Privacy Policy

For processing for which the SHAMOGRIK operator determines the purposes and means, the controller is Bishwajit Karmaker, Wönnichstraße 03, 10317 Berlin, Germany. Privacy enquiries can be sent to support@shamogrik.com.

SHAMOGRIK is primarily a business software platform. Where a customer organization determines why and how personal data of its employees, users, customers or other persons are entered and used in SHAMOGRIK, that organization is generally responsible for its processing. To the extent SHAMOGRIK processes such data only on the customer's documented instructions, the service acts as a processor. A data-processing agreement under Article 28 GDPR must be concluded where required before relevant production processing.

When the public contact channel is used, SHAMOGRIK stores the name, email address, enquiry category, subject, message, selected language, delivery status and timestamps in order to receive, deliver and respond to the enquiry. Please do not submit passwords, payment-card details or sensitive employee information through the public contact form.

• Contractual or pre-contractual enquiries may be processed under Article 6(1)(b) GDPR.
• Other enquiries may be processed under Article 6(1)(f) GDPR where there is a legitimate interest in receiving, securing and responding to communications.
• Where another legal basis is required for a particular enquiry, that basis applies according to the circumstances.

To provide authenticated access and protect the service, SHAMOGRIK can process account identifiers, email addresses, organization and branch memberships, roles and permissions, authentication/session information, trusted or operational device information, security events, login or device-attempt information and audit metadata. Some security and POS audit records can include IP addresses.

Depending on the customer's configuration, the service can process employee identity and contact information, employment and organizational assignments, responsibilities, availability, rosters and shifts, working-time sessions and breaks, attendance events, corrections and manager reviews, leave entitlements and requests, payroll-related records and associated notes or audit history. The customer organization is responsible for ensuring that its use of employee data has an appropriate legal basis and is limited to what is necessary for the employment context.

A recorded sickness or sick-leave status can reveal information concerning an employee's health and may therefore constitute special-category personal data under Article 9 GDPR. In V1, SHAMOGRIK records sickness only as an absence status with dates and necessary workflow/audit information. The sickness workflow is not medical case management: diagnosis, symptoms, medical documents and free-text sickness reasons are not collected through this workflow. Access remains restricted because even a sickness status can reveal health information. In Germany, employee health data also requires particular confidentiality under § 26(3) BDSG in conjunction with Article 9 GDPR.

If a customer explicitly enables personal-device attendance and configures location verification, a clock action can include device-provided latitude, longitude and accuracy for verification against the configured workplace location. The backend derives verification evidence such as status, distance and accuracy for the attendance event. Location functionality must be enabled and used by the customer only where necessary and legally permitted; it should not be used for continuous employee tracking.

Depending on enabled modules, SHAMOGRIK can process organization and branch records, products, inventory and stock movements, suppliers or other counterparties, POS transactions and receipts, expenses, payments, finance and revenue records, assets, production records and related audit information. Such records can contain personal data where individuals are identified within them.

The application uses browser storage and technically necessary session mechanisms for functions such as authentication/session state, selected organization or branch, language and time-format preferences, device identifiers, passkey/device markers and optional attendance reminders. Authentication also uses a secure refresh cookie in production. Optional browser notifications require the user's browser permission. SHAMOGRIK does not currently rely on advertising cookies in the inspected application code. Storage or access that is not strictly necessary must not be introduced without checking the consent requirements of § 25 TDDDG.

On the public homepage and developer portfolio, SHAMOGRIK uses privacy-minimized first-party analytics for page views, approximate engagement duration, referrer domain, coarse device/browser/operating-system classification, browser language and campaign parameters. Analytics does not set or read an analytics cookie, localStorage or sessionStorage identifier. Raw IP addresses are not stored in analytics records; the server derives a one-way visitor key that rotates daily for aggregate counting. Analytics records are intended to be retained for 30 days. Authenticated employee and customer business activity is not profiled by this public analytics.

SHAMOGRIK uses infrastructure providers to operate the service. The current production architecture uses OVH infrastructure for VPS hosting and email delivery. Providers can process technical or communication data where necessary to provide their services. Before additional providers or monitoring/analytics services receive personal data, their role, contractual safeguards and any international transfers must be assessed and documented.

Retention differs by record type and customer context. Data is kept while required to provide the service, maintain security and auditable business records, meet contractual obligations or satisfy applicable statutory retention requirements. The current application contains records intentionally protected from ordinary deletion, including attendance and audit-related history. Customer-specific retention and deletion rules must therefore be defined before broad commercial production use rather than assuming one universal period.

Where SHAMOGRIK is the controller, data subjects can exercise applicable rights including access, rectification, erasure, restriction, portability and objection, and can lodge a complaint with a competent supervisory authority. Where a customer organization is the controller for workforce or other customer data, requests should normally be directed to that organization; SHAMOGRIK will support the customer as processor where required.

SHAMOGRIK uses technical and organizational controls including authenticated access, organization/branch scoping, permissions, secure production transport, security logging and audit-oriented records. Security measures must be reviewed according to risk, particularly for employee, health, location and financial data. No internet service can guarantee absolute security. Suspected privacy or security incidents should be reported promptly to support@shamogrik.com.