Privacy Policy

The short version

• Kloqr is a workplace tool. Your employer sets up your account and decides how Kloqr is used at your company.
• The app uses your location only when you clock in or out, scan a checkpoint or update a job, and while you are clocked in. It stops when you clock out.
• We do not sell personal information, show ads, or track you across other companies' apps or websites.
• Kloqr is hosted in Canada, on servers in Toronto.
• You can ask to see, correct or delete your information at any time by emailing privacy@kloqr.com.

1. Who we are and what this covers

Kloqr Technologies Inc. ("Kloqr", "we", "us", "our") is a Canadian corporation based in Ontario. We make workforce scheduling, time and attendance, and proof-of-work software for companies in many industries. This policy applies to:

• the Kloqr mobile app for iPhone, iPad and Android (the "app");
• the Kloqr web portal at app.kloqr.com and each company's own Kloqr address, such as yourcompany.kloqr.com (the "portal");
• our website at kloqr.com (the "website"); and
• the Kloqr API and related services these connect to (together with the app and portal, the "Services").

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to us. "Personal information" means information about an identifiable individual.

This policy does not cover other companies' apps or websites, even if Kloqr links to them, or the way your employer handles information outside Kloqr.

2. Your employer's role and ours

Kloqr is sold to businesses (our "customers"), who use it to manage their staff and work. If you use Kloqr because your employer or a company you work with gave you an account, that company controls the information in its Kloqr workspace. It decides what is recorded, which features are switched on, who in the company can see what, and how long records are kept. We process that information on the company's behalf, following its instructions and our agreement with it, and we do not use it for our own purposes except as described in this policy.

Your employer is responsible for:

• telling you how it uses Kloqr at work, and getting any consent the law requires;
• its own workplace policies, including any written policy on electronic monitoring that employment law requires it to give you (for example, under Ontario's Employment Standards Act, 2000); and
• the accuracy of the information it enters about you.

Questions about your employer's own practices are best sent to your employer first. You can always contact us instead, and we will help or pass your request to the right person.

For information we collect for our own purposes, such as demo requests from our website, customer account and billing contacts, and security records about how the Services are used, Kloqr is directly responsible.

3. Information we collect

What we collect depends on the features your company switches on and how you use them.

Account and profile information

Your name, work email, phone number, employee number, job title or position, your role in Kloqr, the sites, clients or teams you work with, your profile photo if one is added, and your password (stored only in a hashed form that we cannot read). If your company turns on two-step sign-in, we store what is needed to verify it.

Employment and pay information entered by your employer

Pay rates, hours, timesheets, overtime and amounts approved for payroll; licences, certifications, training and their expiry dates; availability and time-off requests. Pay information is visible only to the people at your company whose role allows it.

Location

Precise location from your phone when you clock in, clock out, scan a checkpoint or update a job, so your company can confirm you were at the work location. While you are clocked in, the app also records your location in the background at intervals for attendance and your safety, including when the app is closed or not in use. Background location stops when you clock out. We do not collect location when you are not clocked in. If your company uses the SOS feature and you send an alert, your location is sent to your supervisors with it.

Photos and files

Photos you take or choose to attach to a report, incident, job or spot check, and documents your company uploads. Photos taken in the app may have the time and date stamped on them as proof of when they were taken. The app uses your camera or photo library only when you choose to take or attach a photo; it cannot see the rest of your photos.

Work records

Shifts, assignments, clock-in and clock-out times, breaks, checkpoint scans (QR or NFC tag, time and location), reports and incidents you file, signatures and checklists, notes you read or acknowledge, job progress, and messages and notifications sent to you through Kloqr.

Device and technical information

Your device model and operating system, a device identifier used to check that attendance records are genuine, whether your phone reports a simulated location, the push notification token for your device, the app version, IP address, browser type, sign-in sessions, and security and audit logs of actions taken in Kloqr (who did what, and when). If you work without a signal, the app stores your updates on your phone and sends them when you are back online.

Customer and billing information

For the companies that buy Kloqr: contact details of the people who manage the account, company details, plan, invoices and payment records.

Support and communications

What you send us when you contact us for help, and our replies.

Information from our website

If you request a demo on kloqr.com, we collect your name, work email, company name, phone number (optional), the kind of work your team does, team size, and any message you send, along with your IP address and browser type to prevent spam and abuse.

We do not ask for and do not want sensitive information such as health information, government identification numbers or banking details through Kloqr, unless your company has a specific need and has told you why. Please don't include it in reports or messages unless you have to.

4. How we collect it

• From you, when you use the app or portal, fill in a form, or contact us.
• From your employer, when it sets up your account and enters schedules, pay rates and other records.
• Automatically from your device, such as location while you are clocked in and the technical information described above.
• From other systems your company connects, such as its own software sending jobs into Kloqr through an integration your company sets up.

5. App permissions

The app asks for your permission before using these features on your phone. You can change any of them later in your phone's settings.

If you turn off location, Kloqr can't confirm your attendance at a work location, so some features, such as clocking in, may not work. Your employer may offer another way to record your time.

6. How we use information

• To provide the Services: scheduling, attendance, timesheets, rounds, reports, jobs, time off and the other features your company uses.
• For your company's records: letting it check and approve hours, prepare payroll and invoices, and give its clients proof of work done at their sites.
• For safety: including SOS alerts and notifying supervisors about incidents.
• To communicate with you: notifications, emails and text messages about your work, your account and the Services.
• To keep Kloqr secure: preventing fraud such as location spoofing or someone else clocking in for you, detecting misuse, and keeping audit records.
• To support and improve Kloqr: answering questions, fixing problems and understanding how the Services perform. Where we can, we use information that has been de-identified or combined so it no longer identifies anyone, and we never try to re-identify it.
• To run our business: responding to demo requests, managing customer accounts and billing.
• To meet legal obligations: and to establish or defend legal claims and enforce our agreements.

Kloqr may flag things for a person to review, such as a late clock-in or a clock-in away from the work location. These flags help your company; decisions about you are made by people at your company, not by Kloqr automatically.

We use personal information only for the purposes in this policy, or for a new purpose that we tell you about and, where required, ask your consent for first.

7. Consent

We collect, use and share personal information with consent, except where the law allows otherwise. For information in your company's workspace, your employer is responsible for getting any consent needed from you, and the app also asks for your permission before using your location, camera, photos, NFC and notifications.

You can withdraw consent at any time, subject to legal or contractual limits, by changing your phone's permissions, contacting your employer, or emailing us. We will explain what withdrawing consent means for your use of Kloqr. For example, if you turn off location, you may not be able to clock in through the app.

8. Who we share it with

Inside your company

People at your company see your information according to their role. For example, supervisors see hours and records for the sites they run, and pay is visible only to owners and people who run payroll. If your company gives its clients access to Kloqr, a client can see records for its own sites only, such as attendance and reports.

Service providers

We use a small number of companies to run Kloqr. They may use the information only to provide their service to us. Each is bound by an agreement with us to keep it confidential and protect it to a standard equal to or greater than this policy.

When the app shows a map, it uses the map built into your phone (Apple Maps on iPhone, Google Maps on Android). If you tap for directions, the address is passed to the maps app you choose, and that app's own privacy policy applies.

At your company's direction

Your company may export records from Kloqr or connect Kloqr to its own systems, such as a payroll provider. Once information leaves Kloqr this way, your company's and that provider's privacy practices apply.

Other cases

• When the law requires it, such as a valid court order or subpoena, and only to the extent required.
• To protect someone's life, health or safety in an emergency.
• If Kloqr is sold, merged or reorganized, information may be transferred to the new owner, who must continue to protect it under this policy.
• With your consent.

Kloqr has no parent, subsidiary or affiliated companies that personal information is shared with.

9. What we don't do

• We do not sell or rent personal information.
• We do not show ads in Kloqr or use personal information for advertising.
• We do not track you across other companies' apps or websites, and we do not share information with data brokers.
• We do not use third-party analytics or advertising tools in the Kloqr app.
• We do not collect your location when you are not clocked in.

10. Where information is stored

Kloqr is hosted in Canada: our servers, database and file storage are in Toronto. Some of the service providers listed above, such as those that deliver emails, text messages and push notifications, process limited information (for example, your email address, phone number or the text of a notification) in the United States or other countries. Information processed outside Canada is protected by our agreements with those providers, but it may be subject to the laws of those countries, including lawful access by their courts, law enforcement and national security authorities.

11. How long we keep it

We keep personal information only as long as it is needed for the purposes in this policy or as the law requires. Your company can set shorter or longer periods for most records, and can place a legal hold on records it needs for a dispute or investigation. Unless your company chooses otherwise:

When a company stops using Kloqr, we delete or de-identify its workspace within 90 days after its agreement ends, unless the law requires us to keep something longer. Backups are overwritten on a regular cycle after that. Information stored on your phone is removed when you sign out or delete the app. If we have used personal information to make a decision about you, we keep it long enough for you to be able to ask for it.

12. Your choices and rights

You have the right to:

• ask whether we hold personal information about you, and get access to it and a copy;
• ask how it has been used and who it has been shared with;
• ask us to correct information that is wrong or incomplete;
• withdraw your consent, as described in section 7;
• ask us to delete your information, as described in section 13; and
• complain to us, and to the privacy regulator (see section 20).

You can also turn off location, camera, photo and notification access at any time in your phone's settings, or stop using the app.

To make a request, email privacy@kloqr.com. We will confirm your identity before acting, respond within 30 days, and tell you if we need more time and why. Requests are free. If the information is in your employer's workspace, we may involve your employer, because it controls those records. If we can't give you some information, for example because it would reveal someone else's personal information or the law prevents it, we will tell you why.

13. Deleting your account and data

Kloqr accounts are created by your employer. To have your account and personal information deleted, either:

• ask your employer's Kloqr administrator to remove your account; or
• email privacy@kloqr.com from the email address on your account, with the subject "Delete my account" and the name of your company.

We will delete or de-identify your account and personal information within 30 days of confirming your request. The only exception is records that your employer or we are required by law to keep, such as payroll and hours worked. If anything must be kept, we will tell you what and why, keep it only for as long as required, and use it for nothing else. Deleting the app from your phone does not delete your account.

14. How we protect information

We protect personal information with safeguards that match how sensitive it is, including:

• encryption of information sent between your phone or browser and Kloqr, and encryption of stored data by our hosting provider;
• passwords stored only as secure hashes, sign-in information kept in your phone's secure storage, and optional two-step sign-in;
• each company's data kept separate, with access checked on our servers for every request;
• role-based access, so people see only what their job needs;
• audit logs of who changed what, and when; and
• limited staff access to customer data, only when needed to support or protect the Services.

No system is perfectly secure, and you can help by keeping your password private and your phone locked. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you, your company and the Office of the Privacy Commissioner of Canada as the law requires, and keep a record of every breach.

15. Cookies and similar technologies

Our website does not use cookies. The portal uses a small number of essential cookies and browser storage to keep you signed in securely, protect against forged requests and remember settings such as a collapsed menu. They are not used for advertising or tracking, and the portal won't work properly if you block them.

16. Emails from us

We send service messages that you need to use Kloqr, such as password resets and notifications your company has turned on. If you request a demo, we will contact you about it. We will only send marketing emails as permitted by Canada's anti-spam law, and every marketing email has a way to unsubscribe.

17. If you live outside Canada

Kloqr is based in Canada and built for companies operating in Canada. If you live in a province or country whose privacy laws give you additional rights, such as Quebec, we will honour those rights for your personal information. Contact us at privacy@kloqr.com to make a request.

18. Children

Kloqr is a workplace tool and is not directed at children. We do not knowingly collect personal information from children under 13. Young workers who are old enough to work use Kloqr only through an account set up by their employer. If you believe a child's information is in Kloqr without proper authorization, contact us and we will delete it.

19. Changes to this policy

We may update this policy as Kloqr or the law changes. We will change the date at the top of this page, and if a change is significant we will tell you in the app, in the portal or by email before it takes effect. We will not use personal information for a new purpose without consent where it is required.

20. Contact us and complaints

Kloqr's Privacy Officer is accountable for our compliance with this policy and with privacy law. For questions, requests or complaints about privacy, contact:

Privacy Officer
Kloqr Technologies Inc.
Ontario, Canada
privacy@kloqr.com

For help using Kloqr that isn't about privacy, email support@kloqr.com. For sales and general questions, email info@kloqr.com.

We will look into every complaint, tell you what we find, and fix any problem we discover. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.