Simplified notice. The organization for which you work or provide services is the controller of your workday data recorded in LITCRONO; LEGAL IN TECH, S. de R.L. de C.V. processes them on its behalf. They are used to record and control your workday, your leave and your incidents, and to comply with labor and social security obligations. Your location is obtained only when recording. Health data are processed only with your express consent. You may exercise your ARCO rights in accordance with section 8. This English version is provided for reference only; in the event of any discrepancy, the Spanish version shall prevail.
01Controllers and processor
1.1. Controller of the workday data: the Organization that contracts LITCRONO and with which you have an employment or services relationship. When that Organization is AMERICA LEGAL BUFETE, S.C., its address is Av. Insurgentes Sur 1425, Piso 7 C-D, Col. Insurgentes Mixcoac, Alcaldía Benito Juárez, C.P. 03920, Mexico City.
1.2. Processor: LEGAL IN TECH, S. de R.L. de C.V., owner of the solution, processes such data only on behalf of and following the instructions of the Organization, under an instrument that obliges it to keep confidentiality, apply security measures and not use them for its own purposes.
1.3. LEGAL IN TECH is, on the other hand, the controller of the contact data of the persons who administer the Organization's account and of the solution's security logs.
02Data processed
| Category | Data |
|---|---|
| Identification | Name, area, collaboration scheme, institutional email and PIN (stored in protected form) |
| Workday | Date and time of each check-in and check-out, accumulated hours, late arrivals and missed punches |
| Location | Coordinates and accuracy at the moment of recording, the nearest Declared zone and the distance to it |
| Technical | IP address and browser type of the device used to record |
| Leave and incidents | Type, dates, schedule, pay status and reason of each request, its resolution and any supporting documents you choose to attach |
| Social service and internships | Program, educational institution and accredited hours |
| Sensitive data | Only when you provide them: medical leave certificates or other documents with health information |
03Purposes
Primary, necessary for the relationship with the Organization:
- Record and control the workday or service hours and their duration.
- Validate the place of each record against the Declared zones.
- Process leave, vacations, medical leave and missed punches.
- Comply with labor, tax and social security obligations, and respond to requests from authorities.
- Certify social service or internship hours for their release.
- Prepare the weekly workday report, which is sent every Monday by institutional email to General Management and Human Talent, and make it available to them in a read-only consultation view.
- Prevent misuse of the PIN and maintain the security of the solution.
There are no secondary purposes. Your data are not used for advertising or to build profiles unrelated to the relationship with the Organization.
04Legal basis and consent
4.1. Processing for the primary purposes derives from the legal relationship with the Organization and from legal obligations, so it does not require consent under the Federal Law on the Protection of Personal Data Held by Private Parties.
4.2. Health data are sensitive personal data. They are processed only if you decide to provide them and grant your express written consent, which is obtained in the solution itself before attaching the document: when choosing «Medical leave», you decide whether you authorize and attach the photo or PDF, do not authorize, or prefer to review it directly with Human Talent without uploading anything. Your choice is recorded with date, time and IP address. In the reason of a leave request you must not describe conditions; it is enough to indicate «medical leave».
05Geolocation
5.1. Location is requested when pressing «Check-in» or «Check-out» and only with the permission you grant on your device. There is no continuous tracking or location check at any other time.
5.2. The comparison between the location of the record and the Declared zones is performed on the solution's servers. Coordinates are not sent to geocoding services or other third parties.
5.3. Protected address. When you report one or more addresses for occasional remote work, LITCRONO keeps only the state and the coordinates that define the corresponding zone, with a 300-meter radius. Street, number, neighborhood and postal code are redacted and are not visible to Human Resources or to other areas of the Organization. The coordinates are obtained once from the reported address, using publicly available mapping tools and without linking it to your name, and are accessible only to the technical administration of the solution. No photographs of your home are collected or kept.
5.4. For records made from your home, neither the place nor the coordinates are stored or displayed as text; only the zone is recorded. Records outside the declared zones are considered field work and require the prior authorization set by the Organization.
5.5. Notice with acknowledgment. Before each clock-in or clock-out is recorded, the time clock shows you the workday notice or end-of-workday notice set by the Organization; the record is made only if you accept it. Your acceptance is kept in a log with the server time, the zone, the identification method and a SHA-256 digital fingerprint of the notice text, chained to the previous acknowledgment so that any alteration is detectable. Each week a cut-off of that log is generated, which the Organization may seal with a Security Folio and Authenticity QR code to keep it as evidence. Record confirmations are shown on screen; email is reserved for exception notices.
06Remittances and transfers
6.1. Remittances. Your data are communicated to LEGAL IN TECH as processor and to the infrastructure providers that host the solution, subject to confidentiality and security obligations.
6.2. Transfers. No data are transferred to third parties, except in the cases of article 36 of the law, including to labor, tax, social security or judicial authorities that require them, and, at your request, to your educational institution for the release of the social service or internship.
6.3. Internal access. Within the Organization, workday, leave and incident information is accessible only to General Management and to the Human Talent staff it authorizes, through a personal account and password. Human Talent consults it in a read-only view, without the ability to modify records, and receives the weekly workday report every Monday by institutional email. Neither the view nor the report is shared with third parties.
07Security
Administrative, technical and physical measures are applied: role-based access, protected PIN, encrypted communications, an unalterable log of each record and each correction, and reinforced safekeeping of documents with health data, visible only to General Management and the Human Talent staff it authorizes.
Fingerprint or face check-in (optional). If you enable it, the time clock uses your phone's fingerprint or facial recognition. The biometric check is performed exclusively by your device: LITCRONO does not receive, keep or process your fingerprint, face or any biometric template. Only a public key linked to that device, its type, the activation date and the date of your last PIN validation, requested every 30 days, are stored. You may stop using it at any time by checking in with your PIN or asking Human Talent to remove the device.
08ARCO rights and revocation
8.1. You may access, rectify or cancel your data or object to their processing, revoke your consent and limit their use, where applicable.
8.2. Address your request to the area designated by your Organization. In the case of AMERICA LEGAL BUFETE, S.C., write to amartinez@americalegal.law with a copy to info@americalegal.law and the subject «ARCO Rights · LITCRONO». Include your name, a means to reply to you, the document evidencing your identity and a clear description of your request.
8.3. We will inform you of the determination within a maximum of twenty business days and, if appropriate, it will be made effective within the following fifteen business days. Workday records cannot be cancelled while the law requires them to be kept; in that case they are blocked.
09Retention
Workday, leave and incident records are kept during the relationship and, thereafter, for the periods required by labor, tax and social security legislation, including the one set forth in article 804 of the Federal Labor Law. Once those periods have elapsed, they are blocked and deleted. Documents with health data are deleted at the end of the legal retention period of the corresponding file.
10Minors
LITCRONO is not designed to record persons under eighteen years of age. If the Organization were to do so, it will be responsible for obtaining the authorizations required by law.
11Changes
Any change to this Policy will be published on this page with its update date and will be reported in the solution itself.
12Supervisory authority
If you consider that your right to the protection of personal data has been violated, you may go before the Ministry of Anti-Corruption and Good Governance, the competent authority under the Federal Law on the Protection of Personal Data Held by Private Parties in force.
13Legal framework
- Federal Law on the Protection of Personal Data Held by Private Parties (DOF 20-03-2025) and, to the extent not inconsistent, its Regulations and the Privacy Notice Guidelines.
- Federal Labor Law and Social Security Law, regarding the retention of records.
- Commercial Code, regarding data messages.
Contact: info@americalegal.law · 55 6385 7030 · Av. Insurgentes Sur 1425, Piso 7 C-D, Col. Insurgentes Mixcoac, Alcaldía Benito Juárez, C.P. 03920, Mexico City.