‍1. Who We Are

Koverhoop Technologies Inc. is the data controller for personal information collected through KollabHR. We are incorporated and based in the Province of Quebec, Canada.

Privacy contact: admin@koverhoop.com

2. Information We Collect

2.1 Employee and User Personal Data

• Full name, email address, and phone number
• Home address
• Date of birth
• Profile photo
• Gender (collected as optional diversity data)

2.2 Employment and HR Data

• Job title, department, and employment type
• Start date
• Leave and attendance records
• Disciplinary records
• Benefits enrollment data

2.3 Payroll and Financial Data

• Salary and compensation details
• Bank account information

2.4 Authentication and Account Data

• Login credentials (username and hashed passwords — passwords are never stored in plain text)
• User roles and permissions

Multi-factor authentication (MFA) data collection is planned for a future release and this Policy will be updated accordingly.

2.5 Automatically Collected Technical Data

• IP addresses
• Browser type and device information
• Session duration

We do not use cookies or tracking identifiers for advertising or analytics purposes. If this changes, this Policy will be updated and a consent mechanism will be implemented.

2.6 Slack Integration Data

When a Customer connects the KollabHR Slack app:

• Slack bot token and workspace ID — stored upon workspace connection.
• Slack User ID — stored when a User connects their KollabHR account to Slack.
• Slack User IDs retrieved via the Slack API for notification routing — only stored for Users who have explicitly connected their accounts.

KollabHR does not read, store, or process Slack messages or channel content. The integration is used exclusively to send outbound HR reminders and notifications.

Upon disconnection of the Slack integration, all stored tokens and Slack User IDs are permanently deleted. Slack’s own data handling is governed by Slack’s Privacy Policy at slack.com/privacy-policy.

2.7 Data We Do Not Currently Collect

• Tax identification numbers (SIN or SSN)
• Medical or disability information
• Emergency contact details
• Background check results
• Cookies or advertising tracking identifiers
• Data from third-party HR tools or payroll systems

This Policy will be updated if any of the above are introduced in future.

3. How We Collect Information

• Directly from Customers when setting up and managing employee profiles.
• Directly from Users when they log in, update their profiles, or submit requests.
• Automatically through the Platform’s technical infrastructure (IP address, browser info, session data).
• Through the Slack integration when a Customer connects their workspace or a User links their Slack account.

4. How We Use Information

• To provide and operate the KollabHR Platform and its features.
• To manage employee records, leave, assets, and HR workflows on behalf of Customers.
• To authenticate Users and manage access controls.
• To send HR reminders and notifications via Slack where the integration is enabled.
• To respond to support requests and communicate with Customers and Users.
• To monitor Platform performance, security, and session activity.
• To comply with applicable legal and regulatory obligations.
• To improve and develop the Platform based on usage patterns.

We do not use personal information for advertising, profiling, or sale to third parties.

5. Legal Basis for Processing

• Contract: Processing is necessary to deliver the KollabHR Platform as agreed.
• Consent: For sensitive data categories (such as gender) and the Slack integration.
• Legal obligation: Where required by applicable laws.
• Legitimate interests: For security monitoring, fraud prevention, and platform improvement.

6. Data Sharing and Third Parties

We do not sell personal information.

6.1 Service Providers

We share data with third-party vendors who help us deliver the Platform, including hosting, cloud infrastructure, and security services. These providers are contractually bound to process data only as instructed and in compliance with applicable law.

6.2 Slack

When the Slack integration is enabled, KollabHR sends outbound notifications to Users via the Slack API. Slack receives Slack User IDs and the content of those notifications. Slack’s use of this data is governed by their own Privacy Policy.

6.3 Paddle

Payment processing is handled by Paddle.com Market Limited, the Merchant of Record. Paddle processes billing and payment information under their own Privacy Policy. KollabHR does not store full payment card details.

6.4 Legal Authorities

We may disclose personal information to authorities if required by law, court order, or to protect the rights, safety, or property of KollabHR, its Customers, or the public.

6.5 Business Transfers

In the event of a merger, acquisition, or asset sale, personal information may be transferred. Affected individuals will be notified in advance.

7. International Data Transfers

KollabHR is based in Quebec, Canada. Data may be stored or processed on servers in Canada or the United States depending on our infrastructure providers.

8. Data Retention

• Active account data: Retained for the duration of the Customer’s Subscription.
• Post-cancellation: Customer Data is retained for 90 days following cancellation or expiry, after which it is permanently deleted.
• Non-payment suspension: Data is retained for 90 days from the date of suspension before permanent deletion.
• Technical logs (IP addresses, session data): Retained for up to 90 days.
• Slack tokens and User IDs: Deleted immediately upon disconnection of the Slack integration.
• Legal and compliance records: Retained for the period required by applicable law.

9. Your Rights

• Right to access: Request a copy of personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete information.
• Right to deletion: Request deletion of your personal information, subject to legal retention obligations.
• Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to lodge a complaint: Contact the Commission d’accès à l’information (CAI) in Quebec or the Office of the Privacy Commissioner of Canada (OPC).

To exercise any of these rights, contact us at admin@koverhoop.com. We will respond within 30 days.

10. Security

• Encryption of data in transit using TLS.
• Hashed storage of passwords — plain text passwords are never stored.
• Role-based access controls limiting who can access personal information.
• Regular monitoring for security vulnerabilities.

While we take reasonable precautions, no system is completely secure. Koverhoop is not liable for any loss, direct or indirect, arising from unauthorized access, data breaches, or security incidents beyond our reasonable control. In the event of a data breach posing risk to individuals, we will notify affected parties and relevant authorities as required by Quebec Law 25 and PIPEDA

11. Children’s Privacy

KollabHR is intended for organizations and their employees. It is not directed at individuals under 18. We do not knowingly collect personal information from anyone under 18.

12. Cookies and Tracking

KollabHR does not currently use cookies or tracking identifiers for advertising or analytics. We collect only session duration as part of technical platform monitoring. If we introduce cookies in future, this Policy will be updated and a consent mechanism will be implemented.

13. Language

This Privacy Policy is available in English. A French version is available at kollabhr.com/fr/privacy-policy and shall be provided upon request under the Charter of the French Language (Bill 96). In the event of any inconsistency, the French version prevails for individuals based in Quebec.

14. Changes to This Policy

We may update this Policy to reflect changes in data practices, legal requirements, or Platform features. For material changes, we will provide at least 30 days advance notice via email. The effective date at the top of this Policy always reflects the most recent update.

15. Contact Us

Koverhoop Technologies Inc.

Privacy contact: admin@koverhoop.com