Privacy Policy for casamato

This Privacy Policy describes how ArnoHealth S.L. ("onmedic", "we", "us", "our") and Casa Mató S.L. collect, use, and protect your information when you use the casamato mobile application (Package ID: com.alarno.casamato, referred to as the "App").

1. Data Controller and Entity Information

The entities responsible for data processing under this Privacy Policy are:

• Developer & Publisher: ArnoHealth S.L., Barcelona, Spain (info@onmedic.com)
• Business Application Owner: Casa Mató S.L., Rambla 153, Sabadell, Barcelona, Spain (info@casamato.com)

2. Information We Collect and Process

The App is designed for internal store management, stock logistics, recipes, sales tracking, work shift logging, and inventory auditing for Casamato. We collect and process the following categories of data:

• User Identity & Account Information: Email address, user name, and unique authentication identifier (UID) managed via Firebase Authentication to verify employee identity and assign access roles.
• Workshift & Time Records: Clock-in / clock-out timestamps, shift hours worked, and employee IDs transmitted to securely manage workforce attendance records.
• Inventory & Store Management Data: Stock levels (SIMA module), product quantities, text notes, sales figures, and recipe formulations entered into the App.
• Camera & Photo Access (Remain Module): With your permission, the App accesses your device camera and image picker to take photos of daily remaining inventory ("sobrants"). These images are transmitted securely to our cloud backends (Google Workspace Drive / Google Apps Script) strictly for internal store auditing and waste management.
• Device & Security Technical Identifiers: Secure installation tokens and device IDs strictly used for API authentication, session maintenance, and application security.

3. Legal Basis and Purposes of Processing

We process your personal data under the following legal bases:

• Performance of Employment / Business Relationship: To authenticate staff members, manage work shifts, maintain inventory logs, and enable internal store operations.
• Legitimate Interests: To maintain security, prevent unauthorized application access, and prevent food waste through inventory audits.

4. No Data Sale or Third-Party Commercial Sharing

We do not sell, rent, trade, or monetize your personal data to any third party.

We only share data with trusted infrastructure providers acting as data processors under strict GDPR compliance:

• Google Cloud & Firebase: For user authentication and real-time app state synchronization.
• Google Workspace / Apps Script: For business logic execution, work shift storage, and secure inventory photo archives.

5. Data Security

We implement industry-standard encryption protocols (HTTPS/TLS in transit, encrypted storage at rest) and strict access controls to protect your information against unauthorized access, loss, or misuse.

6. Data Retention and Account Deletion

Personal data and workshift records are retained for the duration of the active business/employment relationship or as required by applicable labor and tax laws in Spain.

Users may request account deletion or data erasure at any time by contacting us at info@casamato.com or info@onmedic.com. Upon verification, associated personal identifiers will be permanently removed from our active authentication databases.

7. User Rights under GDPR

If you are in the European Economic Area (EEA), you have the right to:

• Access, rectify, or request erasure of your personal data.
• Restrict or object to data processing.
• Request data portability in a structured format.

To exercise your rights, email info@casamato.com or info@onmedic.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD at aepd.es).

8. Updates to this Policy

We may update this Privacy Policy periodically. The latest version will always be available at this URL with an updated "Last updated" date.

9. Contact Us