Privacy Policy

1. Introduction

MATAT TECHNOLOGIES LTD ("Clokio", "we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy is designed to comply with the Israeli Privacy Protection Law 5741-1981 and its Amendment 13 (תיקון 13 לחוק הגנת הפרטיות), as well as the European Union General Data Protection Regulation (GDPR - Regulation 2016/679).

This policy explains how we collect, use, store, share, and protect your personal data when you use our attendance management services, and informs you of your rights regarding your personal data.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person
• Data Subject: The individual whose personal data is being processed
• Processing: Any operation performed on personal data (collection, recording, storage, use, disclosure, etc.)
• Data Controller: The entity that determines the purposes and means of processing personal data (Clokio)
• Data Processor: An entity that processes personal data on behalf of the controller
• Sensitive Data: Data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, etc.

3. Categories of Personal Data We Collect

3.1 Identity and Contact Data

• Full name
• Email address
• Phone number
• Profile photograph

3.2 Employment Data

• Employee ID number
• Job title and department
• Work location assignment
• Employment status

3.3 Attendance and Time Data

• Clock-in and clock-out timestamps
• Break times
• Working hours calculations
• Leave requests and absences

3.4 Location Data

• GPS coordinates at clock-in/clock-out (with explicit consent)
• Geofencing verification data

3.5 Biometric Authentication

3.6 Technical Data

• IP address
• Device type and operating system
• Device identifiers
• Browser type (for web access)
• App version

4. Legal Basis for Processing (GDPR Article 6 & Israeli Law)

We process your personal data only when we have a valid legal basis:

5. Purposes of Processing

We process your personal data for the following specific purposes:

• Providing and maintaining attendance management services
• Verifying employee identity during clock-in/clock-out
• Generating attendance reports for employers
• Processing leave requests and managing absences
• Sending service-related notifications
• Providing customer support
• Improving and optimizing our services
• Ensuring security and preventing fraud
• Complying with legal and regulatory requirements
• Sending marketing communications (only with consent)

6. Data Sharing and Recipients

We do not sell your personal data. We may share your data with the following categories of recipients:

6.1 Your Employer

Attendance data, working hours, and leave information are shared with authorized administrators in your organization as part of the employment relationship.

6.2 Service Providers (Sub-processors)

We engage third-party service providers who process data on our behalf. For a complete list of our sub-processors, please visit our Sub-processors page.

All service providers are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance and appropriate security measures. Organizations requiring a DPA can contact us at support@matat.co.il.

6.3 Legal and Regulatory Authorities

We may disclose data when required by law, court order, or government request, or to protect our legal rights.

7. International Data Transfers

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

After the retention period, data is securely deleted or anonymized in accordance with our data destruction procedures.

9. Your Rights (GDPR & Israeli Privacy Law)

How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer at support@matat.co.il. We will respond within:

• GDPR: 30 days (extendable by 60 days for complex requests)
• Israeli Law: 30 days

We may request identification verification before processing your request.

10. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

• Israel: The Privacy Protection Authority (הרשות להגנת הפרטיות) - www.gov.il/privacy
• EU: The supervisory authority in your country of residence or where the alleged infringement occurred

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Employee security training and confidentiality agreements
• Incident response and breach notification procedures
• Physical security of data centers
• Regular backups and disaster recovery procedures

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR requirement)
• We will notify the Israeli Privacy Protection Authority as required by Israeli law
• If the breach is likely to result in a high risk to your rights, we will notify you directly without undue delay

13. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. This section explains what cookies are, how we use them, and how you can control them.

13.1 What Are Cookies?

Cookies are small text files that are stored on your device when you visit a website. They help websites remember your preferences and improve your experience.

13.2 Types of Cookies We Use

13.3 Specific Cookies Used

13.4 Local Storage

In addition to cookies, we use browser local storage for:

• FCM Token: Push notification device token
• Cookie Consent: Your cookie preference
• UI Preferences: Sidebar state and display settings

13.5 Managing Cookies

14. Children's Privacy

Our services are intended for adults in employment relationships. We do not knowingly collect personal data from children under 16 (GDPR) or 18 (Israeli law). If we become aware that we have collected data from a minor without appropriate consent, we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes:

• By email at least 30 days before the changes take effect
• Through a prominent notice in our application
• By updating the "Last updated" date at the top of this policy

Continued use of our services after changes become effective constitutes acceptance of the revised policy.

16. Contact Information