Privacy policy

We may process identity, contact, job, attendance, leave, payroll, HR document, role, permission and technical audit data.

Biometric or biometric-like data should only be enabled when the customer has a clear legal basis and documented consent or internal policy.

Processing supports secure access, HR workflows, reports, notifications, audit trails and platform operations.

We do not sell HR data. Internal access is limited to support, security, operations and compliance needs.

Users may request export, correction, limitation or deletion according to applicable laws and employer retention obligations.

The platform also exposes product controls to track deletion requests and biometric consent.

Leopardo applies tenant isolation, role-based access control, sensitive data access logging and least-privilege principles.

Customers remain responsible for user configuration, internal policies and local legal obligations.

Leopardo publishes and hosts the platform. For your employees' data (attendance, leave, payroll, HR documents), your company is the data controller and Leopardo acts as a processor, on your instructions.

For website and commercial relationship data, Leopardo is the data controller.

Each processing activity relies on an identified basis: performance of the contract (service delivery), legal obligation (retention of payroll and social documents), legitimate interest (security, fraud prevention, support), or consent (analytics, marketing personalisation, biometric data).

Account and production data: for the duration of the contract, then 12 months. Technical logs: 12 months. Payroll and social documents: applicable statutory periods. Analytics: 14 months maximum. Consent choice: 6 months, then asked again.

Internal access is limited to support, security and engineering teams on a need-to-know basis.

Processors: hosting (infrastructure located in the European Union), application error monitoring, and analytics (Google Analytics 4, Mixpanel) only after your explicit consent. The up-to-date list is available on request.

Production data is hosted in the European Union. Some providers may process data outside the EU: such transfers are covered by appropriate safeguards (standard contractual clauses). Analytics, which may involve such a transfer, is off by default.

Necessary cookies (session, language, security) are always active. Analytics and marketing personalisation are enabled only after your consent, and you can change that choice at any time via “Manage my cookies” in the footer. Your choice is stored for 6 months.

You can exercise your rights (access, rectification, erasure, restriction, objection, portability) by writing to privacy@leopardo-rh.com; we reply within one month. You may also contact the competent data protection authority: in Algeria, the ANPDP; in the European Union, the authority of your country of residence.

If a breach is likely to result in a high risk to your rights, we inform the affected customers and, where required by law, the competent authority, within the applicable timeframes.