Privacy policy
Last updated:
This policy explains what data Lakazone processes, why, for how long, and what your rights are. It is based on the Mauritius Data Protection Act 2017 and, where it applies, the European Union's General Data Protection Regulation (GDPR).
Who is responsible for your data
Lakazone is published by One Hour Labs Limited, Domaine Victoria V2, Sottise Road, Grand Baie, Mauritius (BRN C26236235). Contact: hello@onehour.mu.
Depending on the data, we act in one of two roles:
- Your employer data: One Hour Labs Limited is the controller for your account data (email address, display name, Google account identifier if you use Google sign-in, preferred language, sign-in times) and for the service's technical logs.
- Your employees' data: for the information you enter about your employees (full name, NIC number, phone number, job, hours, salary, payslips, absences including sick leave and menstrual leave, whether a medical certificate was received, payment method), you, the employer, are the controller. One Hour Labs Limited acts as a processor on your behalf and uses this data only to provide the service to you.
It is up to you to let your employee know that you use Lakazone to manage their pay. An employee who wishes to exercise their rights should contact their employer first, or can write to us at hello@onehour.mu.
Health data
Absences for sickness or menstrual leave relate to health. Lakazone records only the date, the type of absence and whether a medical certificate was received. We never store the medical certificate itself or any diagnosis. This information can only be accessed from the account of the employer concerned.
Why we process this data
| Purpose | Legal basis |
|---|---|
| Providing the service: account, payslips, contributions, leave, MRA summaries | Performance of the contract |
| Security and fraud prevention, for example limiting sign-in code requests per email address and IP address | Legitimate interest |
| Meeting our legal obligations | Legal obligation |
Your data is never sold or used for advertising.
Signing in
You can sign in in two ways:
- One-time code by email: we send you a 6-digit code. We only store a keyed hash of it, and the code expires after 10 minutes.
- Google sign-in: Google shares your name, email address and account identifier with us. Google's own privacy policy applies to what happens on its side.
Cookies
Lakazone only uses cookies that are strictly necessary for the service to work:
- the session cookie, which keeps you signed in during your visit;
- the "remember me" cookie, valid for 30 days;
- a security token that protects forms.
We use no advertising or analytics cookies, which is why you are not shown a consent banner.
Who receives your data
- OVHcloud, our hosting provider, whose servers are located in France (European Union);
- our transactional email provider, which delivers sign-in codes;
- Google, only if you choose Google sign-in.
These providers act only on our instructions. We do not sell your data or share it for any other purpose.
International transfers
One Hour Labs Limited is based in Mauritius and our servers are located in France, in the European Union. Data exchanged between Mauritius and the European Union is covered by appropriate safeguards, in line with the Data Protection Act 2017 and the GDPR.
How long we keep data
- Account and employee data: for as long as your account is active. After a request to delete your account, it is erased within 30 days, except for anything the law requires us to keep.
- Technical logs: up to 12 months.
- Sign-in codes: deleted as soon as they are used or expire.
Mauritian law requires you to keep your payroll records. Before deleting your account, export or print your employees' payslips.
Security
- All connections to the site are encrypted (HTTPS).
- Sign-in codes are never stored in plain text.
- Each account is kept separate: an employer can only see their own household and their own employees.
- Data is backed up regularly.
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise these rights, write to us at hello@onehour.mu; we will reply within one month.
If you believe your rights have not been respected, you can lodge a complaint with the Data Protection Office in Mauritius or, if you live in the European Union, with the supervisory authority in your country.
Changes to this policy
We may update this policy. Any change will be announced on the site, with the date of the last update shown at the top of this page.
See also our legal notice.