Data processing agreement (DPA)

This agreement applies between the customer identified in the accepted registration or order, as employer and controller, and Klox, provider of the service, as processor. The processor is Klox BV, Sint-Amandsesteenweg 268, 2880 Bornem, Belgium, company number 1043.296.663, RPR Antwerpen, afdeling Mechelen. The customer determines the purposes and essential means. Klox determines the appropriate technical implementation within the scope of the assignment. This standard agreement is not intended for a customer that itself acts exclusively as a processor for other employers; in that case, the parties set out the correct processing chain separately.

The customer is identified by the legal name, address and company number from its registration and order. Its authorised administrator and privacy and incident contact is the managing director (owner) of the environment, unless the customer designates another contact in writing. Klox can be reached for this agreement at privacy@klox.be. The customer keeps its contact and authorised instruction givers up to date. Klox's own business contact, billing and contract administration is governed by the privacy policy. Accounts, sessions and audit data within the employer environment fall under this assignment when they are processed for the employer.

Klox processes the personal data for the agreed working-time registration: recording start, end and any breaks, compiling registers, traceable corrections, access by authorised users, support and output for the customer, the employees concerned and the competent inspectorate. Roster, absence, kiosk and reporting functions form part of the assignment only if the customer purchases the module concerned. Processing comprises collection, recording, organisation, storage, consultation, securing, correction, export, backup and deletion. The duration runs from the first performance until the end of the periods and instructions in point 10.

The customer ensures a lawful legal basis, information to data subjects, necessary internal arrangements and lawful instructions. Klox does not use these personal data for its own advertising, sales, the training of AI models or any other independent purpose. Access for support or troubleshooting remains limited to what is necessary for the assignment. A development test preferably uses synthetic or genuinely anonymised data. The use of production data for a necessary reproduction of an error remains subject to the same instructions, access protection and deletion rules.

3.1 Data subjects. Employees and other workers lawfully admitted by the customer, plus the customer's administrators and authorised users. The customer separately assesses its authority with regard to, for example, temporary agency workers or workers of another employer.

3.2 Ordinary data. Name, staff number and, where applicable, payroll number, workplace and team, contract type and start and end of employment, insofar as necessary for the chosen features. In addition, business email and account data, secured authentication data, clock-in and clock-out times, recorded breaks, the source of each registration (web app, mobile app, QR code, kiosk or manual entry), corrections with reason, author and time, and the rosters and permitted absence data of the modules purchased. Not every field is mandatory for every customer. Technical data comprise the IP address and device and browser information for relevant audit actions, and the IP address, user agent and necessary login session data. The IP address and device information for a time registration form part of the evidence of that registration and follow its retention period.

If the customer purchases the kiosk module, Klox also processes an employee's personal kiosk PIN, exclusively as a cryptographic derivative with a key per organisation; for badges, exclusively a cryptographic derivative of the badge code and never the readable code; and the data of the kiosk device (name, site, model, operating system and app version). For the mobile app, Klox processes an installation ID, the platform and the app version.

3.3 Absence and sensitive information. The standard assignment does not include medical certificates, diagnoses, biometric identification data, national register numbers or readable badge codes. An ordinary holiday request is not a special category merely by virtue of its name. A sickness code or sickness period may, however, reveal health data. Where the customer has such limited codes or periods processed via the purchased absence module, it sets out the permitted codes, the purpose, the exception under article 9 GDPR and the authorised roles in its documented module instruction. Without that delimitation, no health reasons are processed. Free text containing medical, religious or trade union information and attachments containing medical documents fall outside this assignment.

If the customer uses the sickness absence type in the absence module, the standard instruction in point 11 applies, unless the customer records a different instruction in writing.

For permitted health data, the parties limit access to the necessary categories of persons, describe their functions, keep the list available to the supervisory authority and ensure a statutory or contractual duty of confidentiality. Data received unintentionally outside the scope of the assignment are isolated. Klox informs the customer and follows its lawful instruction for deletion or other necessary handling. The parties limit recurrence through appropriate field, import and access settings.

3.4 Location. The data model contains optional latitude and longitude fields, but the collection of precise geolocation is not part of this standard assignment. Klox does not activate such collection without a separate documented assignment and appropriate technical set-up. Nor does the customer enter such data via import, API or free text without that arrangement. The customer assesses in advance necessity, proportionality, information to employees and any impact assessment. Ordinary workplace or team data are to be distinguished from this.

Klox processes personal data only on documented instructions. Those instructions consist of this agreement, the accepted registration or order, lawfully chosen settings and written instructions from the designated authorised contact persons. International transfers are also subject to point 8. An instruction outside the agreed features first requires agreement on feasibility, security and any additional services. This does not delay assistance required by law.

If Union or Member State law to which Klox is subject requires other processing, Klox informs the customer of that legal requirement before such processing, unless that law prohibits such information on important grounds of public interest. Klox immediately informs the customer if, in its opinion, an instruction infringes the GDPR or other applicable EU or Member State data protection provisions. It does not unlawfully carry out the disputed instruction and consults without undue delay on a lawful solution. A necessary restriction affects only the processing concerned, for as long as that is possible.

Access is granted only to persons who need the data for their task, have received appropriate instructions and are bound by statutory or contractual confidentiality. This includes authorised staff and engaged self-employed contractors. The confidentiality obligation continues to apply after their access or assignment has ended. Klox may, without a new customer instruction, adjust necessary non-essential technical means of implementation provided that the purpose, scope, level of security and the agreed data location are not extended.

Klox implements and maintains appropriate technical and organisational measures in accordance with article 32 GDPR. It takes into account the state of the art, the costs of implementation, the nature and scope of the processing and the risks to data subjects. The measures below are agreed obligations. They are not a commitment that every incident is technically excluded. A different implementation may be used if it provides at least equivalent protection and does not change any other express contractual arrangement.

Transport and authentication. Data transfer takes place via appropriate, up-to-date TLS security. Passwords are stored only with a suitable, salted password hash, not in readable form. Access rights are granted and reviewed on a need-to-know basis. Privileged administrative and support access is protected with multi-factor authentication. Keys and authentication secrets have restricted access and are not included in ordinary exports.

Isolation and integrity. Organisations are separated at database level with row-level security and appropriate authorisation checks. Klox tests their effectiveness, including APIs, exports and anomalous administrative rights. Necessary support access is authorised and traceable. Raw time records are append-only during their retention period; corrections are recorded separately with reason, author and time. This does not prevent lawful rectification, restriction or deletion at the end of the retention period.

Logging. Relevant actions and privileged access are recorded in a protected audit trail with appropriate time synchronisation and protection against unauthorised modification. Business correction data are distinguished from detailed technical security data. Retention follows point 9.

Backups and recovery. Klox makes daily encrypted backups with a rolling retention of at most thirty calendar days. Access to backups is restricted. Klox periodically tests recovery and documents the outcome and necessary improvements. Earlier deletion or restriction instructions are reapplied after a restore before the data concerned become normally available again. Daily backups do not imply a guarantee that no data can ever be lost between two backup moments.

Management and control. Klox applies appropriate processes for security updates, vulnerabilities, secure development, incidents and business continuity and periodically assesses the effectiveness of the measures. The primary application and database are hosted in Germany. Other processing locations and any transfers follow points 6 and 8. The customer remains responsible for its own devices, including a kiosk on the shop floor, account allocation and lawful configuration; this does not reduce Klox's own security obligations.

6.1 Authorisation and chain. The customer grants general written authorisation for the sub-processors identified in the register below before the first processing and for subsequent changes in accordance with 6.2. Klox selects parties that provide sufficient guarantees, imposes on them in writing the same relevant data protection obligations and remains fully liable to the customer for the performance of their obligations in accordance with article 28(4) GDPR. Klox keeps the necessary information on identity, tasks and the further chain available.

• Hostinger. Task: hosting of the application and database, with the data of the purchased modules necessary for that purpose. Primary application and database location: Germany. Contracting party: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.
• Brevo. Task: necessary transactional emails, such as invitations and notifications. Data: email address, necessary name and minimal message content. Contracting party: Sendinblue SAS, trading as Brevo, 106 boulevard Haussmann, 75008 Paris, France. Sensitive leave reasons and complete inspection dossiers are not included in ordinary notifications. Non-essential open and click tracking is not used for these employee messages.

Access or further processing by these sub-processors outside the European Economic Area takes place only in accordance with point 8. On request, Klox provides the countries for backups, administrative and support access and further processing notified by the sub-processor, and the applicable transfer safeguard.

Cloudflare and Mollie Payments are not listed in this register as sub-processors for this employee assignment for as long as Cloudflare provides only DNS without processing employee data on behalf of the customer and Mollie handles only Klox's own payment administration. The processing of technical DNS data and the own role of payment service providers are set out in the privacy policy. If their actual task or data flow changes, Klox reassesses their role before deployment and, where necessary, applies this procedure.

6.2 Changes. Klox normally notifies an intended addition or replacement at least thirty calendar days in advance, stating the identity, task, data, locations and relevant safeguards. The customer may raise a reasoned objection on specific data protection grounds within fifteen calendar days of the notification. Klox deals with the objection before deployment and investigates an appropriate solution. The customer need not consent without information, but cannot require Klox to develop a materially different infrastructure for it free of charge. If no lawful and reasonably feasible solution is possible, either party may terminate the affected part before the new sub-processor processes those data. Klox refunds unused prepaid service time; no early exit fee then applies.

In the event of a demonstrable urgent security or continuity need, the ordinary notice period may be shortened. Klox notifies the reason, the new party and the safeguards before the processing concerned and allows as much time as possible for objection. The statutory right to information and to object is not lost. A customer who only later becomes aware of a specific problem retains a reasoned objection based on that new information.

7.1 Assistance. Taking into account the nature of the processing and the information available, Klox provides appropriate technical and organisational assistance with data subject requests and the obligations under articles 32 to 36 GDPR inclusive, including security, notifications, impact assessments and prior consultation. A data subject request received directly is forwarded without undue delay to the designated customer contact. Klox does not itself decide on the request on behalf of the employer without instructions, except where the law requires it to act itself.

Included are the ordinary product features for access, export, correction and deletion and reasonable standard information about Klox's own processing. For extensive specific search work, custom reports, additional workshops or other assistance beyond that standard support, Klox may charge a reasonable fee agreed in advance. Klox estimates the work and costs in advance where possible. Assistance or remediation required because of non-compliance attributable to Klox is not charged separately to the customer. Urgent assistance required by law is not delayed because of a discussion about additional fees.

7.2 Breaches. As soon as Klox becomes aware of a breach relating to the customer's personal data, it informs the designated contact without undue delay. Klox does not wait until the investigation or the full extent has been established. The first notification contains the information then available on the nature, the data and persons affected, the likely consequences, the measures taken or proposed and a reachable contact. Missing information follows in phases without undue delay. Unlawful loss, destruction, alteration or unavailability may also constitute a breach; theft or disclosure alone is not an exhaustive description.

Klox takes appropriate measures to limit the consequences, preserve evidence, carry out recovery and prevent recurrence and keeps the customer informed of material developments. The customer decides on its notification to the supervisory authority and data subjects. Klox does not make such notifications independently on behalf of the customer without instructions, except where it has its own statutory obligation. An incident notification or the provision of assistance is not in itself an admission of liability. The arrangements on costs and liability are without prejudice to these operational obligations.

The primary application and database are hosted in Germany. Klox organises the standard processing of employee data within the European Economic Area (EEA), in accordance with the chain in point 6. In accordance with the configuration described, normal application traffic is routed directly to the application servers, without a Cloudflare proxy. This is not a guarantee that every network packet is carried without network service providers and makes no statement about separate DNS, email or support flows.

Access or other processing outside the EEA is permitted only after prior documented authorisation or instruction from the customer for the specific recipient, activity and countries, and compliance with chapter V GDPR. Klox communicates the actual transfer safeguard. Where an applicable adequacy decision exists, the recipient and processing must fall under it. Otherwise, Klox uses appropriate safeguards, such as the applicable European standard contractual clauses with the necessary transfer impact assessment and supplementary measures. An instruction from the customer is not in itself a transfer safeguard. Without a lawful solution, Klox does not begin or continue that transfer.

Klox assesses a request from a public authority for data as to its legal validity, scope and applicable obligations. It limits any disclosure to what is necessary, informs the customer unless prohibited by law and, where appropriate, seeks clarification or challenges an unlawful request. An order from a third country is not, without further review, a sufficient basis for a transfer. These arrangements do not constitute an absolute guarantee that a lawful request from a public authority can never be complied with.

9.1 Retention schedule. The customer determines a lawful period and the correct starting point per category. For time records, the associated necessary identification and the correction history, the standard instruction is sixty months from the day to which the registration relates. The customer may have a different justified period and a different starting point required by law recorded, including a shorter period where its applicable obligations permit. Klox carries out that lawful instruction. Additional long-term archiving beyond the included service may require a separate arrangement and a price accepted in advance. The end of the subscription follows point 10 and is not postponed by this standard period.

Detailed technical security and login session data are, by default, deleted or reduced to the necessary minimum audit information after ninety calendar days from the event. The minimum author, action and time of a lawfully retained correction may be kept with that registration without automatically also keeping every IP address or session secret. A specific incident or a reasoned customer instruction may justify a separate necessary period. Access ends when the authorisation is revoked; retaining historical identification does not mean retaining an active account.

For the optional absence module, a module instruction setting out the permitted codes, authorised roles, necessary evidential data, retention period and starting point is recorded before sensitive codes are processed. A period for the underlying time registration does not automatically apply to the sensitive reason or free text. The customer determines that period on the basis of its specific employment-law purpose and justifies any longer retention. Medical documents remain excluded. A targeted legal hold for an actual dispute is recorded in writing, limited to the necessary data and periodically reviewed.

After expiry of the lawful period, Klox deletes personal data or, on lawful instruction, genuinely and irreversibly anonymises them. Removing a name alone is insufficient where staff numbers, rosters, locations, audit data or other reasonably available information allow identification. The customer cannot disable deletion or anonymisation without a documented lawful reason in order to retain data indefinitely. Leaving employment is not automatically the starting point for all categories of data.

9.2 Demonstrability and audits. Klox makes available the information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, conducted by the customer or an independent auditor mandated by it. The parties first use appropriate documentation, recent test results or independent reports where these answer the audit question. This does not replace a necessary additional inspection.

An ordinary audit is announced at least ten working days in advance, scheduled during normal working hours and limited to relevant processing operations. In principle, one ordinary audit is carried out per calendar year. Those limitations do not apply where specific indications of non-compliance, a relevant breach or a supervisory authority make additional or urgent review necessary. The auditor is independent, has no directly competing product interest and is bound by appropriate confidentiality. Other customers' data, authentication secrets and non-relevant trade secrets are shielded. Klox offers appropriate alternative evidence where direct access creates a demonstrable security risk, without preventing the necessary review.

The customer bears its ordinary external audit costs. Reasonable additional effort by Klox beyond standard documentation is estimated and agreed in advance. Insofar as an additional audit proves necessary because of material non-compliance attributable to Klox, Klox bears its own costs of cooperation and remediation. Costs, confidentiality or a supplier procedure may not make the review required by law impossible. For sub-processors, Klox organises adequate information and cooperation in the chain.

10.1 Choice and availability. After the end of the processing services, the customer chooses between return and deletion. The accepted standard instruction is return via secure export for thirty calendar days, followed by deletion. A lawful earlier return or deletion instruction remains possible. In the event of a switch under the Data Act (Regulation (EU) 2023/2854), the retrieval period begins only after the transition and lasts at least thirty calendar days. This agreement remains in force during that wind-down.

The export comprises the lawfully retained personal data and their necessary relationships and metadata, including registrations, corrections with author and reason, rosters, permitted absence data and relevant audit data. Klox provides a commonly used, structured, machine-readable format with the necessary field and schema information and, in addition, a readable PDF dossier according to the plan. Passwords, authentication secrets and data of other customers are not included. The export function remains available after ordinary use ends. If portal access is unsafe, Klox offers an appropriate secure alternative.

10.2 Deletion. After the retrieval period, Klox deletes the personal data from active systems and accessible operational copies within thirty calendar days. This includes relevant temporary exports and support files. Klox has the sub-processors carry out the corresponding wind-down. Only where Union or Member State law to which Klox is subject requires further retention does Klox keep the necessary category, isolated, for the mandatory period and inform the customer, unless notification is prohibited.

Remaining backup copies that are not regularly accessible are phased out no later than thirty calendar days after production deletion. Until then, they remain protected and are used only for necessary recovery, with renewed application of earlier deletion and restriction instructions. On an ordinary end without an extended switch, personal data are deleted from active systems no later than day sixty and from remaining backups no later than day ninety. An earlier lawful instruction is carried out without undue delay, with an explanation of any strictly necessary technical phase-out.

10.3 Trial without activation. Ordinary trial use ends on the last trial day. On the basis of the instruction accepted at the start of the trial, the customer may then securely export or still activate for ninety calendar days. It may request return or deletion earlier. Klox warns the designated contact at least fourteen calendar days before the end of those ninety days. Production deletion follows no later than day 120 and deletion of remaining backups no later than day 150, calculated from the last trial day. Timely activation replaces the scheduled trial wind-down with the subscription retention schedule. Once deletion has been completed, there is no entitlement to recovery of the erased data. Applicable statutory switching rights remain unaffected.

10.4 Evidence and subsequent archive. The customer checks its export in good time and arranges the further archiving that its statutory obligations require. The wind-down is not a free archive for the full employment-law retention period. Klox remains responsible for the agreed complete and usable export. On request, it confirms in writing the completed production deletion and phasing out of remaining copies, or states the category that must be retained by law, the legal basis and the end date.

10.5 Relationship with the terms and conditions. This agreement takes precedence for specific instructions, security and personal data obligations. For Klox's and the customer's own contractual claims for damages against each other, article 8 of the terms and conditions applies, including the special data cap and the exceptions stated there. The rights of data subjects and supervisory authorities and the statutory recourse expressly preserved there are not limited. An update of the privacy policy does not automatically amend this agreement. Substantive amendments are agreed in writing or electronically, in addition to the procedure accepted in advance for sub-processors and equivalent technical measures.

This instruction applies when the customer uses the sickness absence type in the absence module and does not record any other written instruction.

• Permitted data: the sickness absence type, the period (including half a day) and the status of the request. No reason, diagnosis, medical certificate or other medical information. An optional comment contains no health information.
• Purpose: the employment-law and payroll administration of absences, such as processing guaranteed salary and correctly compiling the working-time register.
• Exception under article 9 GDPR: article 9(2)(b) (obligations and rights in the field of employment and social security law).
• Authorised roles: the employee concerned, the owner and HR administrators of the customer, and managers with viewing rights for that employee. They are bound to confidentiality by their employment contract or another duty of confidentiality; the customer ensures this.
• Retention period and starting point: the same period as the underlying time records (point 9.1), calculated from the last day of the absence, unless the customer has a shorter period recorded.

For questions about this agreement: privacy@klox.be. Last updated: 11/10/2026.