‍1. Who We Are

Koverhoop Technologies Inc. is the data controller for personal information collected through KollabHR. We are incorporated and based in the Province of Quebec, Canada.

Privacy contact: admin@koverhoop.com

Privacy contact: admin@koverhoop.com

Koverhoop Technologies Inc.

2. Information We Collect

15. Contact Us

2.1 Employee and User Personal Data

We may update this Policy to reflect changes in data practices, legal requirements, or Platform features. For material changes, we will provide at least 30 days advance notice via email. The effective date at the top of this Policy always reflects the most recent update.

• Full name, email address, and phone number
• Home address
• Date of birth
• Profile photo
• Gender (collected as optional diversity data)

14. Changes to This Policy

2.2 Employment and HR Data

This Privacy Policy is available in English. A French version is available at [kollabhr.com/privacy-fr] and shall be provided upon request under the Charter of the French Language (Bill 96). In the event of any inconsistency, the French version prevails for individuals based in Quebec.

• Job title, department, and employment type
• Start date
• Leave and attendance records
• Disciplinary records
• Benefits enrollment data

13. Language

2.3 Payroll and Financial Data

KollabHR does not currently use cookies or tracking identifiers for advertising or analytics. We collect only session duration as part of technical platform monitoring. If we introduce cookies in future, this Policy will be updated and a consent mechanism will be implemented.

• Salary and compensation details
• Bank account information

12. Cookies and Tracking

2.4 Authentication and Account Data

KollabHR is intended for organizations and their employees. It is not directed at individuals under 18. We do not knowingly collect personal information from anyone under 18.

• Login credentials (username and hashed passwords — passwords are never stored in plain text)
• User roles and permissions

11. Children’s Privacy

Multi-factor authentication (MFA) data collection is planned for a future release and this Policy will be updated accordingly.

While we take reasonable precautions, no system is completely secure. Koverhoop is not liable for any loss, direct or indirect, arising from unauthorized access, data breaches, or security incidents beyond our reasonable control. In the event of a data breach posing risk to individuals, we will notify affected parties and relevant authorities as required by Quebec Law 25 and PIPEDA

2.5 Automatically Collected Technical Data

• Encryption of data in transit using TLS.
• Hashed storage of passwords — plain text passwords are never stored.
• Role-based access controls limiting who can access personal information.
• Regular monitoring for security vulnerabilities.

• IP addresses
• Browser type and device information
• Session duration

10. Security

We do not use cookies or tracking identifiers for advertising or analytics purposes. If this changes, this Policy will be updated and a consent mechanism will be implemented.

To exercise any of these rights, contact us at admin@koverhoop.com. We will respond within 30 days.

2.6 Slack Integration Data

• Right to access: Request a copy of personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete information.
• Right to deletion: Request deletion of your personal information, subject to legal retention obligations.
• Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to lodge a complaint: Contact the Commission d’accès à l’information (CAI) in Quebec or the Office of the Privacy Commissioner of Canada (OPC).

When a Customer connects the KollabHR Slack app:

9. Your Rights

• Slack bot token and workspace ID — stored upon workspace connection.
• Slack User ID — stored when a User connects their KollabHR account to Slack.
• Slack User IDs retrieved via the Slack API for notification routing — only stored for Users who have explicitly connected their accounts.

• Active account data: Retained for the duration of the Customer’s Subscription.
• Post-cancellation: Customer Data is retained for 90 days following cancellation or expiry, after which it is permanently deleted.
• Non-payment suspension: Data is retained for 90 days from the date of suspension before permanent deletion.
• Technical logs (IP addresses, session data): Retained for up to 90 days.
• Slack tokens and User IDs: Deleted immediately upon disconnection of the Slack integration.
• Legal and compliance records: Retained for the period required by applicable law.

KollabHR does not read, store, or process Slack messages or channel content. The integration is used exclusively to send outbound HR reminders and notifications.

8. Data Retention

Upon disconnection of the Slack integration, all stored tokens and Slack User IDs are permanently deleted. Slack’s own data handling is governed by Slack’s Privacy Policy at slack.com/privacy-policy.

KollabHR is based in Quebec, Canada. Data may be stored or processed on servers in Canada or the United States depending on our infrastructure providers.

2.7 Data We Do Not Currently Collect

7. International Data Transfers

• Tax identification numbers (SIN or SSN)
• Medical or disability information
• Emergency contact details
• Background check results
• Cookies or advertising tracking identifiers
• Data from third-party HR tools or payroll systems

In the event of a merger, acquisition, or asset sale, personal information may be transferred. Affected individuals will be notified in advance.

This Policy will be updated if any of the above are introduced in future.

6.5 Business Transfers

3. How We Collect Information

We may disclose personal information to authorities if required by law, court order, or to protect the rights, safety, or property of KollabHR, its Customers, or the public.

• Directly from Customers when setting up and managing employee profiles.
• Directly from Users when they log in, update their profiles, or submit requests.
• Automatically through the Platform’s technical infrastructure (IP address, browser info, session data).
• Through the Slack integration when a Customer connects their workspace or a User links their Slack account.

6.4 Legal Authorities

4. How We Use Information

Payment processing is handled by Paddle.com Market Limited, the Merchant of Record. Paddle processes billing and payment information under their own Privacy Policy. KollabHR does not store full payment card details.

• To provide and operate the KollabHR Platform and its features.
• To manage employee records, leave, assets, and HR workflows on behalf of Customers.
• To authenticate Users and manage access controls.
• To send HR reminders and notifications via Slack where the integration is enabled.
• To respond to support requests and communicate with Customers and Users.
• To monitor Platform performance, security, and session activity.
• To comply with applicable legal and regulatory obligations.
• To improve and develop the Platform based on usage patterns.

6.3 Paddle

We do not use personal information for advertising, profiling, or sale to third parties.

When the Slack integration is enabled, KollabHR sends outbound notifications to Users via the Slack API. Slack receives Slack User IDs and the content of those notifications. Slack’s use of this data is governed by their own Privacy Policy.

5. Legal Basis for Processing

6.2 Slack

• Contract: Processing is necessary to deliver the KollabHR Platform as agreed.
• Consent: For sensitive data categories (such as gender) and the Slack integration.
• Legal obligation: Where required by applicable laws.
• Legitimate interests: For security monitoring, fraud prevention, and platform improvement.

We share data with third-party vendors who help us deliver the Platform, including hosting, cloud infrastructure, and security services. These providers are contractually bound to process data only as instructed and in compliance with applicable law.

6. Data Sharing and Third Parties

6.1 Service Providers

We do not sell personal information.