Card, PIN or biometrics
The site's access system connects to the employee's real status in Kimobox.
Employee portal
Who gets in, where and when, with no guard at the door
Access authorization to the plant or office per employee, with card, PIN or biometrics, synced with their real documentation and schedule status.
What it does and what to watch for
A corporate access control system decides who may enter each area and when, and it does so by consulting that person's actual status: whether their safety training is current, whether their fitness certificate is valid, whether their contractor coordination paperwork is approved. Kimobox connects the door to those records, so authorisation stops being a list somebody maintains by hand and becomes a consequence of the data.
- Workplace biometrics
- High-risk processing The Spanish authority advises against it for attendance absent an art. 9.2 GDPR exception; guidance of November 2023
- Worker consent
- Not a valid basis on its own The subordinate relationship prevents it from being freely given
- Usual alternatives
- Card, PIN, NFC or QR code They meet the purpose without processing special categories of data
- CCTV
- Art. 89 of the LOPDGDD Requires prior information and a visible notice
- Contractor coordination
- Automatic block on expired documents Links to art. 24 of Law 31/1995 and RD 171/2004
Automatic authorization
Access is only granted if training, medical fitness or documentation are current.
Access by work site
Each site has its own zones and its own access permissions.
Access history
Date, time and documentation status at the moment of each entry, available to look up later.
Automatic lockout
If a document or medical fitness check expires, access is blocked on its own, with nothing to remember.
Visitors and external staff
The same access control also manages visits and subcontractor staff.
What it controls
From employee status to the site's door
- Access authorization by employee, site and zone
- Sync with card, PIN, biometrics or a kiosk
- Automatic lockout if training, medical fitness or documentation expires
- Access history by employee, date and site
- Access management for visitors and subcontractor staff
- Integration with the physical access control already installed
How it works
From employee status to access authorization
Training, medical fitness and documentation are verified automatically. Only if all three are current is the access authorization issued, synced with the site's card, PIN or biometrics.
- Automatic verification of training, medical fitness and documentation
- Authorization synced with the physical access system
- Automatic lockout as soon as any requirement expires
Real examples
Doors that close themselves when they should
Chemical plant
A contractor without current site training
Before The guard checks a printed list updated on Mondays. Someone whose training lapsed on Wednesday keeps walking in all week.
After The card checks the file status at the moment of the read. If training expired yesterday, the door stays shut and the manager gets the alert with the reason.
Logistics centre
Temperature-controlled areas
Before Anyone with a general card can enter the chill store, whether or not they have cold-working training.
After Permissions by area tied to the competence matrix. Only those with the relevant qualification get in, and every access is logged.
Offices · visitors
The visitor book on the reception desk
Before A notebook with names and times, illegible within a fortnight and exposing third parties' personal data to everyone.
After Pre-registration by the host, a temporary badge with automatic expiry and a searchable log, without showing one visitor's details to the next.
Vocabulary
Distinctions worth keeping
- Access control
- A system that authorises or denies entry to a space. Its purpose is physical security, not time accounting, even where the same reader serves both.
- Attendance control
- Recording working time. When it uses the same reader as access control, it is worth being clear these are two distinct processing operations with distinct legal bases.
- Biometric data
- Personal data derived from physical characteristics that uniquely identifies a person: fingerprint, iris, facial geometry. The GDPR treats it as a special category when used for identification.
- Credential
- What proves identity to the reader: card, fob, PIN, code on the phone. It can be revoked instantly, which a fingerprint cannot.
- Anti-passback
- A rule preventing the same credential from entering again without having exited. It is what lets you know exactly who is inside in an evacuation.
Frequently asked questions
What people ask us before getting started
Does it replace the physical access system we already have?
No, it integrates with it: Kimobox decides who's authorized and the turnstile, kiosk or reader carries out that decision.
What happens if an employee's medical fitness expires?
Access is automatically blocked until the documentation is current again.
Does it work across several work sites?
Yes, each site has its own zones, permissions and authorized lists.
Can I look up who accessed a zone on a specific date?
Yes, the access history is available by employee, zone and date.
Can a fingerprint be used to clock in?
The Spanish data protection authority concluded in its November 2023 guidance that biometric attendance control processes special categories of data and rarely finds a valid basis in employment, since worker consent is not considered freely given. The prudent route is a card, a PIN or a credential on the phone.
What about facial recognition?
The same reasoning applies: it is biometric data used for unique identification, with the same restrictions. The European AI Regulation also restricts certain biometric identification uses.
Can access be controlled by zone?
Yes. Permissions are defined by zone and by role, and can be conditioned on the person holding current training or a specific authorisation.
How are visitors handled?
With pre-registration by the host and a temporary badge that expires automatically. The access is logged without exposing one visitor details to the next, as a reception notebook does.
What happens in an evacuation?
With the anti-passback rule active, the system knows who is inside at any moment and produces the list of people present by zone, which is what is needed at the assembly point.
Tell us how you control access to your facilities today
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
No paperwork in order, no access to the site
Contractor coordination with company, worker and equipment documentation validated before access, and expiry…
Occupational safety: PPE, medical fitness and PRL, per employee
Risk assessment, PPE and medical fitness with monitored expiry, PRL training and accident investigation…
Where your team is, in real time and with no phone calls
A live map of clock-ins and field staff movements, with geofences per site, alerts and route history.
What your IT lead is going to ask
Encryption, access control, an audit log, verified backups, and a data processing agreement that reads…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Guidance on attendance control using biometric systems Spanish Data Protection Agency · November 2023
- Organic Law 3/2018 (LOPDGDD), art. 89: CCTV in the workplace BOE-A-2018-16673 · Consolidated text
- Regulation (EU) 2016/679 (GDPR), art. 9: special categories of data EUR-Lex · Applicable since 25 May 2018
Access control to facilities per employee
Kimobox's access control authorizes entry to the plant or office by employee and by work site, synced with card, PIN, biometrics or a kiosk, and automatically blocked if training, medical fitness or any required documentation expires.
Access history stays available by employee, zone and date, and the same system also manages access for visitors and subcontractor staff, integrated with the physical access control already installed at the site.