Contents
Fleet Rewind Ltd ("we", "us", "our") is a company registered in Ireland. We operate the ÉascaDesk platform, including ÉascaDesk Desk Booking and ÉascaDesk Scheduler, accessible at www.eascadesk.ie and scheduler-lite.eascadesk.ie.
Registered address: 17 Keatingstown, Wicklow, A67 DH73, Ireland.
Fleet Rewind Ltd is the data controller for account and platform data. Where our business customers (managers) store their employees' personal data in ÉascaDesk Scheduler, Fleet Rewind Ltd acts as a data processor on behalf of those customers, who are themselves the data controllers for their employees' data.
This policy applies to:
If you are an employee whose data has been entered by your employer, your employer (the manager account holder) is responsible for informing you that your data is held in ÉascaDesk and for obtaining any consent required under their own legal obligations. This policy explains how we, as processor, handle that data.
| Data | Source | Purpose |
|---|---|---|
| Name, email address | Registration form | Account creation & authentication |
| Password (bcrypt hash) | Registration form | Authentication |
| Country, timezone (IANA) | Settings page | Localising schedule output & compliance exports |
| Stripe customer ID, subscription status | Stripe payment flow | Plan management & billing |
| Last login timestamp | Automatically on login | Security & account integrity |
| Uploaded Excel files (schedule data) | File upload | Schedule generation; deleted after solve |
| Generated schedule JSON | Solver output | Displayed & exported to manager |
| Data | Notes |
|---|---|
| Full name | Required for scheduling |
| WhatsApp phone number (E.164) | Used by clock-in/out bot; globally unique per platform |
| Skills / roles | Used for shift matching |
| Availability preferences | Fed into scheduling solver |
| NIF (Spanish tax ID) | Optional; used for Spanish compliance CSV export |
| Clock-in / clock-out timestamps | Recorded via WhatsApp bot, manual entry, or auto-close |
| Break start / end timestamps | Recorded via WhatsApp bot |
| Shift assignments | Generated by solver or assigned manually |
| WhatsApp session state | 30-minute TTL; holds conversation context only |
We do not use personal data for advertising, profiling, or sale to third parties.
| Processing activity | Legal basis |
|---|---|
| Account registration & authentication | Contract (Art. 6(1)(b)) |
| Providing scheduling features | Contract (Art. 6(1)(b)) |
| Stripe billing | Contract (Art. 6(1)(b)) |
| Employee clock-in/out records (Pro) | Legitimate interests of the manager (employer legal obligation under Real Decreto-ley 8/2019) (Art. 6(1)(f) / Art. 6(1)(c) as processor) |
| WhatsApp session data | Legitimate interests — necessary to operate the bot (Art. 6(1)(f)) |
| Compliance CSV export & audit log | Legal obligation of the controller (employer) — we process as data processor (Art. 6(1)(c)) |
| Server access logs | Legitimate interests — security (Art. 6(1)(f)) |
| Marketing communications (if any) | Consent (Art. 6(1)(a)) — we will ask separately |
We share personal data only with the following processors, under appropriate data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Stripe Inc. | Payment processing & subscription management | USA (SCCs) |
| Meta Platforms Ireland Ltd | WhatsApp Business Cloud API — delivering bot messages | EU / USA (SCCs) |
| Hosting / cloud infrastructure provider | Server & database hosting (PostgreSQL) | EU |
We do not sell, rent, or trade personal data. We do not share data with any third party for advertising purposes.
We may disclose data if required by law, court order, or regulatory authority, or to protect the rights and safety of Fleet Rewind Ltd or others.
Where data is transferred outside the European Economic Area (EEA) — for example, to Stripe or Meta servers in the United States — we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46 GDPR.
| Data type | Retention period |
|---|---|
| Manager account data | For the duration of the account, plus 12 months after deletion request |
| Schedule runs (JSON) | Retained while the account is active; deletable by the manager |
| Uploaded Excel files | Deleted immediately after the solve completes |
| Employee records (Pro) | Retained while the manager account is active; deletable by manager at any time |
| Clock events (including soft-deleted) | Minimum 4 years — required by Spanish Real Decreto-ley 8/2019 for accounts subject to Spanish law |
| Clock event audit log | Minimum 4 years (immutable by design) |
| WhatsApp session state | 30-minute TTL; automatically expired |
| Server access logs | Up to 90 days |
| Stripe billing records | Governed by Stripe's retention policy (typically 7 years for financial records) |
Depending on your relationship with us and applicable law, you have the following rights:
To exercise your rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie or with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es if your complaint relates to Spanish-law processing.
ÉascaDesk Scheduler's Pro plan includes features specifically designed to help employers comply with Real Decreto-ley 8/2019 (Spain's mandatory digital working-time recording regulation).
Under this regulation, employers are required to:
To fulfil these requirements, ÉascaDesk Scheduler implements soft-delete (records are never permanently removed), an immutable audit log for every create, edit, and delete action, and a correction workflow where employees are notified via WhatsApp and must approve any time changes proposed by their manager.
The employer (manager account holder) is the data controller for their employees' working-time data. Fleet Rewind Ltd processes this data solely on the employer's documented instructions as data processor, pursuant to a data processing agreement incorporated into these terms.
ÉascaDesk Scheduler's clock-in/out bot uses the Meta WhatsApp Business Cloud API. When an employee sends a WhatsApp message to the ÉascaDesk bot number:
Meta's own privacy practices are governed by WhatsApp's Privacy Policy. We are not responsible for Meta's data handling.
Employee phone numbers are stored in E.164 format and are used exclusively for operating the ÉascaDesk bot. They are not used for marketing.
We take reasonable technical and organisational measures to protect personal data, including:
No system is completely secure. If you believe your account has been compromised, contact us immediately at [email protected].
ÉascaDesk Scheduler is a single-page application (React/Vite). Authentication uses JWT tokens stored in browser memory and/or localStorage — not cookies. We do not use advertising cookies or third-party tracking cookies on the application.
Our marketing website (www.eascadesk.ie) may use essential cookies for page functionality. We will update this section if analytics or other cookies are introduced.
ÉascaDesk is a business tool intended for use by adults in an employment context. We do not knowingly collect personal data from children under the age of 16. If you believe a child's data has been submitted to our platform, please contact us and we will arrange deletion.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered account holders by email. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
For any privacy-related queries, data subject rights requests, or concerns:
We aim to respond to all enquiries within 30 days.
