Draft: This is a working draft. The final text depends on your company's legal form and must be reviewed by a lawyer. Fields between [vierkante haken] still need to be filled in with your actual company details.
1. Who are we?
Klox is a service for mandatory work-time registration, offered by [bedrijfsnaam BV], with registered office at [adres] and company number [KBO-nummer]. For questions about this policy, you can reach us via privacy@klox.be.
Important distinction: for the data of your employees who clock in via Klox, Klox acts as a processor, and you, as the employer, are the data controller. This relationship is governed by our data processing agreement (DPA). This privacy policy covers the data for which Klox itself is responsible: visitors to this website, contact and demo requests, and account holders.
2. What data we process and why
Contact and demo requests. When you contact us or request a demo, we process your name, email address and optionally your company name, sector and number of employees. Purpose: answering your question and following up with you as a prospect. Legal basis: your consent and our legitimate interest in informing interested parties.
Account and use of the service. For a (future) account, we process your name, email address, organisation details and login credentials. Purpose: delivering the service. Legal basis: performance of the contract.
Technical data. Our servers log limited technical data (such as IP address and timestamp) for security and the proper functioning of the service. Legal basis: our legitimate interest in a secure, working service.
3. Where your data is located
All personal data is stored and processed on servers within the European Union (Germany). That is a deliberate choice and a founding principle of the product. For the security and availability of our website we rely on a specialised provider with servers in several countries; it processes network traffic only and does not retain any personal data. The full list of processors is set out in the data processing agreement.
4. How long we retain data
We retain contact and demo requests until they are no longer needed for the purpose for which they were collected. Work-time records processed via the service are retained for at least 5 years, as required by law; the details are set out in the data processing agreement (DPA).
5. Who we share data with
We never sell your data. We only engage processors that are necessary to deliver the service (such as hosting and, for payments, a payment provider in the EU). We sign a data processing agreement with every processor. You can find the current list of sub-processors in our data processing agreement (DPA).
6. Cookies
This website only uses functional and strictly necessary cookies (for example, to secure a logged-in session). We currently do not use tracking or advertising cookies. Should that change, we will ask for your consent in advance.
7. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict and port your data, and the right to object or to withdraw consent you have given. Send your request to privacy@klox.be; we will respond within the legal deadline.
If you are not satisfied, you can file a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).
8. Changes
We may adjust this policy when the service or regulations require it. The most recent version is always on this page. Last updated: August 2026.