Privacy Policy

Last updated: May 29, 2026

This notice explains how KaryaQ handles personal data for website visitors, pilot partners, customer contacts, administrators, employees, workers, and other users of KaryaQ workforce operations services. It is written for GDPR-minded use in Germany and the EU using only details KaryaQ can genuinely publish at this stage.

1. Who Is Responsible

KaryaQ is responsible for this website, pilot communications, product access requests, and service administration. Until a dedicated privacy channel is published, privacy requests can be submitted through the contact page.

For website enquiries, pilot communications, marketing preferences, and KaryaQ's own service administration, KaryaQ acts as controller. For workforce records entered or configured by a customer organization, that organization is normally the controller and KaryaQ acts as processor under a data processing agreement or equivalent written terms.

2. Data We Process

Account and contact data

Name, work email, phone number, role, company, team, site, account identifiers, authentication data, and communication preferences.

Workforce operations data

Shifts, schedules, clock events, task activity, approvals, notes, documents, messages, corrections, disputes, review history, and related work details.

Location verification data

Site entry or exit signals, timestamps, device permission status, and privacy-masked verification data. KaryaQ is designed for limited work-site checks, not continuous worker tracking.

Pilot and support data

Pilot requests, feedback, implementation notes, issue reports, support messages, call notes, and product usage observations needed to run and improve the pilot.

Technical and security data

IP metadata, device and browser metadata, log events, session information, diagnostics, abuse-prevention signals, and audit records needed to secure and operate the service.

3. Why We Use Data

To provide scheduling, time, task, approval, communication, document, and review workflows.
To verify work events with privacy-bounded location signals where enabled by the customer organization.
To maintain evidence integrity, audit trails, access control, and security monitoring.
To operate pilots, respond to enquiries, provide support, and improve the product.
To comply with legal duties and defend or establish legal claims where necessary.

4. Legal Bases

Contract performance: to provide accounts, pilot access, support, scheduling, workforce workflows, and requested services.
Legitimate interests: to secure the platform, improve reliability, prevent abuse, protect important records, and understand pilot use where those interests are not overridden by individual rights.
Legal obligations: to keep records, respond to lawful requests, comply with data protection duties, and support employment, tax, audit, or regulatory requirements where applicable.
Consent: for optional marketing, optional device permissions, optional product research participation, or other processing where consent is the correct legal basis.

5. Location and Workforce Safeguards

KaryaQ is designed to avoid unnecessary location collection. Location functionality should be configured around work sites, shifts, and verification events. We do not design the service for continuous private-life tracking, hidden monitoring, or unrelated worker surveillance. Customer organizations are responsible for enabling location features only where lawful, transparent, proportionate, and communicated to affected workers.

6. Automated Decisions

KaryaQ may help organize signals, alerts, schedules, audit records, or workflow recommendations. KaryaQ should not be used to make solely automated decisions that produce legal or similarly significant effects for a worker unless the customer organization has a lawful basis, appropriate safeguards, meaningful human review, and a way for affected individuals to contest the decision.

7. Sharing and Sub-Processors

We do not sell personal data. We share data only when needed to provide the service, follow documented customer instructions, comply with law, protect rights and security, or complete a business transaction with appropriate protections. Service providers may include hosting, database, analytics, communications, security, support, and infrastructure providers. Production customers should receive a current sub-processor list and notice process.

8. International Transfers

Where personal data is transferred outside the European Economic Area, KaryaQ uses an approved transfer mechanism where required, such as Standard Contractual Clauses, transfer impact assessments, supplementary safeguards, or another lawful mechanism recognized by data protection law.

9. Security

KaryaQ uses technical and organizational measures intended to protect personal data, including access controls, encryption in transit, tenant-aware data separation, audit logging, least-privilege access, monitoring, backups, secure development practices, and incident response procedures. No internet service can promise absolute security, but security and privacy limits are treated as product requirements.

10. Retention

Contact and pilot enquiries

Kept while the conversation is active, then deleted or archived when no longer needed.

Account and access records

Kept while the account exists and for a limited period after closure for security, dispute, and audit reasons.

Shift, task, approval, and work records

Kept according to the customer organization's configured retention rules and applicable legal requirements.

Site check records

Kept only as long as needed for work checks, dispute handling, payroll/audit support, or legal retention duty.

Security logs

Kept for a limited security period unless needed longer to investigate abuse, incidents, or legal claims.

11. Your Rights

Access your personal data and receive information about how it is used.
Correct inaccurate or incomplete personal data.
Request deletion where the data no longer needs to be kept.
Restrict or object to certain processing.
Receive portable data where GDPR portability applies.
Withdraw consent where processing is based on consent.
Object to direct marketing at any time.
Ask for human review where an automated process may significantly affect you.
Lodge a complaint with a competent data protection supervisory authority.

If your employer or another customer organization controls the relevant workforce data, we may direct your request to that organization or assist them in responding. We may need to verify your identity before acting on a request.

12. Children

KaryaQ is a workforce and business service and is not intended for children. The service should not be used to create accounts for individuals under 16 unless a customer has confirmed a lawful basis and all required employment and data protection safeguards.

13. Contact

For privacy questions, data requests, pilot privacy review, or security concerns, contact KaryaQ through the contact page until a dedicated privacy contact channel is published.

Talk with us