Tajo is an app for time tracking, work reports and staff management for construction companies. It is developed and provided by PlisPlas (enunplisplas.com). This policy explains what data the app processes, for what purpose, who sees it and what you can do about it.
Who processes your data
Tajo is not used on your own: you get into it because your company has registered you with an invitation code. That is why there are two different roles:
- Your company is the data controller. It decides which of your data is recorded and for what purpose, and it is the one you must contact to exercise your rights. When it registered you, it should have given you its data protection information with its company name, address and contact details.
- PlisPlas is the data processor. It provides the service to your company on its behalf, under a data processing agreement (art. 28 GDPR), and does not use your data for anything else.
For any question about the app or this policy you can write to info@enunplisplas.com. If what you ask us is to exercise a right over your data, we will pass it on to your company and help it respond.
Demo accounts. If you sign in with a demo code (used by testers and app store reviewers), you enter a fictitious company. There, the controller of your name and email is PlisPlas, solely to let you try the app; ask for deletion whenever you want.
What data is collected and why
Your account
You sign in with your Google account. From it Tajo receives your name, your email and a user identifier; it does not receive your password.
Your working day
When you clock in, clock out or take a break, the exact moment you did it is saved, measured by the server's clock, together with the time shown on your phone (to detect clocks that are off), the device model and the app version (to investigate bugs).
This is not optional, either for your company or for you: article 34.9 of the Estatuto de los Trabajadores (Spanish Workers' Statute) requires a daily record of working hours to be kept. The legal basis is compliance with a legal obligation (art. 6.1.c GDPR), not your consent.
Your location
If your company has it enabled, your position is saved at the moment you clock in or out, and only at that moment, to check that the work is done at the assigned site.
When you yourself start a trip (for example, from one site to another), the app saves points along your route while it lasts —about one every 50 metres— to calculate the kilometres. While it is active you will see a persistent notification saying "Desplazamiento activo" (Trip in progress), and it ends when you close it yourself or when you clock out.
What this is not:
- There is no continuous tracking. Outside the moment of clocking in or out and a trip you have started yourself, the app does not check where you are. Background location permission is not requested.
- Clocking in far from the site does not stop you clocking in. If you are far away or the GPS fails, the entry is recorded anyway and flagged so that your company can review it with you.
- You can deny location permission and keep clocking in and out; the entry will be saved without coordinates.
The legal basis is your company's legitimate interest in verifying the work performed (art. 6.1.f GDPR), within the limits of art. 20.3 of the Estatuto de los Trabajadores.
Your personal and employment data
To manage your employment relationship (legal basis: the performance of your employment contract, art. 6.1.b GDPR, and your company's employment and Social Security obligations, art. 6.1.c): first name and surnames, job title, site or workplace, manager, contact phone and email, contracted hours, absences and holidays. When your company needs them for payroll or Social Security: DNI or NIE (Spanish ID or foreigner ID number), Social Security number and bank account.
The latter are stored separately from the rest of your record and can only be seen by you and whoever handles Human Resources at your company. Your colleagues see your name and job title; never your DNI or your bank account.
Work reports, photos and videos
What you write in the daily report, and the photos and videos you attach to a report, an incident or a purchase receipt, are uploaded to Tajo's servers so that your company can see them. The legal basis is the performance of your contract and your company's legitimate interest in monitoring the work done on its sites (art. 6.1.b and 6.1.f GDPR). The app only accesses the camera or your photos when you choose to attach something.
Voice dictation
If you use the microphone to dictate the report, the audio is converted into text by your phone's speech recognition service (Google on Android, Apple on iPhone), which depending on the model may process it on the phone itself or on its servers. Tajo does not store or send the audio: it only receives the text, which you can review before saving it.
Documents, occupational risk prevention and vehicles
- Documents your company sends you (payslips, contracts, rules) and the record that you have read them.
- Occupational risk prevention: training received, protective equipment handed over and, from the medical check-up, only the fitness result (fit or unfit) and its date — never the diagnosis. The legal basis is the Ley de Prevención de Riesgos Laborales (Spanish Occupational Risk Prevention Act) (art. 9.2.b GDPR).
- Vehicles and kilometres if you drive a company vehicle: number plate and odometer readings that you enter yourself.
Notifications and crashes
To send you alerts (for example, that your holiday has been approved) a notification identifier for your device is stored. If the app closes because of an error, a technical crash report is sent (Firebase Crashlytics) without the content of your reports or your location. The legal basis is the legitimate interest in the app working properly (art. 6.1.f GDPR).
Automated decisions
Tajo does not make decisions that affect you automatically (art. 22 GDPR). When it flags something —a clock-in far from the site, a report that does not add up—, it is always reviewed by a person at your company.
What is NOT collected
- No biometric data. Tajo does not use fingerprints or facial recognition.
- Nothing about your activity on the phone: no installed apps, no browsing, no contacts, no messages.
- No advertising or marketing analytics. Tajo has no ads and no advertising trackers.
Who can see your data
| Who | What they see |
|---|---|
| You | Everything about you, including your full working-hours record |
| Your supervisor or site manager | Clock-ins, reports and absences of their team. They do not see sensitive data |
| Your company's Human Resources | The employment data of the workforce, including sensitive data |
| Your company's administration | All of the above plus the configuration and the access log |
| PlisPlas | Only what is strictly necessary to provide technical support and fix bugs, when your company asks for it |
No colleague without responsibility over you can see your clock-ins.
Third parties
The data is hosted on Google Cloud (Firebase), in data centres located in Madrid, Spain. Google acts as a sub-processor and does not access the data except to provide the service.
Some Google technical services used by the app —Google sign-in, notification delivery and crash reports (Firebase Crashlytics)— may process technical data outside the European Economic Area. Google does so with the safeguards of the GDPR: the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. Your clock-ins, reports, photos and documents are stored in Madrid.
Data is not sold or transferred to third parties for commercial purposes. Your company may share with its payroll advisers what is needed for payslips; in that case it will have told you in its data protection information.
How long data is kept
The working-hours record is kept for four years, as required by article 21 of the consolidated text of the Ley sobre Infracciones y Sanciones en el Orden Social (Spanish Act on Labour and Social Security Offences and Penalties). Trip routes are kept for the same time as the clock-in they belong to. The rest of your data, for as long as your employment relationship lasts and afterwards for the periods set by law.
Your rights
You have the right of access, rectification, erasure, objection, restriction and portability. Exercise them with your company, or write to us at info@enunplisplas.com and we will pass it on.
If you believe your rights have not been properly handled, you can lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es).
Deleting your account
Also on its own page: tajo.enunplisplas.com/en/delete-account.
From the app: More tab → Settings and account → Delete my account. If you can no longer sign in (you have changed phone or company), write to info@enunplisplas.com from the email you used to sign in and we will delete it within 30 days at most, notifying your company.
You should know exactly what happens, because it is not a full deletion and it would be dishonest to say it is:
- Deleted immediately: your login account, your email, your phone number, your DNI, your Social Security number, your bank account, your contact details and the phone notifications. On your record, your name becomes "Cuenta borrada" (Account deleted).
- Your working-hours record is kept (with the location of each clock-in) for the four years required by law: this is an express exception to the right to erasure (art. 17.3.b GDPR).
- Kept by your company, without your name: the employment documents it sent you (payslips, contracts), absences and sick leave, work reports with their photos and videos, trips, purchases and occupational risk prevention records. These are company records that employment, tax and risk prevention law require it to keep for various periods; once they expire, your company deletes them. If you want something deleted sooner that is not subject to that obligation, ask your company or write to us.
Security
Data travels encrypted and access is controlled by role: every operation checks who you are and what you are entitled to see.
The working-hours record is unalterable by design. A clock-in cannot be edited or deleted, not even by an administrator: correcting a mistake means adding a new entry that records who made it, when and why, and the original remains visible. Each entry is cryptographically chained to the previous one, so that any tampering would be detectable. This protects you as much as the company.
Minors
Tajo is a work tool for adults and is not directed at people under 18.
Changes to this policy
If anything relevant changes we will let you know inside the app. The date of the last update appears at the beginning of this document.