PRIVACY POLICY

The protection of privacy and personal data is a priority for SISQUAL® Workforce Management Lda, hereinafter referred to as “SISQUAL® WFM”. This policy pertains to the privacy practices within the scope of SISQUAL® WFM ‘s activities, specifically its Software as a Service (SaaS), Local Application, and Mobile Application platforms, including the portals, online sites, and other services managed by it.

This Privacy Policy describes how SISQUAL® WFM processes information that can be used directly or indirectly to identify an individual (“Personal Data”), collected through the use of its website and platform, by the applicable regulations and standards identified in this Privacy Policy (such as the GDPR).

Under the terms of this policy, SISQUAL® WFM defines the term “Client” as an entity with which SISQUAL® WFM maintains a formal relationship, the term “User” as any individual who responds to SISQUAL® WFM marketing campaigns or who is included as contact in the clients’ account, and the term “Visitor” as an individual who visits the front-end of our website (e.g. www.sisqualwfm.com or forecast.sisqualwfm.com).

Any information stored on SISQUAL® WFM’s platforms is treated as restricted. All information is stored securely and accessed only by authorised personnel. SISQUAL® WFM has implemented and maintains appropriate technical, security and organisational measures to protect Personal Data against unauthorised or unlawful processing and use and accidental loss, destruction, damage, theft or disclosure.

1. Data Protection Officer (DPO)

SISQUAL® WFM has appointed a Data Protection Officer (DPO), who can be contacted via this link or by emailing dpo@sisqual.com .

2. Privacy

SISQUAL® WFM respects your right to privacy. The data requested is intended for the provision of the service you have asked for, and no personal data will be collected that is not necessary for the provision of the service or without your consent.

SISQUAL® WFM offers a Software as a Service (SaaS), Local Application and Mobile Application platform.

The personal data you provide us with during your interaction with the various services will be processed with the guarantees of security and confidentiality required by the legal framework on the protection of personal data by the following terms.

3. As a Personal Data Controller

SISQUAL® WFM as data controller:

Ensures that the processing of your personal data is carried out exclusively for the purposes for which it was collected or for compatible and legitimate purposes;
It collects, uses and retains only the personal data that is strictly necessary for the fulfilment of the purpose in question, ensuring that collection is minimised;
It does not share or transmit personal data for commercial or advertising purposes without proper consent, except in cases where this is required by law;
It only processes personal data for legally prescribed purposes or to provide services requested by the user, always by the provisions of the GDPR.

4. As a Personal Data Processor

As a processor, SISQUAL® WFM undertakes to comply with the privacy and personal data processing agreements contracted with the entities responsible for data processing, that is, with the controllers.

In the context of providing our services and supplying software, SISQUAL® WFM acts as a processor of personal data. To this end, it is necessary to collect and process personal data to enter into contracts with our customers or to fulfil our contractual obligations. In addition, we may process such data based on our legitimate business interests, namely, to administer our platforms, provide access to interfaces and resources, and ensure the application of our usage policies and terms of service.

Where our clients need to collect, share and authorise us to process the personal data of their employees, SISQUAL® WFM will act according to their instructions. We rely on our clients to provide the necessary privacy notices and obtain the appropriate authorisations as required by the GDPR.

5. Technical and organisational measures

SISQUAL® WFM has implemented and continually improves technical and organisational measures in line with best practices and the requirements of international standards, ensuring that contractually agreed security requirements are met. We undertake to process personal data exclusively by our clients’ instructions while also ensuring compliance with applicable legal and regulatory obligations, including the GDPR.

In addition, SISQUAL® WFM is certified in the main international management standards, namely:

NP EN ISO 9001:2015 (Quality Management);
NP ISO/IEC 20000-1:2018 (IT Service Management);
NP ISO/IEC 27001:2022 (Information Security Management);
ISO/IEC 27018:2019 (Protection of personal data in the cloud);
NP ISO/IEC 27701:2019 (Information privacy management);
DNP TS 4577-1:2021 – Silver Level (Digital Security).

These certifications demonstrate our ongoing commitment to the security and protection of personal data, ensuring compliance with the highest industry standards.

6. Information we collect on our corporate website

In general, the SISQUAL® WFM’s website, accessible via the addresses www.sisqualwfm.com and forecast.sisqualwfm.com, can be visited without having to provide any directly identifiable personal data. However, we may collect indirectly identifiable information (pseudonymised) from visitors, such as their IP address, which will be used to monitor visits to our website for analytical or commercial purposes, helping to improve the user experience.

To grant access to protected areas or exclusive resources, we may ask for additional information, such as your full name, postal address and e-mail address, to respond to your requests for information, such as the distribution of white papers or participation in feedback surveys. In other situations, we may request information about the products you are interested in to send you only relevant content, such as articles, newsletters, product and service alerts, updates on new launches and invitations to events.

When we collect personal data, we ensure that the visitor is informed of the purpose of the collection and how this data will be used. It is important to emphasise that providing directly identifiable personal data is optional. In that case a visitor receives a confirmation e-mail or any communication from SISQUAL® WFM, clear instructions will be given on how to opt out of receiving further communications in the future.

Under the General Data Protection Regulation (GDPR), SISQUAL® WFM assumes responsibility for the personal data it collects and, where necessary, transfers internally or to third parties outside the European Economic Area. SISQUAL® WFM’s responsibility for this data is described in more detail below. In particular, by the GDPR, SISQUAL® WFM remains liable if it engages third parties to process personal data on its behalf and these processors do not comply with the provisions of the GDPR, unless SISQUAL® WFM can demonstrate that it was not responsible for the event that caused the damage.

7. Cookies and Similar Technologies

SISQUAL® WFM uses cookies and similar technologies to help us better understand the activity of visitors to our website. These cookies enable us to collect data about visits, including the number of visitors, pages visited, time spent on the site, approximate geolocation, and the navigation path (such as where visitors have come from).

If you do not want us to collect this information, you can disable cookies directly in your browser by following the instructions available here: https://cookies.insites.com/disable-cookies/.

Cookies are small data files that function as anonymous and unique identifiers, that are sent to your browser from the websites you visit and are stored in your device’s internal memory.

SISQUAL® WFM and its service providers or unaffiliated third parties may use cookies and other technologies, such as pixel tags, on our digital properties. These resources allow us to analyse trends, manage the site and monitor users’ movements on our pages.

Users can control the use of cookies directly through their browser settings. However, by disabling cookies, some functionalities or features of our website may be limited.

Our partners and service providers, such as Google and other marketing platforms, may also use cookies and pixels to help us monitor and optimise the effectiveness of content and advertising campaigns. These third parties are prohibited from using the data collected for any purposes unrelated to the services provided to SISQUAL® WFM.

8. Data Processing in Commercial Situations

SISQUAL® WFM adheres to specific practices and guidelines for the collection, processing, and use of personal data in commercial settings, such as events, meetings, and other similar interactions where the collection of personal data may occur. The processing of this data is carried out transparently, ethically and in full compliance with applicable data protection laws by the following principles:

Necessity and Data Minimisation: Personal data will be collected only when strictly necessary for the realisation of legitimate and relevant business purposes.
Transparency and Information: Individuals will be informed clearly and transparently about the purpose of collecting their data, as well as any relevant information related to its use for commercial purposes.
Free and Informed Consent: Consent to data processing will be voluntary, specific, informed and unequivocal. Individuals will have the right to withdraw their consent at any time without prejudice to the processing carried out based on the consent previously given.
Limited and Legitimate Use: Personal data collected for commercial purposes will be used exclusively for the specific purposes for which it was collected and will be processed in a compatible and legitimate manner.
Confidentiality and Sharing: Personal data will not be shared with third parties for commercial purposes without the prior and explicit consent of the individuals, except when such sharing is required by legal obligation.

9. Information we collect in our mobile applications

We collect, receive, and store your data to enable you to access the service and facilitate the use of its various functions and features. If you disagree with our Privacy Policy, please do not use the service or download the application.

Data collected

We collect the following personal data when you use our mobile applications:

Service Information: We collect data related to the services provided, including the time and duration of each specific service, as well as the location from which the services were accessed;
Account personalisation: Users have the option to personalise their account with additional information, such as a photo, telephone number, or other personal details. This data will be stored on the employer’s database server and can be integrated into the company’s (employer’s) internal systems;
Authentication data: We collect your username, employee number and password to validate your identity on your employer’s authentication server.

User responsibilities

The user undertakes to:

Do not substitute or impersonate another person, and SISQUAL® WFM reserves the right to block the user’s account in the event of suspicion of improper substitution, disclaiming any liability in such circumstances;
Keep your password secure and confidential, and be responsible for protecting it;
Do not share, reveal or transfer your password to another person.

Device Data Collection

We must collect information related to the device used, such as device identifiers, IMEI, hardware type and other software details, including the operating system version. This application is free and can be downloaded with no hidden fees.

Location

Location collection is an integral part of the service. When the user registers or performs a new clocking registration, the location is captured. This data will be stored exclusively with your consent and only on the employer’s database server.

For the application to capture and send your location (GPS coordinates and/or Wi-Fi SSID) to the employer’s server, the user must enable location access. This is necessary to clock in or clock out.

Consent and Responsibility

The user must agree to the points mentioned above, as they will be solely responsible for their authentication and the data they provide.

Sharing Personal Data

SISQUAL® WFM does not sell or rent your data to third parties for marketing purposes.

Distributor Privacy Policies

The app is available for download from the app stores (App Store, Google Play, Huawei AppGallery). The processing of personal data and the use of cookies or other monitoring devices are subject to the privacy policies and conditions of use of the distributors themselves.

10. Reasons to use data

I. Log Data

Please be advised that whenever you use our Service, in the event of an application error, we collect data and information from your device (via third-party products), known as Log Data. This data may include information such as the device’s Internet Protocol (IP) address, device name, operating system version, application settings while using the Service, time and date of access, as well as other statistics.

II. Security and Retention

SISQUAL® WFM is committed to guaranteeing the confidentiality, integrity, availability and ongoing resilience of our systems and services that process Personal Data. To this end, it adopts measures that are proportionate and appropriate to the best market practices and the specific needs of the company.

We implement comprehensive protection, including antivirus, anti-spam, spyware protection, intrusion detection systems, robust firewalls and real-time alerts.

III. Personal Data Archive

The personal data collected by SISQUAL® WFM will be kept for the period necessary for processing by the purpose for which it was collected.

The retention periods may be adjusted if the public interest, historical, scientific or statistical reasons so require, and appropriate security and conservation measures are adopted.

IV. Access and the Right to Privacy

If you are a client or potential client, you have additional rights under the terms of the GDPR and can access, correct or request the deletion of your Personal Data.

SISQUAL® WFM respects the rights of data subjects under articles 13 to 22 of the GDPR, including:

Right to be informed about processing activities and applicable rights;
Right of access to data (or to obtain data subject to processing);
Right to rectification of data (when out of date or incorrect);
Right to erasure of data (right to be forgotten);
Right to object to data processing (mainly when based on consent);
Right to restrict processing (when processing is considered unlawful);
Right to data portability (between systems, in a standard format);
Rights related to automated decision-making (including decisions based on profiling).

We allow you to access, rectify and delete your data at your request. If the processing of your data is based on consent, you have the right to withdraw it at any time without jeopardising the validity of the processing carried out up to that date.

Through our Data Protection Officer (link), you may request:

Information about your data;
Information on data processing;
Purpose of treatment;
Correcting or updating data;
Obtaining your data in an accessible format;
The deletion of data by applicable legislation.

SISQUAL® WFM has implemented operational processes to fulfil all requests for the rights of data subjects within 30 (thirty) days of receiving the request and may check specific fields of personal data to ensure correct identification.

If your business contact details change, or if you wish to modify, delete or exercise other rights, please get in touch with us via the link provided.

SISQUAL® WFM may disclose personal information in response to lawful requests from public authorities, including national security requirements, or to comply with legislation.

We value your trust and endeavour to protect your data using commercially acceptable means. However, we remind you that no method of transmission over the Internet or electronic storage is 100% secure and reliable, and we cannot guarantee total security.

SISQUAL® WFM cannot be held liable for any damages or losses arising from the use (correct or incorrect) of its Services or contents, including improper access to the user’s computer or computer system by third parties. The information disclosed should be considered for information purposes only.

11. International Data Transfers

All processing of Personal Data is carried out by privacy rights and regulations, following the Data Privacy Framework (DPF), GDPR and local legislation.

You have the right to know whether we hold information about you, and if we do, you can access that information and demand that it be deleted, limited or corrected if it is inaccurate. This right can be exercised by contacting us via the link.

In compliance with the GDPR, SISQUAL® WFM undertakes to resolve complaints relating to the collection or use of personal information.

12. Release of Liability

13. Notification of Changes

SISQUAL® WFM reserves the right to update or amend this Privacy Policy from time to time.

Changes will be published on this page, and if significant, a notice will be made available on the website or by other appropriate means.

14. Privacy in Cloud Services

SISQUAL® WFM undertakes to comply with the applicable data protection legislation, including the GDPR, as mentioned above, in addition to the contractual terms agreed with its cloud service customers. This service is provided under the Software as a Service (SaaS) model, in which the customer accesses and uses our WFM software in the cloud. Respecting the following principles,

Cooperation regarding the rights of data subjects in the cloud: Our WFM software (version 7 and later) includes functionalities that enable customers to efficiently exercise their rights to access, correct, and delete personal data. Request the document “GDPR SISQUAL® WFM” for more information.
Purpose of processing: We do not process any personal data stored by you or your end users in the WFM database for any purpose not included in the cloud service contract, unless you instruct us to do so. Nor do we use such personal data for marketing and advertising purposes.
Notification of data breaches: We will notify you of any request for disclosure of personal data by a competent authority, unless prohibited by law (e.g. in cases of ongoing investigations).
Return, transfer, and deletion: Upon termination of the contract, we guarantee the secure return of personal data to the customer and the deletion of data from all systems, including backups, whenever the customer no longer needs it.
User access management: The client is responsible for managing access to the system’s users and providing administrative rights to control or terminate access as needed.
Use of encryption: To enhance the protection of personal data, we utilise HTTPS encryption, and for databases, we employ AES256 encryption.
Backups: We guarantee backups and restoration of data stored in the cloud.

15. Audits

We conduct independent internal audits and are audited annually by an accredited certification body to ensure that our information security and privacy policies are in line with industry standards.

16. Awareness-raising, education and training

The entire SISQUAL® WFM team is trained in the consequences of breaching privacy and security rules, especially when processing personal data.

17. Applicable law and jurisdiction

These Terms and Conditions are governed by Portuguese law. The competent jurisdiction to resolve any disputes is the court of the Porto area, to the exclusion of any other.

18. Complaints to the Supervisory Authority

According to Article 14 of the General Data Protection Regulation (GDPR), individuals have the right to lodge complaints with the competent supervisory authority if they consider that the processing of their data violates the provisions of the GDPR.

19. Contact

If you have any questions about the processing of your data, please get in touch with us via this link.

PUBLIC INFORMATION – Privacy Policy – updated on 12/06/2025