Data Controller
Callgas S.r.l.s.
Registered office: Via Nerone, 8a - 00012 Guidonia (RM), Italy
VAT Number: IT15564641007
Email: info@callgas.it
Certified Email (PEC): callgas@legalmail.it
The Data Controller is responsible for the collection and processing of personal data of users of the OpsHub platform and the HUB2GO mobile application.
Personal Data Processed
The HUB2GO application collects and processes the following categories of personal data:
- Identification data: First name, last name, company user ID, username, company email
- Authentication data: Password (stored in encrypted form with bcrypt hash), session tokens
- Geolocation data: GPS coordinates at the time of clock-in/clock-out, exclusively for the purpose of verifying presence at the workplace
- Work activity data: Time tracking, leave/permission/sick leave requests, material and meter assignments, pallet movements
- Company vehicle data: Fuel refill records, mileage, receipt photos
- Technical data: Push notification tokens (Expo Push Token), device information for proper app functionality
- Images: Photos of fuel refill receipts
Purposes of Processing
Personal data is processed for the following purposes:
- Attendance management: Recording clock-in and clock-out times with geographic location verification
- HR management: Processing requests for vacation, leave, sick days, and other absences
- Operational management: Tracking assignments of materials, meters, and pallets to technicians
- Fleet management: Monitoring refueling, consumption, and mileage of company vehicles
- Operational communications: Sending push notifications related to work activities (approvals, reminders, notices)
- Security: User authentication and protection of access to company data
Legal basis: Processing is necessary for the performance of the employment contract (Art. 6.1.b GDPR) and for the pursuit of the legitimate interest of the employer in the efficient management of business operations (Art. 6.1.f GDPR).
Data Retention
Personal data is retained for the following periods:
- Time tracking data: 5 years from recording, as required by labor regulations
- Leave requests: 5 years from the request
- Refueling data: 10 years for tax and accounting obligations
- Material and pallet movements: 5 years from recording
- Authentication data: For the duration of the employment relationship, deleted within 30 days of termination
- System logs: 12 months
At the end of the retention periods, data is deleted or irreversibly anonymized.
Data Sharing and Transfer
Personal data may be shared with:
- Technical service providers:
- Expo (Expo.dev) - for sending push notifications
- Apple Inc. - for App Store distribution and push services (APNs)
- Google LLC - for Google Play Store distribution and Firebase services (if used)
- Cloudflare Inc. - for web traffic protection and distribution
- Employer company: Data is accessible to authorized administrators of the client company (tenant) for personnel management purposes
Extra-EU transfers: Some technical providers (Apple, Google, Cloudflare, Expo) may transfer data to the United States. Such transfers are made on the basis of Standard Contractual Clauses approved by the European Commission or the EU-US Data Privacy Framework.
Data is not sold to third parties or used for marketing purposes.
Data Security
We adopt appropriate technical and organizational measures to protect personal data:
- Password encryption with bcrypt algorithm
- Secure connections via HTTPS/TLS protocol
- Authentication via JWT tokens with expiration
- Data access limited to authorized personnel
- Regular database backups
- Monitoring of access and suspicious activities
Data Subject Rights
In accordance with Regulation (EU) 2016/679 (GDPR), the user has the right to:
- Access: Obtain confirmation of processing and a copy of their data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of data (within the limits of legal obligations)
- Restriction: Restrict processing in certain cases
- Portability: Receive their data in a structured format
- Objection: Object to processing for legitimate reasons
To exercise these rights, contact: info@callgas.it
The user also has the right to lodge a complaint with the Italian Data Protection Authority (official website: www.garanteprivacy.it).
Application Permissions
The HUB2GO app requires the following device permissions:
- Location (GPS): To record location at the time of clock-in/out. Location access occurs only at the time of clocking and not in the background.
- Camera: To take photos of refueling receipts and for QR code/barcode scanning
- Push notifications: To receive operational communications from the company
- Internet access: For data synchronization with the server
All permissions can be revoked from device settings, but some app features may not be available.
Contact
For any questions regarding this Privacy Policy or the processing of personal data:
Email: info@callgas.it
Support email: info@callgas.it
Website: OpsHub website (opshub.it)
Last updated: November 26, 2025