Privacy Policy
1. Introduction
This Privacy Policy describes how Kodius d.o.o. (hereinafter: "Data Controller") collects, uses, stores, and protects personal data through the Kloki platform (hereinafter: "Platform"), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Implementation Act on the General Data Protection Regulation (NN 42/2018).
The Platform is intended exclusively for businesses. The User is a legal entity or sole trader, and the personal data we process relates to the User's contact persons and to the employees the User enters into the Platform.
The Platform is intended exclusively for businesses. The User is a legal entity or sole trader, and the personal data we process relates to the User's contact persons and to the employees the User enters into the Platform.
2. Data Controller
3. Categories of Data We Collect
- Company data: Company name, tax ID (OIB), registered address, company contact details.
- Employee personal data: First name, last name, email address, job title, department, start date, contact phone number.
- Work time data: Records of arrivals and departures, overtime hours, night work, work on public holidays.
- Absence data: Annual leave, sick leave, remote work, paid and unpaid leave.
- Project data: Time entries per project (Work log), task descriptions, billability labels.
- Shift data: Work schedules, planned and completed shifts.
- Travel orders: Destinations, dates, mileage, daily allowances.
- Technical data: IP address, browser and device type, cookies, Platform usage data.
- Sign-up source data: The ad click identifier (for example, the Google gclid parameter) and campaign tags from the link through which you arrived on our website, as well as the page from which the sign-up was started. We obtain these tags from the link itself and store them with the company data only once the sign-up is completed. We do not store them in a cookie.
- Anonymous visit counting: On our public pages we count page loads and clicks on the sign-up and demo buttons, together with the campaign tags from the link. We do not store an IP address, a cookie or any visitor identifier, so visits cannot be linked to a person. This is not personal data and requires no consent.
4. Legal Basis for Processing
We process personal data based on the following legal grounds under Article 6(1) of the GDPR:
- Performance of a contract (point b): Processing necessary for providing the Platform service: registration, account management, work time and absence tracking.
- Legal obligation (point c): Processing necessary for compliance with the Croatian Ordinance on the content and manner of keeping records of workers employed by an employer (NN 55/2024), the Labour Act, and tax regulations.
- Legitimate interest (point f): Platform improvement, system security, abuse prevention, usage analytics, and measuring the effectiveness of our own advertising, that is, learning which ad led to a sign-up.
- Consent (point a): For analytical cookies and marketing communications. Consent may be withdrawn at any time.
5. Purposes of Processing
We use data exclusively for:
- Providing and maintaining Platform services.
- Maintaining legally required work time records.
- Subscription billing and invoicing.
- Service-related communications (maintenance notices, terms changes, security alerts).
- Usage analysis to improve functionality and user experience.
- Technical support and troubleshooting.
- Abuse prevention and Platform security protection.
- Measuring advertising effectiveness. We send the ad click identifier to Google so that a completed sign-up can be linked to the ad that brought it. No employee data or Platform content is sent to Google in the process.
6. Data Processors (Sub-processors)
We use the following third parties to provide our service:
All other data (database, application server, chat system) is stored on the Data Controller's own servers located in a data center in Zagreb, Croatia.
| Sub-processor | Purpose | Data location |
|---|---|---|
| Amazon Web Services (AWS SES) | Sending transactional emails | EU (Frankfurt) |
| Google LLC (Google Analytics) | Website usage analytics | EU/US (with SCCs) |
| Google LLC (Google Ads) | Measuring ad effectiveness (click identifier and time of sign-up) | EU/US (with SCCs) |
7. Data Storage and Location
- Primary location: All user data is stored on our own servers in Zagreb, Republic of Croatia.
- Transfers outside the EU: Google Analytics may transfer data to the US. For such transfers, appropriate safeguards are in place (Standard Contractual Clauses, SCCs). Users may reject analytical cookies via the cookie banner.
- Encryption: All data in transit is protected by TLS encryption. Data at rest is protected at the database level.
8. Data Retention Periods
- Active account data: Retained while the subscription is active.
- After subscription cancellation: Data is retained for 90 days to allow reactivation or export, after which it is permanently deleted.
- Accounting data: Invoices and payment data are retained for 11 years in accordance with the Accounting Act.
- Technical logs: Retained for up to 12 months for security and diagnostics purposes.
- Consent-based data: Retained until consent is withdrawn.
- Sign-up source data: Retained together with the account data, for no longer than 24 months from sign-up, after which it is deleted.
9. Data Subject Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): You may request confirmation of whether we process your data and obtain a copy.
- Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): You may request deletion of data when processing is no longer necessary, unless retention is legally required.
- Right to restriction of processing (Art. 18): You may request restriction of processing in certain cases.
- Right to data portability (Art. 20): You may request your data in a machine-readable format. Kloki enables data export in CSV and Excel formats.
- Right to object (Art. 21): You may object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7): Consent for analytical cookies and marketing may be withdrawn at any time.
10. Controller and Processor Relationship
When the User (company) uses the Platform to record data of their employees:
- The User is the Data Controller for their employees' data.
- Kodius d.o.o. is the Data Processor who processes this data solely according to the User's instructions and for the purpose of providing the service.
- By accepting the Terms of Use, the User enters into a Data Processing Agreement (DPA) with Kodius d.o.o. that includes obligations under Article 28 of the GDPR.
- Kodius d.o.o. undertakes not to process the User's employee data for its own purposes.
11. Security Measures
We implement the following technical and organizational security measures:
- TLS encryption for all data in transit (HTTPS).
- Encryption of data at rest at the database level.
- Regular encrypted backups.
- Restricted data access limited to authorized personnel on the principle of least privilege.
- Access and security event monitoring (audit log).
- Regular software updates and security patches.
12. Cookies
A detailed overview of the cookies we use is available in our Cookie Policy.
13. Changes to the Privacy Policy
We will notify Users of significant changes to this Privacy Policy via email at least 15 days before they take effect. The updated version will be published on this page with a new modification date. We recommend periodically reviewing this page.
14. Contact
For any questions regarding the protection of personal data:
- Website: Kodius d.o.o.
- Email: info@kloki.app
- Address: Kodius d.o.o., Oreškovićeva 1a, 10000 Zagreb, Croatia
- Phone: +385 1 2095 273
Thank you for using Kloki!
Date of last change: September 23, 2026