# ErgoTime App Privacy Notice

Version 1.1 · 2 October 2026 · ErgoTime for iPhone

Processing takes place on the iPhone. Workstation photographs, survey data, results and reports are not uploaded to the developer. The app communicates with Apple for purchases and with Sectigo and FreeTSA for timestamps. Timestamp services receive file digests and technical data, including the connection's IP address, rather than photographs or reports. The app uses no advertising or advertising-tracking tools. It does not require workers' names, identifiers or health information: do not enter them in free-text fields or photographs.

## 1. Scope, controllers and contact details

ErgoTime is the manual-handling assessment software supplied by CE4U S.r.l. / RAVENG. Questions about app data flows can be sent to **info@raveng.it**.

**CE4U S.r.l.**, trading as RAVENG, Italian VAT and tax number 04731920239, REA VR-444364, Via G. Rossini 29/2, 37012 Bussolengo (VR), Italy, is the controller for processing through its support, contact and testing-management channels. Contact: **info@raveng.it**; certified email (PEC): **posta@pec.ce4u.it**. Use “ErgoTime Privacy” as the subject for privacy requests.

For surveys, photographs and reports, the controller is the party actually determining the assessment's purposes and means, such as the employer, commissioning company or appointed professional, depending on the relationship. The software licence does not automatically assign that role to the user or give the developer access to local files. Apple and timestamp providers process service data under their own notices below. Website use is covered separately by the [website privacy notice](https://raveng.it/privacy-policy/) and [cookie policy](https://raveng.it/cookie-policy/).

## 2. Data on the device

ErgoTime locally processes and stores workstation and load photographs at origin and destination, taken by the user or selected from the photo library; information entered about companies, sites, departments, workstations and tasks; dimensions, masses, forces, frequency counts and observation windows; coupling, posture and condition categories; the selected population and reference mass; user-consulted standard values recorded as declared data; results, indices, sensitivity ranges, diagrams and reports; preferences, selected language and learning progress. Automatic language selection uses Italian when it is the device's primary language and English otherwise. You can change this preference without transmitting it to CE4U.

Photographs document the workstation and load geometry; no measurements are derived from them. They must show places, equipment and objects rather than identifiable people. The app does not recognise or identify people and does not automatically blur faces. If a person appears, retake or remove the photograph before generating a report.

There are no fields for individual workers' names, personnel numbers, age, sex, health or fitness-for-work decisions. A reference population is a method category, such as an adult working population, rather than a description of an individual. If personal information is entered in notes or descriptions, the controller of the assessment activity is responsible for that processing.

The app also stores assessor declarations, revisions and local acceptance receipts: a random identifier, declared name and organisation, capacity, device date, app version, and version, language and digest of the accepted terms. Receipts are not sent to CE4U and do not authenticate identity. Accepting the terms is not general privacy consent.

No ErgoTime account is required and there is no developer-operated cloud archive. File digests are transmitted for timestamps. A digest does not normally allow reconstruction of a file, but can be compared with a file already available; it is not represented as necessarily anonymous.

## 3. Timestamps and technical communications

The app requests RFC 3161 timestamps for assessment-package photographs, report PDFs and package manifests. Requests can be retried when connectivity returns and during background execution permitted by iOS. A locally available assessment does not establish that a timestamp has been obtained; the app displays its status.

HTTPS requests contain the **SHA-256 digest, algorithm and random verification nonce**. Providers also receive the **public connection IP address, request time, app name and version**. This protocol does not send photographs, PDFs, assessor names, company or workstation data, advertising identifiers or persistent device identifiers. Timestamp transport uses neither cookies nor a persistent web session.

| Provider | Service and sources | Retention and information limits |
| --- | --- | --- |
| Sectigo | `https://timestamp.sectigo.com/qualified`; [privacy](https://www.sectigo.com/privacy-policy); [service policies and documents](https://www.sectigo.com/legal) | The provider's policies govern technical records, security, obligations and retention. No single deletion period for all data is promised here. |
| FreeTSA, published contact `busilezas@gmail.com` | `https://freetsa.org/tsr`; [CPS](https://www.freetsa.org/freetsa_cps.html) | The CPS states that it does not request or save information, but does not specify separate periods for every possible technical log. No undocumented deletion or location guarantee is added here. |

These services issue timestamps and process technical data for operation and security under their policies. An endpoint name is not an ErgoTime guarantee that a particular timestamp is qualified or has a particular evidential value. Free commercial use of the Sectigo service is marked NOT VERIFIED in the app configuration.

The app does not anonymise IP addresses or associated request data before transmission. The timestamp protocol does not transmit photographs or reports to the developer. Store privacy information should be read together with the flows described here.

## 4. Apple purchases

Apple handles purchases, subscriptions, renewals, refunds and restoration under its [privacy policy](https://www.apple.com/legal/privacy/en-ww/). ErgoTime receives no payment-card numbers. The app verifies transactions through StoreKit and stores transaction identifiers, products, dates, environment, transaction status and access rights locally, including in the Keychain.

The only plans are Base monthly and Base annual. Both include all functions and reports, with no per-assessment purchase. The subscription purchase flow does not associate photographs, reports or the assessment UUID with Apple. There is no CE4U purchase-verification server. Management and restoration are available on the Subscription screen, reached from Archive and About. Deleting the app or an assessment does not cancel a subscription; restoring purchases does not recreate deleted files.

## 5. Permissions and choices

The camera is used to photograph the workstation and load at origin and destination; Photos is used to attach existing images and save survey photographs. Manage permissions in iOS Settings. Refusal limits functions requiring those permissions. The app does not request microphone, contacts, calendar, GPS location or motion-sensor access.

Declining the declarations required for Assess and Calculate leaves Learn and archive consultation available; it does not cancel a subscription. There is no separate switch to disable only timestamp requests. They are part of the flow described above and may be retried when connectivity returns.

## 6. Sharing and security

When you choose Share, AirDrop, Mail, Files or another service, selected recipients receive the exported content. A package can contain photographs, reports, revisions, survey inputs, declarations, receipts and terms. Check for identifiable people and unnecessary personal or confidential data before sending. Selected services and recipients apply their own rules.

The archive and access rights use the app container and iOS Keychain protections. Set a device passcode and protect backups. Digests and technical signatures support integrity checks without guaranteeing absolute immutability or a certified assessor identity. Exported copies are outside the app's exclusive control.

## 7. Purposes and legal bases

| Activity | Purpose and legal basis |
| --- | --- |
| Requested functions and associated technical flows | Delivering software functions, managing purchased access and requesting timestamps: GDPR Article 6(1)(b), to the extent necessary for the requested service. Providers explain the legal bases for processing under their responsibility in their own notices. |
| Support and enquiries received by CE4U | Responding to requested pre-contractual or contractual activities: Article 6(1)(b). Unnecessary attachments, particularly identifiable photographs or reports concerning individual workers, should not be sent. |
| Requested TestFlight participation | Managing participation and reported errors: Article 6(1)(b). Security and establishing or defending rights in a dispute: Article 6(1)(f), limited to necessary information. |
| Surveys and photographs organised by employers or professionals | The controller of the actual activity determines its purposes, legal basis, notices and retention, including risk-assessment duties and workplace rules. This notice does not replace information owed to workers or other people present. |

App data are not used for advertising, commercial profiling or sale to data brokers. An iOS permission does not replace any authorisation or legal basis required to photograph someone else's workplace or people.

## 8. Retention and deletion

**Local archive.** Workstations, assessments, photographs and reports remain until deleted through available functions. Uninstalling the app removes its local container but does not guarantee removal of Keychain entries, backups, Photos, exports or data received by third parties. No general automatic deletion is scheduled. Previews remain in the protected container; iTunes/Finder file sharing is disabled.

**Backups and Photos.** These follow device and service settings, such as iCloud or computer backups. Images saved to Photos follow that library's rules. Manage copies separately. Subscription expiry does not automatically delete the archive.

**Support and testing.** Received data are kept to handle and conclude the request or test and, where necessary, document activities or address a dispute. Further retention is limited to what those purposes require. Documents subject to statutory retention follow their own periods, which are not indiscriminately extended to photographs and attachments. You can request a deletion review using the contacts in section 1.

**Providers.** Apple applies its own rules; timestamp providers apply the policies in section 3. Deleting a local file does not automatically remove records already retained by a provider.

## 9. Recipients and transfers

Authorised personnel and relevant email, hosting and support providers may access support and testing data, as may authorities where legally required. Website channels are explained in the website notice. Support requests are not published.

Apple and timestamp providers may use infrastructure outside the European Economic Area. A European Sectigo establishment does not guarantee that every operation occurs within the EU. Provider notices describe transfer conditions and how to request information on applicable safeguards. FreeTSA's CPS does not document a specific location guarantee or a transfer agreement with the developer; this notice does not attest that one exists. HTTPS protects transport but is not itself a legal safeguard for an international transfer.

## 10. TestFlight and external websites

Through TestFlight, Apple may provide the developer with invitation information, device and system details, installations, sessions, crashes, feedback and submitted screenshots. These are used to manage tests and correct problems. You can leave testing through TestFlight; see [Apple's TestFlight privacy notice](https://www.apple.com/legal/privacy/data/en/test-flight/).

Source, contact and legal links open browser pages. Website cookies and statistics are separate from the app: read the relevant notice and manage website preferences. The app includes no third-party advertising or analytics SDKs.

## 11. Your rights

Where applicable, you may exercise access, rectification, erasure, restriction, portability and objection rights under GDPR Articles 15–22. You may withdraw consent for processing based on consent without affecting prior lawfulness. For CE4U processing, contact **info@raveng.it** or **posta@pec.ce4u.it**, using “ErgoTime Privacy” as the subject. Identity may be checked proportionately; do not send identity documents, photographs or complete reports unless requested.

For local content, contact the controller of the assessment activity and use the app's functions; the developer has no remote archive access. Workers should contact their employer or the party organising the survey. For provider-held data, use contacts in the providers' notices. You can complain to the [Italian data-protection authority](https://www.garanteprivacy.it/) or another competent supervisory authority.

## 12. Children and updates

The app is intended for adults. It calculates task indices and does not make decisions about people with legal effects. It does not provide fitness-for-work decisions, require health data or serve as a health-surveillance or worker-monitoring tool. Avoid unnecessary personal data and photographs. New functions changing data flows require an updated notice. The version and date identify this text; it does not describe future cloud services or absent features as active.