1. About this policy
This policy explains what we do with personal data when you visit timepay.pro, ask us a question through the chat box, start a free trial, buy a plan, sign in as a user of a customer account, or install our admin or scanner applications. It is written to meet the Data Protection Act 2017 of Mauritius (the "DPA 2017"), and it applies to Dinagsky Ltd (BRN C26236973), which trades as Upspace and owns and operates TimePay, and which decides how this data is used. TimePay is a product of Dinagsky Ltd, trading as Upspace, and references in this policy to "TimePay", "we" and "us" mean Dinagsky Ltd.
It does not cover the personal data of a customer's employees that is stored in the payroll and attendance platform. For that data the customer is the controller and TimePay is its processor; please read our Data Protection notice, which is a separate document.
We use plain language where we can. If something is unclear, write to us using the details in section 15.
2. Who is responsible for your data
Dinagsky Ltd, trading as Upspace and publisher of TimePay, is the controller of the personal data described in this policy. Our identity and contact details are shown at the foot of this page and in section 15.
We act in two different roles, and it helps to keep them apart. When we handle your own details as a visitor, a customer's account holder or a person who writes to us, we decide the purposes ourselves and are the controller. When we host and process a customer's employee records inside the service, we follow that customer's instructions and are the processor.
3. What we collect and where it comes from
The table lists the main categories. We collect most of this directly from you, some of it automatically when you use our services, and a little from payment providers that confirm a payment.
| Situation | Information | Source |
|---|---|---|
| Chat box and contact | Company name, your name, e-mail address, WhatsApp number, your message and the replies exchanged; the page you were on; a browser marker and the IP address used to send the message | You, and your browser |
| Free trial, free plan and orders | Company name, business registration number, contact person, e-mail, phone or WhatsApp number, the plan and extras chosen, and the password you set (stored only as a one-way hash) | You |
| Billing and payment | Invoice and quotation details, billing address, payment status and references. Card details are entered with the payment provider and are not stored by us | You, and the payment provider |
| Account use | Sign-in e-mail, role and permissions, sign-in and sign-out times, IP address, device and browser type, actions recorded in audit logs | You, and automatically |
| Support | What you tell us when you ask for help, and any files you share | You |
| Notifications | If you install the admin application and allow alerts, the technical address of your device that the push service issues to us | Your device |
| Security and reliability | Technical logs and error reports, which can include IP address, browser details and the page or action involved | Automatically |
We do not ask for, and you should not send us, sensitive information such as health data, religious beliefs, or bank card numbers through the chat box or by e-mail.
4. Why we use it, and our legal grounds
The DPA 2017 allows us to use personal data only where there is a proper reason. These are ours:
| Purpose | Ground |
|---|---|
| Answering your chat messages, e-mails and requests, and sending you a copy of a reply when you have left the chat | Your request; our legitimate interest in responding to enquiries |
| Creating and running your trial or paid account, taking payment, issuing invoices and quotations | Performance of a contract with you, or steps you ask us to take before one |
| Keeping accounting, tax and company records | Compliance with a legal obligation |
| Protecting the service: preventing abuse, spam and fraud, blocking people who misuse the chat, investigating incidents | Our legitimate interest in securing our systems and customers |
| Fixing faults, measuring performance and improving the service | Our legitimate interest in running a reliable product |
| Sending alerts to our own administrators' devices | Consent given when allowing notifications |
| Occasional news about TimePay features to customers | Our legitimate interest, with an easy way to opt out; or your consent where the law needs it |
Where we rely on consent you may withdraw it at any time, which will not affect what we did before. Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can object to that use (see section 10).
We do not sell personal data, we do not use it for advertising by third parties, and we do not make decisions about you that have legal effect by purely automated means.
7. Transfers outside Mauritius
Some providers store or process data outside Mauritius. Our primary database is hosted in Singapore, and other providers may process data in the United States, Europe or other regions where they operate.
Where we transfer personal data abroad we do so in line with the DPA 2017: we choose providers that offer appropriate safeguards, such as contractual protections, encryption in transit and at rest, and access controls, or we rely on another basis the Act allows, such as your consent or what is necessary to carry out a contract with you.
8. How long we keep it
We keep personal data only for as long as there is a good reason to, and then delete it or make it anonymous.
| Information | Period |
|---|---|
| Chat conversations and contact enquiries | Up to 24 months after the last message, unless they lead to a contract. Blocked identifiers are kept for as long as the block is needed |
| Trial or enquiry records that do not become customers | Up to 12 months |
| Customer account records | For the life of the contract and for 30 days afterwards, plus any longer period needed to settle a dispute |
| Invoices, quotations and payment records | Seven years, as required by Mauritian tax and company law |
| Security and audit logs | Up to 24 months |
| Push-notification registrations | Until you disable alerts, remove the application or the registration expires |
Backups are overwritten in the normal cycle, so deleted data can remain in a backup for a short time.
9. How we protect it
We apply technical and organisational measures that suit the risk, including:
- encrypted connections (HTTPS) for all traffic to the service;
- one-way hashing of passwords, so that we cannot read them;
- separation between customers' data inside the database, and role-based access with the least privilege needed;
- audit logging of sensitive administrative actions;
- restricted and monitored access for our own team, with strong sign-in for administrators;
- rate limiting and abuse controls on public forms and the chat;
- regular backups and a process for responding to incidents.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within the period the DPA 2017 sets, normally 72 hours of becoming aware where feasible, and we will inform you without undue delay where the law requires.
10. Your rights
Under the DPA 2017 you have the right to:
- be told how we use your personal data, which this policy is meant to do;
- access the personal data we hold about you and obtain a copy;
- have inaccurate or incomplete data corrected;
- have your data erased when it is no longer needed, when you withdraw consent, or when it has been processed unlawfully, unless we must keep it by law;
- restrict our processing in certain situations;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive data you gave us in a structured, commonly used, machine-readable format where the law applies;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
To use a right, write to us using section 15, telling us your name, the e-mail or number you used with us, and what you ask. We may need to confirm your identity. We will reply within one month and, where a request is complex or we have received many, may extend that by a further period as the law allows, telling you why. We do not charge for a request unless it is manifestly unfounded or excessive.
If you are an employee of one of our customers and want to see or correct your payroll or attendance record, please contact your employer first, since they control that data. We will help them to help you.
11. Children
The service is for businesses and is not aimed at children. We do not knowingly collect personal data from anyone under 18 through our website or chat. If you believe a child has sent us information, tell us and we will delete it.
12. News and marketing messages
We may send service notices that you need, such as invoices, security alerts and changes to terms. We may also send occasional news about TimePay. Each such message explains how to stop receiving it, and you can also tell us at any time. Stopping news does not stop service notices.
13. Other websites
Our pages may link to sites run by others, such as the Mauritius Revenue Authority, PayPal or the Data Protection Office. We are not responsible for their content or privacy practices, and you should read their own policies.
14. Changes to this policy
We may revise this policy when our services or the law change. The date and version at the top show when it was last updated. For significant changes we will give notice on the site or by e-mail before they apply.
15. Contact and complaints
For any question about this policy or your personal data, write to our privacy contact at info@myupspace.com, or by post to 148 Pamplemousses Rd, Port Louis, Mauritius. Please put "Privacy" in the subject.
If you think that we have not respected your rights, please let us know first so that we can put it right. You also have the right to lodge a complaint with the Data Protection Office of Mauritius, headed by the Data Protection Commissioner, whose website is dataprotection.govmu.org, or to take your case to a competent court.
Who we are
TimePay is a product of Dinagsky Ltd, trading as Upspace.
Dinagsky Ltd (trading as Upspace) · BRN C26236973 · 148 Pamplemousses Rd, Port Louis, Mauritius
E-mail: info@myupspace.com
Business hours: Monday to Friday, 09.00 to 16.30 (Mauritius). Closed on Saturdays, Sundays and public holidays.