Last updated: August 11, 2026
LETHEA MMC ("LETHEA," "we," "us," or "our") provides the TimeWalker application and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with the Services, and describes the choices and rights available to you.
LETHEA MMC is the entity responsible for the Services and, except as described in Section 2, acts as the controller (i.e., the party that determines the purposes and means of processing) of the personal information described in this Policy.
Contact details are provided in Section 16 ("Contact Us"). We have not appointed a Data Protection Officer, as one is not currently required for our operations. If this changes, we will update this Policy accordingly.
TimeWalker is a business workforce-management service used by restaurants and other organizations. When you use TimeWalker as an employee, crew member, manager, or other authorized user of a restaurant or organization account, that organization (the "Customer") may act as the controller of the employee and workforce data it submits to the Services, while LETHEA may act as a processor or service provider on behalf of that organization.
Customer Data may include employee identity and contact information, job role, branch, work schedule, attendance events (including check-in, check-out, break-in, and break-out), working hours, and employment-related payroll or salary information. Access to this information is controlled by the Customer’s authorized administrators and roles.
Our processing of Customer Data on behalf of a Customer is governed by our Data Processing Addendum (DPA), where required by applicable law.
We aim to collect only the personal information reasonably necessary for the purposes described in this Policy.
Account information: full name, email address, password credentials (stored and managed using appropriate authentication controls), and profile information where enabled.
Workforce information: company or restaurant name, branch, job role, work schedule, availability, and work email, where applicable.
Attendance and payroll-related information: check-in, check-out, break-in, break-out, recorded working time, and salary or payroll-related information provided or calculated for the organization’s workforce-management and payroll processes.
Communications: information you provide when you contact customer support or otherwise communicate with us.
Device information: device model, operating system and version, and identifiers actually generated or used by the Services. We do not intentionally collect identifiers that we do not use.
Log and usage data: IP address where used for security and fraud prevention, browser or app information, crash reports, and error logs.
Diagnostic and performance data: API request logs, latency metrics, and application performance data used to maintain security, reliability, and functionality.
We and our service providers may use SDKs and similar technologies for essential authentication/session functions, preferences, analytics, crash reporting, and security, where applicable to the production Services.
Where consent is required by applicable law or an Apple platform requirement, we will obtain consent before collecting or using the relevant personal or usage data and will provide an accessible mechanism to withdraw that consent where applicable.
The Services are not designed to require or intentionally collect government identification numbers, precise financial account numbers, or health information unless a particular lawful service feature expressly requires such information. Please avoid submitting unnecessary sensitive information in free-text fields.
We collect personal information directly from you and, where you are part of a restaurant or organization account, from the Customer or its authorized administrator. We may also receive information from service providers or integrations that you or the Customer has authorized.
We use personal information to create and manage accounts; authenticate users; provide workforce-management and attendance functions; record and calculate working time; support payroll and salary-related administration; operate branch and role-based access; provide customer support; maintain and improve security, reliability, and functionality; prevent fraud and unauthorized access; comply with legal obligations; and enforce our agreements.
Where GDPR applies, the applicable legal basis may include performance of a contract, legitimate interests, legal obligation, or consent where consent is required.
We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
We do not sell personal information, and we do not share it with third parties for their own independent marketing purposes. We may share personal information with cloud hosting and infrastructure providers, authentication providers, customer-support providers, analytics or crash-reporting providers where used, professional advisors, and public authorities where required by law or valid legal process.
Any third party that receives or processes personal information on our behalf is required to provide the same or equivalent protection for that information as described in this Privacy Policy and required by applicable law and Apple’s App Store Review Guidelines.
When you use TimeWalker through a restaurant or organization account, information submitted as Customer Data may be visible to that organization’s authorized administrators and other authorized users according to the organization’s configuration and permissions.
We use Supabase for database, authentication, and storage functionality. Our primary database infrastructure is hosted in Frankfurt, Germany. Where we engage additional service providers that process personal information on our behalf, we require appropriate contractual, confidentiality, security, and data-protection safeguards.
We maintain an up-to-date list of subprocessors, including the purpose of each engagement, and will make it available on request to contact@timewalker.az.
Our primary database infrastructure, provided by Supabase, is hosted in the European Union, currently in Frankfurt, Germany. This means primary database storage is in the EU; it does not mean all processing occurs exclusively there. Service providers may process limited personal information in other jurisdictions for support, security, or subprocessing purposes, subject to applicable transfer requirements and safeguards.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy and for applicable legal, tax, accounting, employment, security, or dispute-resolution requirements.
For organization-managed employee accounts, removing an employee’s account access does not necessarily delete historical employment, attendance, working-hours, or payroll records that the restaurant or organization is entitled or required to retain. Such records are limited to what is necessary for the applicable business or legal purpose and are retained for the applicable retention period.
Routine backups may contain residual copies until those backups are rotated out.
We implement administrative, technical, and organizational measures designed to protect personal information, including encryption of data in transit and at rest where applicable, role-based access controls, least-privilege access, multi-factor authentication for internal systems that support it, and routine backup procedures.
No method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security. Users are responsible for keeping their credentials confidential.
The Services may allow connections to third-party platforms where enabled. If a connection is used, we may receive information authorized by the user or Customer, such as account identifiers or calendar information. The use of a connected third-party service is also governed by that provider’s privacy terms.
Depending on your location and applicable law, you may have rights including access, rectification, erasure where applicable, restriction, objection, data portability, withdrawal of consent where processing is based on consent, and the right to complain to a relevant data-protection authority.
If you are an employee or crew member whose information is controlled by a restaurant or organization, that organization may be the controller of your employment and workforce information. Requests concerning those records may therefore need to be directed to the organization or its authorized administrator first. Where applicable law requires us to assist, we will cooperate with the relevant organization.
To exercise a privacy right directly with TimeWalker, contact us using Section 16. We may reasonably verify identity before processing a request.
TimeWalker is a business-oriented service and is not directed to children. We do not knowingly collect personal information directly from children through the Services.
If we become aware of a security incident affecting personal information, we will investigate it and, where required by applicable law, notify relevant authorities and affected individuals within the required timeframes.
TimeWalker employee accounts are created and managed by an authorized restaurant or organization administrator. Employees do not independently create or delete the organization-managed employee account.
When an authorized restaurant administrator removes an employee from the organization, the employee’s active TimeWalker access is removed. Personal information that is no longer required for the organization’s operational or legal purposes is deleted or de-identified in accordance with applicable retention requirements.
Certain employment, attendance, working-hours, and payroll-related records may remain after access is removed because the restaurant or organization may need them for payroll administration, accounting, employment records, tax obligations, legal compliance, security, fraud prevention, or dispute resolution. Retained information is limited to what is necessary for those purposes and is retained only for the applicable retention period.
Where you have a legal right to request deletion of information controlled by the restaurant or organization, you may direct that request to the organization or its authorized administrator. TimeWalker will assist the Customer with applicable deletion requests as required by law and our contractual obligations.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes through the Services, by email, or by updating the “Last updated” date above. Where required by applicable law, we will provide additional notice before material changes become effective.
If you have questions about this Privacy Policy or our data practices, or would like to exercise a privacy right described in Section 11, please contact us. Please describe your request and include the email address associated with your account where applicable; we will only ask for information reasonably necessary to verify your identity and respond.
LETHEA MMC
Privacy email: contact@timewalker.az
Website: https://www.timewalker.az
Mailing address: Əliheydər Qarayev 40, Binəqədi, Baku, Azerbaijan
| Purpose | Legal basis |
|---|---|
| Creating, authenticating, and managing an account | Performance of a contract |
| Providing workforce-management, attendance, and working-time services | Performance of a contract |
| Customer support and responding to inquiries | Performance of a contract / Legitimate interests |
| Security, fraud prevention, and service reliability | Legitimate interests / Legal obligation |
| Improving functionality and performance | Legitimate interests |
| Complying with legal obligations and lawful requests | Legal obligation |
| Optional non-essential technologies, where consent is required | Consent |
| Data type | Retention |
|---|---|
| Account/access information | During the organization-managed account lifecycle, then deleted or de-identified when no longer required, subject to legal/contractual exceptions. |
| Attendance and working-time records | For the organization’s applicable payroll, employment, accounting, legal, and retention requirements. |
| Payroll/salary-related records | For the applicable payroll, tax, accounting, employment, legal, and dispute-resolution retention period. |
| Security and fraud-prevention logs | Up to 12 months, unless a longer period is required for a specific incident or legal obligation. |
| Support communications | Up to 24 months after resolution, unless otherwise required. |
| Routine backups | Typically up to 30 days on a rolling basis. |