Processing roles
Christian Arragoni
Registered office: Via Nerone, 8a - 00012 Guidonia (RM), Italy
VAT Number: IT18674331006
Email: info@opshub.it
For workforce and operational data entered by a customer, that customer normally acts as the data controller and Christian Arragoni normally acts as a data processor under the applicable agreement. Christian Arragoni acts as controller for data needed to manage its own accounts, service security, website and commercial relationships. Final roles must be stated in each customer contract.
Personal Data Processed
The HUB2GO application collects and processes the following categories of personal data:
- Identification data: First name, last name, company user ID, username, company email
- Authentication data: Password (stored in encrypted form with bcrypt hash), session tokens
- Geolocation data: GPS coordinates at the time of clock-in/clock-out, exclusively for the purpose of verifying presence at the workplace
- Work activity data: Time tracking, leave/permission/sick leave requests, material and meter assignments, pallet movements
- Company vehicle data: Fuel refill records, mileage, receipt photos
- Technical data: Push notification tokens (Expo Push Token), device information for proper app functionality
- Images: Photos of fuel refill receipts
Purposes of Processing
Personal data is processed for the following purposes:
- Attendance management: Recording clock-in and clock-out times with geographic location verification
- HR management: Processing requests for vacation, leave, sick days, and other absences
- Operational management: Tracking assignments of materials, meters, and pallets to technicians
- Fleet management: Monitoring refueling, consumption, and mileage of company vehicles
- Operational communications: Sending push notifications related to work activities (approvals, reminders, notices)
- Security: User authentication and protection of access to company data
Legal basis: the customer acting as controller determines the appropriate basis for each purpose, such as a legal obligation, performance of the relationship or a properly assessed legitimate interest. Consent is not the default basis for mandatory employment activities.
Data Retention
Exact periods are set by the controller's approved retention schedule according to purpose, legal duties and the need to establish or defend legal claims. In particular:
- Employment and attendance data: for the customer-approved period required by applicable rules;
- Tax and accounting data: for the period required by applicable law;
- Authentication data: while the account is needed, with prompt deactivation on termination;
- Logs and optional analytics: for the shortest approved period, using pseudonymisation and automated deletion;
- Privacy requests and breaches: for evidence of compliance and incident handling.
Automated retention runs only for formally approved rules and stops when a legal hold or dispute requires preservation.
Data Sharing and Transfer
Personal data may be shared with:
- Technical service providers:
- Expo (Expo.dev) - for sending push notifications
- Apple Inc. - for App Store distribution and push services (APNs)
- Google LLC - for Google Play Store distribution and Firebase services (if used)
- Cloudflare Inc. - for web traffic protection and distribution
- Employer company: Data is accessible to authorized administrators of the client company (tenant) for personnel management purposes
Extra-EU transfers: Some technical providers (Apple, Google, Cloudflare, Expo) may transfer data to the United States. Such transfers are made on the basis of Standard Contractual Clauses approved by the European Commission or the EU-US Data Privacy Framework.
Data is not sold to third parties or used for marketing purposes.
Data Security
We adopt appropriate technical and organizational measures to protect personal data:
- Password encryption with bcrypt algorithm
- Secure connections via HTTPS/TLS protocol
- Authentication via JWT tokens with expiration
- Data access limited to authorized personnel
- Regular database backups
- Monitoring of access and suspicious activities
Data Subject Rights
In accordance with Regulation (EU) 2016/679 (GDPR), the user has the right to:
- Access: Obtain confirmation of processing and a copy of their data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of data (within the limits of legal obligations)
- Restriction: Restrict processing in certain cases
- Portability: Receive their data in a structured format
- Objection: Object to processing for legitimate reasons
To exercise these rights, contact: info@opshub.it
The user also has the right to lodge a complaint with the Italian Data Protection Authority (official website: www.garanteprivacy.it).
Application Permissions
The HUB2GO app requires the following device permissions:
- Location (GPS): To record location at the time of clock-in/out. Location access occurs only at the time of clocking and not in the background.
- Camera: To take photos of refueling receipts and for QR code/barcode scanning
- Push notifications: To receive operational communications from the company
- Internet access: For data synchronization with the server
All permissions can be revoked from device settings, but some app features may not be available.
Contact
For any questions regarding this Privacy Policy or the processing of personal data:
Email: info@opshub.it
Support email: info@opshub.it
Website: OpsHub website (opshub.it)
Last updated: October 13, 2026