1. Controller contact details

We are not legally required to appoint a Data Protection Officer (DPO). For privacy questions, contact privacy@prikklokplus.nl.

2. Controller and processor roles

Controller — we are the controller for data related to our own service operations: account management, subscription billing, platform security, and communications from PrikKlokPlus.

Processor — when you as a tenant store data about your employees, clients, or projects inside PrikKlokPlus, we act as a processor on your behalf. A Data Processing Agreement (DPA) governs those data flows. The DPA is available at /legal/dpa.

3. What personal data we process

3.1 Account data

• Name (first and last), email address
• Hashed password (bcrypt — we never see the plaintext password)
• Registration timestamp and IP address
• Language and display preferences (locale, date format, dark mode)
• Two-factor authentication settings (TOTP secret key, recovery codes — encrypted)
• Passkey credentials (WebAuthn public key only)

3.2 Application usage data

• Hour entries: date, project, task, hours, description, approval status
• Tasks and sprints: title, priority, type, assignee, due date, progress
• Projects: name, description, start/end date, linked client relation
• CRM data: client relation names and contact details, invoices, quotes, line items
• Activity log: who performed which action and when (audit and security purposes)

3.3 Billing data

• Company name, billing address, VAT number, Chamber of Commerce number, IBAN
• Invoice history and payment status
• Payments processed via Mollie B.V. — we do not store full payment instrument details

3.4 Technical and security data

• IP addresses (at login, registration, and API requests)
• Session ID (cookie-based, linked to Redis session)
• Browser type and operating system (User-Agent header)
• Login/logout timestamps and failed login attempts
• Error messages and request traces (processed by our self-hosted Grafana/Loki/Tempo monitoring stack — see §6)

3.5 Email communications

• Email addresses for transactional messages: invitations, hour approvals, invoice notifications, security alerts
• Email preferences (opt-out per category, stored in user_email_preferences)

4. Purposes and legal bases

We never use your data for automated individual decision-making or profiling (GDPR art. 22) without human review.

5. Retention periods

6. Sub-processors and third parties

We never sell your personal data to third parties. Analytics (Plausible) and monitoring/error tracking (Grafana/Loki/Tempo/Prometheus) are self-hosted on our own server in Germany — no data leaves the EEA for these purposes. Where a sub-processor transfers data outside the EEA (e.g. Postmark, if using US infrastructure), we rely on EU Standard Contractual Clauses (SCCs, decision EU 2021/914).

7. Security

• Encryption in transit: TLS 1.2+ (HTTPS) for all connections
• Encryption at rest: database disks encrypted at server level
• Passwords: bcrypt hashing — never stored or transmitted in plaintext
• MFA: TOTP and passkeys available for all accounts
• Sessions: HTTP-only, Secure, SameSite=Lax cookies; expire after 2 hours of inactivity
• Rate limiting: login attempts limited (5 per minute per IP + email); registration limited (3 per 10 minutes per IP)
• Access control: staff access on need-to-know, least-privilege basis; secured with MFA

In the event of a personal data breach likely to result in a high risk to your rights, we will notify you promptly and report to the Dutch DPA (AP) within 72 hours (GDPR art. 33–34).

8. Cookies

We do not use tracking or marketing cookies. No third-party advertising cookies are placed.

9. Your rights

We respond within four weeks.

10. Complaints

If you are dissatisfied, please contact privacy@prikklokplus.nl first. You also have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens (AP)
P.O. Box 93374, 2509 AJ The Hague
autoriteitpersoonsgegevens.nl

11. Changes to this policy

We may update this policy when our services or applicable law require it. For material changes we will notify active users by email and/or in-app notification at least 30 days before the effective date.