Privacy in Novelink HR

This page explains what data the Novelink HR app processes when you use it as an employee: to clock in and out, see your shifts, request leave and receive documents. Above all, it explains what happens to your location when you clock in.

1. Who processes your data

The controller is your company, the employer that invited you to Novelink HR. Your company decides why and how the data is used, and gives you the employment privacy notice required by Article 13 GDPR.

Novelink is the processor (Article 28 GDPR): it provides the service and processes data only on behalf of your company and on its instructions. Novelink does not use your data for its own purposes, does not sell it and does not use it for advertising.

Novelink is the sole proprietorship of Federico La Rocca, via San Filippo Neri 36, 20851 Lissone (MB), Italy, VAT 14870570968. Privacy contact: help@novelink.ai.

2. Your location when you clock in

To clock in, you scan the QR code of a clock-in point with the app, for example the one at the venue entrance. Together with the code, the app sends your phone's location at that moment. It has one purpose only: checking that you really are near the clock-in point, so that nobody can clock in for a colleague using a photo of the QR code.

Here is how it works:

• Only when you clock in. The app asks for location permission "while using the app" and never asks for "always". It does not read your location in the background, during your shift, on breaks or outside working hours. If GPS does not respond in time, it uses the last position your phone recorded in the past 5 minutes.
• Your location is not saved. The server compares it with the clock-in point and then discards it. Neither your company nor Novelink can see where you were.
• What is saved: the point where you clocked in (for example "Main entrance"), the date and time of clock-in and clock-out, and the GPS accuracy in metres. The record also shows whether your phone reported a simulated location (the clock-in is accepted but flagged to HR) and whether you clocked in without a connection and the record was sent later.
• You can see it on your phone. When the app uses your location, your phone shows the location icon.
• You can revoke the permission at any time in your phone settings. Without it you cannot clock in from the app: your company must then offer you another way to record attendance, for example entry by the HR office.

If you are too far from the clock-in point, the app tells you how many metres away you are. That figure is used only to show you the message and is not saved.

3. Other data processed

• Profile: name, email, phone, language, office or site, role.
• Work: assigned shifts, clock-ins, any corrections made by HR (with author, date and reason), leave, permission and shift-swap requests and their outcome.
• Documents: payslips and other documents your company uploads for you, forms you fill in, attachments you send, for example with a request.
• Communications: messages and notices from the company, reports you send and the replies, rewards.
• Technical data: the code used to send notifications to your phone and your login data, that is your password, which is stored encrypted. If the app crashes, a technical error report is sent. It contains an internal code that identifies the account, but not your name, email or IP address.

4. Why it is processed

On behalf of your company, to manage your employment: recording attendance, planning shifts, handling leave, delivering documents and communications. Your company states the legal bases and retention periods in its own notice. Usually these are the performance of the employment contract and legal obligations, such as attendance records required by Italian employment law.

Novelink HR is not a tool for monitoring how you work: it does not track your movements and does not record anything from your phone beyond what is described here. It does not access contacts, photos, messages or browsing. The camera is used only to read the QR code, and a file is read only when you choose it as an attachment.

5. Artificial intelligence

Two features use an artificial intelligence service (Anthropic):

• Shift drafts. When HR requests one, the service receives the names of the office's employees, existing shifts and approved days of absence, without the reason for the absence. A person must always review and confirm the draft.
• Automatic translation. Request notes and reports are translated when you and HR use different languages.

No decision about you is taken automatically by artificial intelligence.

6. Where the data is and who helps Novelink

Data is stored on servers in the European Union: the Novelink HR server and database are in the Netherlands. Novelink uses these providers, each bound by a data processing agreement:

• Railway: server and database.
• Vercel: the web console used by HR.
• Cloudflare: document storage, such as payslips.
• Resend: sending emails, such as invitations and password recovery.
• Expo: sending notifications to your phone.
• Anthropic: the artificial intelligence features described above.
• Sentry: technical error reports from the app.

Some of these providers are based in the United States. When data leaves the European Economic Area, the transfer relies on the safeguards provided by the GDPR: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. How long

Your company decides retention periods, in line with the law. For example, attendance records must be kept for the number of years required by employment law. When your company stops using Novelink HR, Novelink returns or deletes the data according to its instructions.

8. Your rights

You can ask to access, correct or delete your data, or to restrict its processing. You can also object to processing and ask for your data in a format you can take elsewhere (Articles 15-22 GDPR).

Send your request to your company, which is the controller. If you write to Novelink (help@novelink.ai), we forward the request to your company and help it reply.

If you believe your data is not processed correctly, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live or work.

9. Changes

If the way the app processes data changes, especially your location, we update this page and the date at the top before the change takes effect.