Privacy Notice

1. Who we are

LabourLedger is operated by CYCS. CYCS is the data controller for the personal data described in this notice. You can reach us at privacy@cycs.cy.

Where your company uses LabourLedger to record its own workers' hours, your company is the controller of that worker data and CYCS acts as processor on its instructions.

2. Personal data we collect and why

• Account data (name, email address, phone number, login credentials, company and role): to create and secure your account, manage company membership and invitations. Legal basis: performance of our contract with you.
• Worker and timesheet data (worker name, position, pay package, assigned projects, daily hours and overtime): to provide the labour tracking and payroll export features. Legal basis: performance of contract and our customer's legitimate interests as employer.
• Support messages: to answer your questions. Legal basis: legitimate interests in supporting customers.
• Usage and audit data (activity logs, actions on records, device identifiers, IP address, browser type): for security, fraud prevention, troubleshooting and improving the product. Legal basis: legitimate interests and legal obligation.
• Billing records (plan, quantities, invoices): to administer subscriptions and meet accounting obligations. Card details are handled by Paddle, not by CyCS. Legal basis: contract and legal obligation.
• Marketing preferences, where you opt in. Legal basis: consent, which you may withdraw at any time.

3. Who we share data with

• Service providers and subprocessors: cloud hosting and database, email delivery, error monitoring and analytics tooling.
• Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers such as legal and accounting firms, where necessary.
• Public authorities where we are legally required to disclose.

We do not sell personal data.

4. International transfers

Some of our providers process data outside the EEA/UK. Where that happens we rely on adequacy decisions or Standard Contractual Clauses with appropriate supplementary safeguards.

5. Retention

We keep account, project and timesheet data for as long as your company's account is active, and for up to 12 months after closure so data can be restored or exported. Billing and tax records are kept for the period required by law (typically 6–7 years). After these periods data is deleted or anonymised.

6. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email privacy@cycs.cy and we will respond within one month. You may also complain to your local supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level data isolation per company, role-based permissions that hide pay rates and costs from foremen, and audit logging of sensitive actions.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to hold your session and preferences, including the on-device demo data. We do not use advertising cookies. Any analytics cookies are only set where permitted, and you can clear or block cookies through your browser settings.

9. Changes

We may update this notice. Material changes will be announced in the app or by email before they take effect.