Legal — annex to the terms of use

Data Processing Agreement

Annex 1 to the AutoCheckIn terms of use

This translation is provided for information. In case of discrepancy, the Dutch version prevails.

This data processing agreement (hereinafter the «Agreement») sets out how Aziri BV, as processor, handles the personal data it processes on behalf of the customer through AutoCheckIn, and complies with Article 28 of the General Data Protection Regulation (GDPR).

Tip: when printing, choose «Save as PDF» to download this document as a PDF. A copy signed by us can be requested at autocheckin@aziri.eu.

Parties

• The processor: Aziri BV, Senator A. Jeurissenlaan 1154 bus 1, 3520 Zonhoven, Belgium, company number BE 0711.989.896, publisher of AutoCheckIn (hereinafter «Aziri»).
• The controller: the company that has created an AutoCheckIn account and uses the service for the attendance registration of its staff and subcontractors (hereinafter the «Customer»). The Customer's identification details are those provided at registration and visible in the dashboard.

This Agreement forms an integral part of the terms of use and takes effect when the Customer creates an account or uses the service. In the event of conflict between this Agreement and the terms of use, this Agreement prevails in respect of everything relating to the processing of personal data.

1. Subject matter, nature, purpose and duration

Aziri processes personal data solely to provide the AutoCheckIn service: registering, storing, displaying, exporting and declaring the attendance of persons on the Customer's construction sites, as further described in Annex A. The processing lasts for as long as the Customer uses the service, extended by the periods set out in Article 12.

The Customer determines the purpose and means of this processing and is the controller; Aziri acts as processor. For the Customer's own account and billing data, and for the security and improvement of its own service, Aziri is the controller — that processing falls outside the scope of this Agreement and is described in the privacy policy.

2. Processing on instructions only

Aziri processes the personal data only on documented instructions from the Customer. The terms of use, this Agreement and the normal use of the service (the actions the Customer performs in the dashboard or the app) constitute those instructions. Additional instructions are given in writing or by email.

Where Aziri processes data because Union law or Belgian law requires it to do so, it shall inform the Customer of that legal requirement beforehand, unless that law prohibits such information. Aziri shall inform the Customer if, in its opinion, an instruction infringes the GDPR.

Aziri never uses the Customer's data for its own purposes, does not sell it, does not use it for advertising and does not use it to train models.

3. Obligations of the Customer

• The Customer warrants that it has a valid legal basis to process (or have processed) the data — for site registration, as a rule the legal obligation regarding «Check In at Work» — and that it has properly informed its staff, including about the use of geofencing and the role of Aziri.
• The Customer enters only data that is necessary for attendance registration. Entering special categories of personal data (health, trade union membership, biometrics …) is not permitted; the service is not designed for this.
• The Customer itself manages who within its organisation is granted administrator rights and revokes them in good time.

4. Confidentiality

Aziri ensures that everyone who has access to the personal data — staff and third parties engaged — is bound by confidentiality and is granted access only insofar as necessary to provide the service or to resolve a support request. Access to a customer file by our administrators is targeted, temporary and logged.

5. Security

Aziri takes appropriate technical and organisational measures as referred to in Article 32 GDPR. The measures currently in force are set out in Annex B. Aziri may update those measures provided that the level of protection is not reduced as a result.

6. Sub-processors

The Customer grants Aziri general authorisation to engage sub-processors. The list of current sub-processors is set out in Annex C. Aziri imposes on each sub-processor, by contract, the same obligations as those that apply here, and remains fully liable to the Customer for their acts.

If Aziri wishes to add or replace a sub-processor, it shall notify the Customer by email at least thirty (30) days in advance. The Customer may object within that period on reasonable grounds relating to data protection. If the parties fail to reach agreement, the Customer may terminate the service free of charge for the remaining part of the paid period.

7. Assistance with data subject rights

The service enables the Customer to comply with most data subject requests itself, without Aziri's involvement: the dashboard offers, per employee, an export of all data (access and portability) and a deletion function, and data can be rectified there directly.

If a data subject contacts Aziri directly, Aziri does not respond to the request itself but refers the data subject to the Customer, and informs the Customer without undue delay. For anything the Customer cannot handle itself in the application, Aziri provides reasonable assistance.

8. Data breaches

Aziri notifies the Customer of a personal data breach without undue delay and in any event within 48 hours of becoming aware of it, with the information available to it at that time: the nature of the breach, the categories and numbers concerned, the likely consequences and the measures taken or proposed. Missing information is provided as soon as it becomes available. Notification to the Data Protection Authority and, where applicable, to the data subjects is made by the Customer.

9. Data protection impact assessment

Aziri provides the Customer with reasonable assistance with a data protection impact assessment (DPIA) and with any prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to Aziri. Annex B and the privacy policy serve as the starting point.

10. Inspection and audit

Upon request, Aziri makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR. The Customer may carry out (or have carried out) an audit at most once per calendar year — and additionally after each data breach — subject to at least thirty days' prior written notice, during office hours, without disrupting the provision of the service and with due regard for confidentiality towards other customers. The costs of the audit are borne by the Customer, unless the audit reveals a material failure on the part of Aziri.

11. Transfers outside the EEA

The personal data are stored within the European Economic Area. Insofar as a sub-processor processes data outside the EEA or may have access to it from there, this takes place on the basis of an adequacy decision or of the standard contractual clauses of the European Commission, supplemented by appropriate additional measures. Annex C states the location and the legal basis for each sub-processor.

12. Return and deletion upon termination

At the end of the provision of the service, the Customer may export its data itself via the dashboard for thirty (30) days. Thereafter, Aziri deletes the personal data, at the latest within ninety (90) days after the end of the agreement; backups are erased in accordance with the normal backup cycle.

There is one exception to this: data whose retention is required by Union law or Belgian law — in particular the statutory attendance registrations under Check In at Work and the billing data — are retained until the end of the statutory retention period. In that case, those data are restricted and processed only to comply with that legal obligation, after which they are deleted.

13. Liability

The liability of the parties under this Agreement is governed by the liability provisions in the terms of use, without prejudice to Article 82 GDPR and to liability that cannot be excluded or limited under mandatory law.

14. Duration, amendment and governing law

This Agreement applies for as long as Aziri processes personal data on behalf of the Customer. Aziri may amend the Agreement when the legislation, the service or the list of sub-processors changes; material changes are notified at least thirty days in advance. This Agreement is governed by Belgian law; disputes shall be submitted to the competent courts of the judicial district in which Aziri BV has its registered office.

Annex A — Description of the processing

Categories of data subjects: employees, temporary agency workers, self-employed persons and staff of subcontractors working on the Customer's construction sites; administrators and contact persons of the Customer.

Types of personal data:

• Identification data: name, phone number, email address if any.
• Social security identification number (INSZ/NISS) or national register number of workers, insofar as the Customer enters it — required for the statutory declaration.
• Attendance data: time of check-in and check-out, the site concerned, the method of registration (automatic, QR or manual) and the declaration number.
• Location data: solely the fact that a device enters or leaves a site zone. No GPS coordinates, routes or movements outside the site zones are stored.
• Technical data: device token for notifications, timestamps and error logs required for operation and security.

Nature and purpose of the processing: collection, recording, storage, consultation, export, disclosure to the competent public authority and erasure, for the purpose of the statutory attendance registration on site and its management by the Customer.

Duration: for as long as the agreement with the Customer is in force, extended by the periods set out in Article 12.

Annex B — Technical and organisational measures

• Encryption — all traffic runs over TLS/HTTPS; data in the database and the backups are stored in encrypted form. Sign-in tokens on the user's device are kept in the operating system's secure key storage (Keychain/Keystore).
• Strict separation per customer — the database enforces at row level (row-level security) that a user can only see data of their own company. The separation is built into the database itself, not only into the application.
• Access control — signing in is done with a one-time SMS code sent to the user's own mobile number; rights are role-based (worker, company administrator, service administrator). Internal access to production data is limited to those who need it.
• Data minimisation by design — the app records only discrete entry and exit events and keeps no location trail.
• Backup and recovery — daily automatic backups with point-in-time recovery, at the database provider within the EU.
• Monitoring — automatic monitoring of errors and of the scheduled background tasks, with notification to the administrator.
• Controlled changes — all code is under version control, is type-checked and is deployed via an automated pipeline, with the ability to roll back.
• Secrets — keys and tokens are never stored in the source code, but in the secure environment variables of the hosting platform.

Annex C — Sub-processors

The NSSO (and any other competent public authority to which the law requires a declaration to be made) is not a sub-processor but an independent controller: the declaration is made because the law requires it.

On the public website, Aziri uses, with the visitor's consent, measurement services from Google and Meta for its own marketing. In doing so, Aziri acts as controller; these services process no Customer data under this Agreement — no attendance or location data, and nothing from Annex A. Google and Meta are therefore not sub-processors; they are mentioned here solely for the sake of completeness (see also the cookie policy).

Acceptance

By creating an AutoCheckIn account or using the service, the Customer accepts this Agreement. Should the Customer wish to receive a signed copy or use its own model agreement, this can be arranged via autocheckin@aziri.eu or +32 11 46 00 44.