Privacy policy

Version 1.0 — TimeSheet application of Ma Societe.

1. Data controller

Ma Societe is the controller for the personal data processed in this application.

2. Purposes

• Recording and approval of working time per project;
• Tracking of activity, budgets and team output;
• Invoicing of services to clients and related supporting documents;
• Security of the service (authentication, access log).

3. Legal basis

Performance of the employment or service contract, compliance with legal and accounting obligations, and the legitimate interest of the organisation in managing its activity.

4. Data processed

• Professional identity : last name, first name, e-mail address, employee number, job title, company;
• Activity : hours entered per day and per project, task descriptions, timesheet status;
• Invoicing : hourly rates, invoiced amounts;
• Technical logs : sign-in dates, actions performed, IP address stored only as a one-way hash.

No advertising cookie or third-party analytics tool is used: only a technical session cookie and display preferences (theme, language) are stored.

5. Recipients

The data is accessible to authorised departments (accounting, application administration) and, for invoiced hours, to the clients concerned as invoicing back-up. Hosting takes place within the European Union.

6. Retention period

• Accounts and timesheets: 60 months after the end of the contractual relationship;
• Invoicing records: 10 years (accounting obligation);
• Access log: 60 months maximum;
• Uploaded Excel files: deleted automatically within 24 hours of processing.

7. Your rights

You have the right of access, rectification, erasure, restriction and portability. An export of your data is available at any time from your profile. You may lodge a complaint with your national data protection authority (in France, the CNIL: www.cnil.fr).

8. Security

Passwords stored as bcrypt hashes, forms protected by anti-CSRF tokens, sign-in attempts limited, access separated by role and sensitive actions logged.

Back