Privacy Policy

1 Introduction

EMLOCA ("Employee Locator," "we," "us," "our") provides a real-time employee GPS location tracking platform accessible via mobile application and web dashboard. This Privacy Policy explains what personal information we collect, why we collect it, and how we handle it — including the personal information of employees whose location is tracked through our platform.

By creating an account or using EMLOCA's services, you agree to this Privacy Policy. If you do not agree, please discontinue use of the platform.

2 Who We Are

EMLOCA operates the domain emloca.com and its associated subdomains.

EMLOCA acts in two capacities:

• Data Controller — for personal information collected directly from account administrators and users who register on our platform (names, email addresses, account credentials).
• Data Processor — on behalf of employer-clients ("Account Administrators") who use EMLOCA to track their employees' GPS locations. In this capacity, we process employee location data strictly under the employer's instructions and for the business purposes they define.

Contact: privacy@emloca.com

3 Data We Collect

a) Account & Identity Data

When registering or managing an account, we collect: name, work email address, company name, job title, and account credentials. Passwords are stored exclusively as bcrypt hashes — never in plain text.

b) Employee Location Data

The core function of EMLOCA is collecting GPS coordinates from employees who have installed the EMLOCA Tracker mobile application and activated tracking. We collect:

• GPS latitude and longitude coordinates
• Timestamp of each location ping
• Movement speed and bearing
• GPS accuracy radius
• Device identifier (Android device ID)

This data is linked to the employee's profile within the employer's EMLOCA account. Tracking only occurs while the EMLOCA Tracker app is actively running — the app does not operate silently in the background without the employee's knowledge.

c) Device & Technical Data

We collect the mobile device's unique identifier, operating system version, and app version. This is used to authenticate GPS pings and diagnose technical issues.

d) Communications Data

When you contact our support team, we retain email correspondence to resolve your request and improve our service. Communications are not retained beyond 12 months after resolution.

e) Usage Analytics

We collect anonymized, aggregated data about how features are used (page visits, feature usage frequency, session duration). This data cannot be linked back to individual users and is used exclusively to improve EMLOCA.

4 How We Use Your Data

We use collected data solely for:

• Service delivery: Processing GPS pings and displaying real-time employee locations on the web dashboard.
• Authentication: Verifying user identity and maintaining secure, session-based access.
• Alerts & notifications: Sending configured alerts (geofence entries/exits, GPS offline detection, after-hours activity) via email or Telegram, as configured by the Account Administrator.
• Trip detection: Automatically detecting and recording employee movement history for operational review.
• Platform improvement: Analyzing anonymized usage patterns to improve product features and performance.
• Legal compliance: Meeting legal obligations applicable to our operations.
• Customer support: Responding to and resolving support inquiries.
• Billing: Processing and managing subscription fees.

5 Data Sharing — We Never Sell

EMLOCA does not sell, rent, or trade personal data. We have no advertising partnerships or data broker relationships. We share data only with the following service providers, and only to the extent necessary:

All service providers are required to process data only as instructed and in accordance with applicable data protection law. We do not authorize any service provider to use your data for their own purposes.

We may disclose data if required by law, court order, or to protect the safety of users — always limited to the minimum necessary and after assessing the legal obligation.

6 Data Retention

After the applicable retention period, data is permanently deleted from production databases and backups. Account Administrators may delete employee data earlier through the dashboard settings.

7 Security

We implement technical and organizational measures to protect your data:

• Encryption in transit: All data is transmitted exclusively via HTTPS (TLS 1.2+). We use Let's Encrypt certificates with automatic renewal.
• Password security: All passwords are hashed with bcrypt before storage. Plain-text passwords are never stored or logged.
• Authentication: Session tokens use JWT (JSON Web Tokens) with expiry limits. Failed login attempts trigger brute-force protection via fail2ban.
• Access control: Role-based access control ensures only authorized administrators within your organization can view employee location data.
• Server hardening: UFW firewall restricts access to necessary ports (22/80/443). Apache headers, PHP exposure, and dangerous functions are disabled. fail2ban monitors SSH and web access.
• Database security: PostgreSQL with restricted user privileges. The database is not accessible from the public internet.

No system is entirely immune to security incidents. If you suspect unauthorized access to your account, contact security@emloca.com immediately.

8 Employer Responsibilities

As the Account Administrator deploying EMLOCA to track your employees, you are the data controller for your employees' location data. You bear full responsibility for:

• Disclosure and notice: Informing employees in writing that their location will be tracked, the purposes for which location data will be used, who will have access to it, and how long it will be retained.
• Legal authority: Ensuring you have a valid legal basis to collect employee location data under the employment law, labor code, and privacy legislation of your jurisdiction. Requirements vary significantly by country and region.
• Consent (where required): Obtaining employees' written consent before activating tracking, particularly in jurisdictions where consent is the mandatory legal basis for employee monitoring.
• Employment agreements: Reflecting the tracking program in employment contracts or workplace policies as required by local law.
• Purpose limitation: Using employee location data only for legitimate operational business purposes (workforce management, safety, field service coordination, payroll verification).
• Employee data access: Responding to employees' requests to access, correct, or delete their location data within the timeframes required by applicable law.
• Account security: Ensuring only authorized personnel access the EMLOCA dashboard and that credentials are kept confidential.
• Data accuracy: Keeping employee profiles and assignments accurate and up to date.

We strongly recommend consulting with employment law and data protection counsel in your jurisdiction before deploying employee location tracking.

9 Employee Rights

Employees whose location is tracked through EMLOCA have the following rights regarding their personal data. Requests may be directed to the employer (Account Administrator) or directly to us at privacy@emloca.com:

• Right of access: Request a copy of your location data held within the platform.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your data, subject to the employer's legal retention obligations.
• Right to restriction: Request that processing be temporarily limited while a dispute is resolved.
• Right to object: Object to processing where our legal basis is legitimate interests.
• Right to data portability: Receive your data in a structured, machine-readable format (CSV or JSON).
• Right to withdraw consent: Where processing is based on your consent, withdraw it at any time — this does not affect the lawfulness of processing prior to withdrawal.
• Right to complain: Lodge a complaint with your local data protection supervisory authority. EEA residents may find their authority at edpb.europa.eu.

We respond to verified rights requests within 30 days. Complex requests may take up to 90 days, and we will notify you if an extension is needed.

10 International Data Transfers

EMLOCA servers are hosted in the United States. If you access EMLOCA from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws governing international transfers, your data will be transferred to and processed in the United States.

We use appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable. By using EMLOCA, EEA and UK users acknowledge that their data may be transferred internationally subject to these protections.

11 Children's Privacy

EMLOCA is a professional business platform intended exclusively for users aged 18 and older. We do not knowingly collect personal information from individuals under 18. If we learn that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor's data has been submitted, please contact privacy@emloca.com.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, product features, or legal requirements. When we make material changes, we will:

• Update the effective date at the top of this page
• Post a notice on emloca.com for a minimum of 30 days
• Send an email notification to Account Administrators

Your continued use of EMLOCA after the updated effective date constitutes your acceptance of the revised Policy. If you disagree with the changes, please discontinue use and contact us to close your account.

13 Contact

For privacy-related inquiries, data rights requests, or complaints regarding this Policy:

EEA residents who are not satisfied with our response may escalate to their national data protection supervisory authority. A list of EEA authorities is available at edpb.europa.eu.