Privacy Policy

1. Who is the controller?

Controller within the meaning of the General Data Protection Regulation (GDPR), unless this policy states otherwise:

• [FIRMA], [ANSCHRIFT]
• Represented by: [GESCHÄFTSFÜHRUNG]
• Register entry: [FIRMENBUCHNUMMER/HANDELSREGISTER]
• Contact for data protection requests: [DATENSCHUTZKONTAKT]
• General contact: [KONTAKT]

This policy covers the kloq website, registration, the customer account and the operation of the kloq service (kloq. time, kloq. people, kloq. pay and kloq. mobile) in the cloud variant we host. Anyone who runs kloq themselves (self-hosting) is responsible for their own data processing. For self-hosting, this policy applies only to the extent services provided by us are used (for example the push relay, see section 5.4).

2. Overview: who is responsible for what?

kloq is a service for businesses, so roles are split in two.

For employee data, the customer therefore decides on purposes and means. We process this data solely on the customer's instructions. Details are in the DPA. Employees will find guidance in section 11.

3. What data do we process as controller, why, and on what basis?

We currently do not process payment data: the public beta is free. Should we charge fees in the future, we will extend this policy beforehand.

There is no statutory obligation to provide the data. Without the registration data, however, we cannot create an account.

We do not use advertising, tracking or analytics services and do not pass on data for advertising. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

4. Processing on behalf of the customer

Where we process employee data for customers, we act as processor. This includes in particular:

• time bookings, corrections, time accounts, absences and rosters (kloq. time),
• personnel master data, roles, invitations and connections to HR systems (kloq. people),
• pre-capture of payroll data, expenses, travel, meal allowance and receipts (kloq. pay),
• data of the mobile app (kloq. mobile), for example clock-ins, push device tokens and optionally a location result.

The customer decides which functions it activates and which data it captures. It is responsible for having a legal basis (Art. 6 GDPR; in Germany supplemented by national rules, in Austria notably ArbVG and AVRAG, in Switzerland Art. 328b OR) and for observing any required participation rights of employee representatives. We do not review this. kloq merely provides notices and a confirmation gate during setup, which does not block.

Data subject requests concerning this data are forwarded to the customer or we support the customer in answering them (Art. 28(3)⁠(e) GDPR).

5. Recipients and processors

We pass on data only where necessary for operation. We maintain the current list of sub-processors in the register attached to the DPA; customers are informed of changes in advance.

5.1 Hosting: Hetzner Online GmbH (Germany)

The service is operated at Hetzner Online GmbH in Germany. Hetzner processes the data stored there on our behalf. An Art. 28 GDPR contract exists or must be concluded [OFFEN – confirm].

5.2 E-mail delivery: [PLATZHALTER – SMTP provider open]

We use an e-mail service provider for sending confirmation-code e-mails and system messages: [PLATZHALTER – SMTP provider, seat, country]. The e-mail address and message content are processed in the process.

5.3 Optional receipt recognition: Anthropic PBC (USA)

kloq can read receipts (for example for meal allowance or expenses) using AI. This receipt recognition is off by default and is processed only if the customer activates it. If so:

• Our data is stored in the EU. Receipt recognition runs through Anthropic PBC (USA). This is therefore a transfer to a third country.
• Only the receipt image and a fixed prompt defined by us are sent to the provider. Employees' names or personnel numbers are not sent.
• Sick notes and proof of incapacity for work are never sent to receipt recognition.
• The result is a suggestion that a person confirms; it does not replace a decision by a human.
• The customer can switch the function off at any time; receipts are then captured manually.

Receipts may still contain personal data, for example a printed name or a card number stub. The transfer relies on [OFFEN – transfer instrument: provider's DPF certification and/or Standard Contractual Clauses, see section 6]. The provider's commitments on retention and non-use for training must be fixed in the contract [OFFEN].

We therefore do not claim that all data is processed exclusively in the EU. The accurate statement is: stored in the EU, receipt recognition (only if activated) through Anthropic (USA).

5.4 Push notifications: Apple and Google

For push notifications of the mobile app we use services of Apple (APNs, USA) and Google (FCM, USA). A device token is transmitted, which is pseudonymous but personal data. The notification itself is content-free: it only carries a "news" signal with an encrypted ID; the app fetches the content directly from the server. For self-hosted installations, forwarding runs through the kloq push relay, which stores nothing except counters for rate limiting. The legal status of Apple and Google (processor or independent controller) and the transfer instrument are still to be clarified [OFFEN].

5.5 Other recipients

• Authorities and courts, where we are legally obliged.
• Professional advisers (legal, tax, audit), where necessary and bound to confidentiality.
• Single sign-on providers such as Microsoft or Google process sign-in data under the customer's own contract with that provider, not on our behalf.

6. Transfers to third countries

Where data is transferred to countries outside the EU/EEA (currently only the USA, see sections 5.3 and 5.4), this happens only on a basis under Chapter V GDPR: either an adequacy decision of the European Commission (EU-US Data Privacy Framework, Decision (EU) 2023/1795, for certified recipients) or Standard Contractual Clauses under Art. 46 GDPR.

The durability of the EU-US Data Privacy Framework has not yet been finally settled in court: the General Court of the European Union dismissed the Latombe action on 3 September 2025 (T-553/23); an appeal (C-703/25 P) is pending. We therefore document Standard Contractual Clauses as a fallback [OFFEN – confirm implementation].

For Switzerland, the Swiss-US Data Privacy Framework applies (in force since 15 September 2024); the EU has confirmed Switzerland's adequacy.

Remote access to customer data by support from outside the EU/Switzerland is also a transfer. Support therefore takes place from the EU/Switzerland or with a transfer basis [OFFEN – confirm].

You may obtain a copy of the safeguards on request at [DATENSCHUTZKONTAKT].

7. Retention

We store data only as long as necessary for the respective purpose or as laws require. We keep our own data (section 3) for the periods stated there.

For data a customer processes in kloq, retention classes apply that are set per country and data class and that the customer can adjust within the permitted range. The classes include time bookings, payroll records, receipts, applicant data, health attachments, raw location values, device reads, access logs, consent records and private contact data for invitations. The starting values are documented in our development documents (SPEC.md section 17.2) and in part still need legal confirmation. Data that must still be retained is blocked rather than deleted (Art. 18 GDPR). Technically, deletion is done by destroying keys or removing data partitions, so backups follow the deletion as well.

Private phone numbers used only for invitations and security codes are deleted automatically after activation.

8. Your rights

Under the GDPR you have the following rights:

• access (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of consent with effect for the future (Art. 7(3)),
• lodging a complaint with a data protection authority (Art. 77).

Send your request to [DATENSCHUTZKONTAKT]. We may ask for proof of identity. We answer requests within one month (Austria and Germany; extendable by up to two further months in justified cases, Art. 12(3) GDPR) or within 30 days (Switzerland).

The competent authority for complaints depends on your residence, workplace or the place of the infringement. For us, the competent supervisory authority is, depending on seat, [OFFEN]. In Switzerland the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

For data your employer processes in kloq, please first contact your employer (section 11).

9. Data security

We protect data by technical and organisational measures, including:

• strict separation of each company's data (tenant separation at database level),
• encryption in transit and field-level encryption for sensitive data,
• multi-factor sign-in for privileged roles,
• revocable sessions and devices,
• a tamper-evident log of security-relevant events,
• no personal data in application logs,
• a data breach procedure with notification to the customer without undue delay and, where we are controller, to the supervisory authority within 72 hours (Art. 33 GDPR).

A detailed description is on the Security page. We cannot promise absolute security.

10. Cookies and local storage

We use no tracking, analytics or advertising cookies. As things stand, we only use strictly necessary storage:

Because only strictly necessary storage is used, we do not ask for consent as things stand [OFFEN – legal review]. You can delete or block cookies in your browser; sign-in or the language setting may then not work.

11. For employees of our customers

If your employer uses kloq, your employer is responsible for processing your employee data. We process this data only on its behalf. Please note:

• What data kloq captures about you depends on which functions your employer has activated. Which functions these are, what legal basis your employer has and to whom it passes data on must be communicated to you by your employer under Art. 13 and 14 GDPR. Please consult your employer's employee information or your HR department.
• Direct your requests for access, rectification, erasure and your other rights to your employer. kloq gives your employer tools for this (for example access export and management of data subject requests). If you contact us, we forward your request to your employer because we may not answer it ourselves.
• Within kloq, employees see their own raw bookings, corrections and who changed what.
• Sick notes contain only period and type, no diagnosis. The team generally only sees "absent" unless more is needed for scheduling.
• Additional functions based on your consent can be withdrawn at any time; withdrawal has no disadvantages for you.
• Former employees keep restricted access for access requests, payslips, employment references and withdrawal of consents.

Your employer is also responsible for ensuring that employee representatives are involved on introduction (Austria: works council under ArbVG sections 96, 96a, 97; Germany: works council under section 87 BetrVG; Switzerland: information and consultation under the Participation Act and ArG/ArGV, docs/legal/datenschutz-mitbestimmung.md section 3.6).

12. Notes for Switzerland

For persons in Switzerland the Federal Act on Data Protection (revDSG, of 25 September 2020) applies. For employment relationships, Art. 328b OR limits processing of employee data to what is necessary for suitability for the employment or for performing the employment contract; this provision is relatively mandatory and consent does not widen the scope (docs/legal/datenschutz-mitbestimmung.md section 3.1). For data breaches with a likely high risk we notify as soon as possible (Art. 24 revDSG). Access request deadline: 30 days.

13. Changes to this policy

We adapt this policy when the service, the law or sub-processors change. The current version with version number and date is on this page. For material changes we inform registered customers in advance by e-mail [OFFEN – period].

As of: 2026-10-10, version 2026-1-entwurf.