Privacy Policy

• Times TX GmbH
• Pestalozzistraße 25
• 22305 Hamburg
• Germany
• Privacy contact: team@werkiq.com

Times TX as Controller — for data processed via this website and for prospect, sign-up, account, contract and billing data of WerkIQ clients. This Privacy Policy applies.

Times TX as Processor — for personal data (e.g. employee data, receipts, attendance records) that clients and their users enter into the WerkIQ SaaS. There, the client is the controller and processing is governed by the executed Data Processing Agreement (DPA) between the client and Times TX and by the in-app Data Protection Notice. This Privacy Policy does not apply to such data.

The werkiq.com website is hosted by Amazon Web Services on servers in the European Union. Server log files (IP address, timestamp, requested URL, referrer, browser/OS, data volume) are processed to ensure operation and security. Legal basis: Art. 6 (1)(f) GDPR. Retention: max. 30 days unless needed to investigate a security incident. An Art. 28 GDPR data processing agreement is in place with AWS.

When you request a demo, contact us, or sign up for WerkIQ, we process the data you provide: name, business email address, company name, phone number (if given), role, and the content of your enquiry; for sign-ups additionally account credentials, subscription details and billing data.

Purposes and legal bases:

• Responding to enquiries and providing demos: Art. 6 (1)(b) GDPR (pre-contractual measures)
• Contract conclusion, provision of the subscription, invoicing: Art. 6 (1)(b) GDPR
• Compliance with tax and commercial retention duties: Art. 6 (1)(c) GDPR
• Direct marketing to existing business contacts within statutory limits: Art. 6 (1)(f) GDPR (you may object at any time)

We use SendGrid / Twilio Inc. (USA) to deliver transactional email (e.g. sign-up confirmations, demo scheduling, service notices). Transfers to the USA are safeguarded by the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. An Art. 28 GDPR data processing agreement is in place.

Subject to your prior consent (Art. 6 (1)(a) GDPR; § 25 (1) TTDSG), werkiq.com uses Google Analytics, Microsoft Clarity and Meta Pixel. No tool loads before you opt in; consent can be withdrawn at any time via "Cookie Settings". Details: Cookie Notice.

• Google Analytics — Google Ireland Ltd. / Google LLC (USA): reach measurement, usage statistics (EU–US DPF; SCCs)
• Microsoft Clarity — Microsoft Ireland / Microsoft Corp. (USA): session analysis, heatmaps (EU–US DPF; SCCs)
• Meta Pixel — Meta Platforms Ireland / Meta Platforms Inc. (USA): conversion measurement, remarketing (EU–US DPF; SCCs)

Hosting (Hostinger, EU; AWS), email delivery (SendGrid/Twilio, USA), payment and accounting service providers as required for billing, and with consent only, the analytics/marketing providers above. All processors are bound by Art. 28 GDPR agreements. We do not sell personal data.

Transfers to US providers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (10 July 2023) and/or the EU Standard Contractual Clauses, consistent with the safeguards in our client DPA.

• Contract, billing and accounting records: 10 years (§ 147 AO)
• Commercial and business correspondence: 6 years (§ 257 HGB)
• Leads and demo contacts without subsequent contract: deleted no later than 24 months after last contact
• Server logs: max. 30 days
• Consent records: for the duration of reliance plus statutory limitation periods

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) GDPR, and the right to withdraw consent at any time (Art. 7 (3) GDPR). Contact: team@werkiq.com. You may lodge a complaint with a supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information (https://datenschutz-hamburg.de).

If your personal data is processed inside a WerkIQ tenant's instance, please direct requests to your employer (the controller); we support the controller in fulfilling data subject rights in accordance with the DPA.

Technical and organisational measures per Art. 32 GDPR apply, including TLS encryption, encryption at rest for platform data, role-based access control and least privilege. Further details for the SaaS platform are provided in the in-app Security & Compliance materials.

We may update this Privacy Policy; the current version is published on werkiq.com.