Privacy and data protection in Regsta

For customer employee and work-time data, the employer is the controller and Keyton ApS processes data under the employer's instructions and data-processing agreement. Keyton ApS may be controller for its own contact, support, and security information.

Regsta may process identity, contact, role, company membership, work-time, breaks, correction reasons, approvals, export history, audit and security facts, and support correspondence. Special-category data must not be placed in free text without a documented basis.

Processing supports authentication, access control, work-time registration, approval, evidence, export, compliance monitoring, support, service security, and agreed or legal obligations.

The production database and authentication operate through Supabase in the EU, the application through Vercel, and rate limiting through Upstash. Access is role- and company-bounded. Regsta does not sell employee data or use it for advertising.

Work-time and audit evidence follows the employer's configured, legally bounded retention period. Account deletion removes access, push credentials, and direct profile identifiers; evidence the employer must retain is pseudonymised rather than silently destroyed.

Employees should normally contact their employer as controller for work-time data. Regsta forwards or handles requests under the data-processing agreement and the employer's instructions.