immediately;
• login sessions: expire after 7 days;
• organisation operational data (shifts, availability, absences, requests): for the duration of the relationship with the organisation and according to its instructions. If a user deletes their account while the organisation keeps using the service, these data remain with the organisation, unlinked from the account;
• documents and certifications: until the service ends for the organisation, unless retention obligations apply;
• clock-in data, including the coordinates detected at the time of clock-in: for the duration of the relationship with the organisation, unless deleted by the organisation itself and subject to any applicable obligations;
• platform activity log: 14 days;
• technical and security logs: 30 days;
• support requests: 3 years;
• administrative and tax records: for the periods required by law, normally ten years;
• data processed on the basis of consent: until consent is withdrawn;
• backups: progressively deleted according to the normal rotation cycle, within 30 days.

When an organisation deletes its account, the operational data, clock-in records and documents linked to it are deleted, except for what must be kept to meet legal obligations.

15. Cookies, analytics and similar technologies

The Sked Solve presentation website does not use profiling cookies. To count visits it uses a statistics tool that stores no cookies or other identifiers on the device and provides only aggregated data.

If visitors arrive from an advertising campaign, the campaign parameters in the page address, such as the click identifier, are passed on to the app at sign-up, so that the registration can be attributed to the campaign. The website does not store them on the device.

The web application and the mobile apps use technologies that are strictly necessary for the operation, authentication and security of the service, such as the session cookie.

To analyse how the service works and how features are used, the app also uses product analytics tools that record the main actions taken in the service and link them to the account. These data are not used for advertising purposes.

Advertising and remarketing tools are activated only after the user's consent, as described in section 16, and consent can be withdrawn at any time from the profile settings.

16. Advertising identifiers

The mobile apps may use the advertising identifier provided by the operating system only with the user's prior consent.

These identifiers may be used to measure the effectiveness of advertising campaigns and, where applicable, for remarketing.

Consent is optional, and not giving it does not limit the use of Sked Solve's main features.

Consent can be withdrawn at any time from the available settings.

The advertising identifier is not used to manage shifts, attendance or the organisation's activities and is not made available to the organisation.

17. Data subjects' rights

Where Sked Solve acts as data controller, data subjects may, where applicable:

• obtain confirmation that their data exist and access them;
• request the rectification of inaccurate data;
• request erasure;
• request restriction of processing;
• object to processing;
• obtain data portability;
• withdraw consent at any time where processing is based on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Where Sked Solve processes data on behalf of an organisation, requests may be sent directly to the organisation, which acts as controller.

Data subjects may also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of their country.

18. Changes to this Privacy Policy

Sked Solve may update this Privacy Policy to reflect regulatory, organisational or service changes.

The updated version is published on this page with the date of the last update.

Where changes are significant, they may also be communicated to users through the app or other appropriate channels.

19. Contact

For requests about this Privacy Policy or the processing of personal data:

Cristian Borelli
Email: support@skedsolve.com
PEC: cristian.borelli@pec.cloud
Registered office: Via Pietro Francavilla 8a, 50142, Firenze, Italy
VAT number: IT07566550484