Privacy Policy

1. Who we are

WorkTito ("the Service", "we", "us") is owned and operated by AbbitSmart ApS, a company registered in Denmark (CVR: [insert CVR number], registered address: [insert address]). For personal data relating to account holders, AbbitSmart ApS acts as the data controller. Where an employer (an "Owner") uses WorkTito to manage their own staff, that employer is the controller of their employees' work data and AbbitSmart ApS acts as a data processor on the employer's behalf.

2. Data we collect

• Account data: name, username, email address, phone number, address, password (stored hashed), user role (owner/employee/admin), company name, and preferred language, timezone and currency.
• Work data: clock-in / clock-out times, worked hours, overtime, shifts, wages and pay rates, time-off requests, tasks and task messages, and any files or images you upload as attachments.
• Location data: the device's GPS coordinates (and accuracy) captured at the moment an employee clocks in and clocks out — see section 3.
• Technical data: IP address and basic device/browser information, used for security and troubleshooting.
• Payment data: subscription and payment records. Card payments are handled by our payment provider (PayPal); we do not store full card details.

3. Location data

WorkTito records an employee's device location only at the point of clocking in and clocking out, so employers can verify where work sessions started and ended. We do not continuously track or follow employees in the background. Because location is personal data, it is only collected with the employee's device-level permission, and employers who use this feature are responsible for informing their staff and for having a lawful basis for workplace location processing under applicable Danish and EU law.

4. Why we process your data

• To create and manage accounts and provide the time- and wage-tracking service.
• To calculate worked hours, overtime and wages, and to generate reports and exports.
• To operate scheduling, shift alerts, notifications and time-off requests.
• To process subscriptions and payments and to send service and invoice emails.
• To keep the Service secure, prevent abuse and comply with legal obligations.

5. Legal basis (GDPR Art. 6)

• Performance of a contract — to deliver the Service you or your employer signed up for.
• Legitimate interests — to run, secure and improve the Service, and (for employers) to manage their workforce.
• Consent — for device location access, which you can grant or refuse in your device settings.
• Legal obligation — where we must retain records (e.g. accounting).

6. Sharing & processors

We do not sell your personal data. We share it only with:

• Your employer / your employees — an Owner can see the work data of the employees they manage; employees see their own data.
• Service providers (processors) acting on our instructions, including our email/hosting provider and our payment provider, PayPal.
• Authorities where required by law.

7. Data retention

We keep personal data for as long as the account is active and as needed to provide the Service. Work and payment records may be retained longer where required by accounting or employment law. When an account is deleted, associated personal data is deleted or anonymised, subject to any legal retention obligations.

8. Security

Passwords are stored using strong one-way hashing, traffic is served over HTTPS, and access to personal data is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Your rights under the GDPR

You have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent at any time. To exercise these rights, contact us at support@worktito.dk. If you are an employee, some requests may need to be directed to your employer as the controller of your work data. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

10. Cookies

We use only essential cookies needed to keep you signed in and to protect forms (session and CSRF cookies) and to remember your language choice. We do not use advertising or third-party tracking cookies.

11. Children

WorkTito is a workplace tool intended for adults in employment. It is not directed at children and we do not knowingly collect data from children.

12. International transfers

Your data is primarily processed within the EU/EEA. Where a processor (such as PayPal) transfers data outside the EEA, appropriate safeguards such as the EU Standard Contractual Clauses are relied upon.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will notify you.

14. Contact

AbbitSmart ApS, Denmark — support@worktito.dk.