Privacy notice for end users of the platform

When your employer or principal uses Duckday to manage shifts, attendance, projects, billing and HR data, the GDPR roles are:

• Data Controller — your organisation. Decides why and how data is processed.
• Data Processor— Superduck S.r.l. Processes data exclusively to provide the platform on the controller's documented instructions, never for its own purposes.

To exercise your data subject rights (access, rectification, erasure, portability, objection, restriction) please contact your employer first, as data controller. Duckday assists the controller in handling your request.

Depending on the configuration chosen by your employer, the platform may process:

• Identification and professional contact data
• Attendance, clock-ins, shifts, leave, business trips
• Geolocation data (only if enabled by the employer in compliance with Italian Workers' Statute, Art. 4)
• Project, activity, progress and labour-cost data
• E-invoicing and accounting data
• Uploaded documents and attachments
• Application logs (logins, IP, user agent, audit trail)
• AI-assistant insights

Duckday implements technical and organisational measures consistent with GDPR Art. 32, leveraging Oncode S.r.l.'s ISO/IEC 27001 certification. Key measures include:

• Encryption in transit (TLS 1.3) and at rest
• Cloud hosting within the European Union
• Strong authentication and granular role-based access
• Immutable audit log of operations
• Regular backups and disaster recovery procedures
• Vulnerability management and periodic penetration tests

For more detail, see the Security page.

To deliver the platform, Duckday relies on qualified vendors (cloud, email, observability, AI). The current list is available at Sub-processors. All vendors operate within the EU or under adequate safeguards (Standard Contractual Clauses 2021/914, Data Privacy Framework).

You may exercise the rights provided by GDPR Articles 15–22 (access, rectification, erasure, portability, restriction, objection) by contacting your employer as data controller.

If you believe your rights have been violated, you may lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome).

For questions about Duckday acting as Processor, write to [email protected] or [email protected].