Privacy Policy

Klox is a working-time registration service provided by Klox BV, Sint-Amandsesteenweg 268, 2880 Bornem, Belgium, company number 1043.296.663, RPR Antwerpen, afdeling Mechelen (VAT BE 1043.296.663). For questions about this Policy, you can reach us at privacy@klox.be.

For employee data that Klox processes on behalf of an employer, the employer is the controller and Klox the processor. This also covers the related user accounts, sessions, time records and audit data within the employer environment. That relationship applies from the first processing, including during a trial, and is set out in the data processing agreement. This Policy concerns our own website, contact and demo requests, registrations that have not yet been completed, and customer, contract, support and billing administration. The same business contact person may appear in our own administration for those separate purposes.

Contact and demo requests. We process your name, email address, the content of your question and, if you provide them, your company name, sector and number of employees. We use that data to answer your question and to follow up on the requested demo or quotation. If you are yourself the potential contracting party, we do this to take steps at your request prior to entering into a contract. If you act on behalf of an organisation, we rely on our legitimate interest in handling business requests and assessing a potential customer relationship.

When you start registering. We process your email address and what you fill in afterwards: your name, your company details (name, VAT or company number, address), the number of employees, the sector and, if you wish, your telephone number, plus the page or campaign through which you arrived. We only store your password once your account exists. We use that data so that you can later continue where you left off, and to send you at most two reminders if you do not complete: the first after about an hour, the second a day later, without promotions. If you gave a telephone number, we may also call you to help you get started. We do this to take steps at your request prior to entering into a contract and on the basis of our legitimate interest in helping to complete a registration that has been started. Every reminder contains a link to stop receiving reminders. We never upload your email address or telephone number to advertising platforms.

Business administration and support. We process name and business contact details, organisation and order details, necessary correspondence, billing details, payment references and payment status in order to perform contracts, provide support, collect payments and keep our records. For a natural person who is a customer themselves, the legal basis is the performance of the contract. For contact persons of an organisation, it is our legitimate interest in managing the relationship. Statutory tax and accounting processing is based on a legal obligation. For the necessary retention of evidence and the handling of disputes, we rely on our legitimate interest in establishing, exercising or defending our rights.

Promotional messages. A demo request or a registration is not a newsletter subscription. We ask for consent for separate promotional emails. Only in the context of an existing customer relationship may we, without that separate consent, propose our own similar services to an email address we received in the context of a sale, provided that a simple, free opt-out is offered at the time of collection and with every message. If you object or opt out, we stop that marketing. Ordinary replies to your question, the reminders for a registration that has been started and necessary service messages are not a newsletter.

Security. Our website and own administration process necessary technical data, such as IP address, time and security events, for access security, abuse prevention and the investigation of malfunctions. If you report a vulnerability, we process your name, email address and report in order to handle it. The legal basis is our legitimate interest in a secure service. Logs that Klox keeps exclusively for the employer environment are governed by the data processing agreement. Website statistics with Google Analytics are based on consent, as set out in point 6.

We obtain this data from you or, for business contact details, from your organisation or an authorised colleague. Where data is obtained indirectly, we inform you no later than at the first contact, or earlier where the statutory deadline so requires. Your name, contact and order details are necessary to handle your request or order. Company profile details for a demo, your telephone number and consent to marketing are optional. Within the processing operations of our own described here, Klox does not take any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

The primary application and database of the service are hosted in a data centre in Germany. For the processing of employee data, the data location and transfer arrangements in the data processing agreement apply. For our own website, email, administration and payments, we also use the service providers listed in point 5. Their processing locations do not automatically coincide with the location of our database.

Google Analytics may, after consent, process website data outside the European Economic Area, including in the United States. Our contracting party for Google Analytics is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited may transfer the data to Google LLC in the United States and to other Google entities and sub-processors, including outside the European Economic Area. The transfer to Google LLC is covered by the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, under which Google LLC is certified. For other recipients outside the European Economic Area, the European Commission's standard contractual clauses incorporated in Google's data processing terms apply. You can request information about these safeguards and a copy of them via privacy@klox.be. Confidential parts may be redacted without making the safeguard unverifiable.

Contact and demo requests that do not lead to a customer relationship are, in principle, deleted twelve months after the last substantive contact. A registration that you do not complete is erased after thirty days; if you do complete it, it becomes part of your account. We use marketing data until you opt out or object. After that, we keep only the minimum information needed to respect that choice and, where necessary, to demonstrate earlier consent. That limited record is no longer used for promotion.

We keep business contact and support data for the duration of the customer relationship. Afterwards, we delete data that is no longer needed from the operational administration. A limited contract and evidence file may be kept for as long as a legal claim can be brought or handled, with a periodic review of necessity. We keep tax and accounting documents in accordance with the applicable statutory period and the starting point for that document. Specifically: sales invoices and VAT documents for ten years from 1 January of the year following their date; the limited contract file until ten years after the end of the agreement, the ordinary limitation period for contractual claims. This retention does not automatically cover all support content or the employee data from the service.

We keep our own technical security logs for a maximum of ninety days, unless a specific incident or dispute requires a targeted longer retention. For employee data, the employer determines a lawful retention period per category. The default for time records is sixty months, with an appropriate starting point and the lawful deviations from the data processing agreement. This is not a minimum for all accounts, session logs or leave details, nor a guarantee that data will remain available free of charge for five years after the subscription.

After the end of a paid subscription, there is normally a thirty-day export period, followed by deletion from the active systems within thirty days at the latest and phasing out of remaining backups no later than thirty days after that. After a trial that has not been activated, there is first a ninety-day period for export or reactivation. The overall maximums are therefore normally ninety and one hundred and fifty days respectively after the end. A lawful earlier deletion instruction, a statutory retention obligation of Klox itself or an applicable switching arrangement may change this process as described in the data processing agreement.

We do not sell your personal data. We use Hostinger for hosting, Brevo for email and Mollie for payments. For website statistics, we use Google Analytics only after consent. In each case, we share the data necessary for the purpose concerned. Service providers that work on our behalf are bound by appropriate processing arrangements. The exact recipients and transfers are listed in point 3 and point 6.

Mollie determines its own purposes and statutory obligations for its payment services and acts as a separate controller for them. Payment of a Klox subscription does not make Mollie a sub-processor of employee data. Our accountant, legal advisers and competent authorities may also receive necessary data for their assignment or a specific legal obligation.

Cloudflare provides only the DNS service for klox.be. In that configuration, Cloudflare does not sit as a proxy between the visitor and our application server and does not receive the content of the application requests. In a DNS lookup, Cloudflare receives only the technical data of that lookup, such as the name requested and the IP address of the DNS server performing the lookup. The current sub-processors of the employer environment are listed in the data processing agreement.

We use strictly necessary cookies to make requested features work and to remember your cookie choice. We use Google Analytics 4 to measure website visits, but only with your prior consent. Analytics tags and cookies remain blocked for as long as you have not consented. If you refuse or withdraw consent, we do not send any Analytics measurements to Google. We do not use advertising cookies.

After consent, Analytics processes visit and event data, such as pages visited, time, browser and device information and cookie identifiers. Google may technically receive the IP address with the network request. We do not send names, email addresses or employee data from the employer environment. The specific recipients and transfer safeguard are listed in point 3. Refusing does not prevent you from using our website. Accepting and refusing are offered equally easily.

We store your choice in the necessary cookie klox_consent. You can change that choice at any time via Cookie preferences at the bottom of the page. Withdrawing is as easy as giving consent and does not affect the lawfulness of the earlier processing. On withdrawal, we delete the Analytics cookies from our website.

Overview of the cookies on klox.be:

• klox_consent. Issuer: Klox. Content and purpose: to remember your cookie choice (accepted or refused). Lifetime: 180 days. Strictly necessary.
• klox_ft. Issuer: Klox. Content and purpose: through which campaign, which referring website and on which page you first arrived, without any code that identifies you. We read it only if you start registering yourself, to know which channels work; it is never passed to a third party. Lifetime: 90 days. Only after consent.
• _ga and _ga_ followed by a code. Issuer: Google (Google Analytics 4), set on klox.be. Content and purpose: a random identifier to count visits and show how the website is used. Lifetime: two years. Only after consent. Google retains the event data in accordance with the retention period we set in Google Analytics, at most fourteen months.

In the app (app.klox.be and your organisation's subdomain), we use only strictly necessary and functional cookies from Klox itself: klox_web_session (your login, httpOnly, until you log out or the session expires after 30 days), klox_locale (your language choice, one year) and a few cookies that remember that you closed a notice or card in the app (klox_trialbar_weg until the end of the trial, klox_upgrade_nudge_ and klox_heard_from_ followed by a code, 7 and 30 days, klox_tip_shown and klox_tip_dismissed, 7 and 30 days). The app does not use analytics or advertising cookies.

You can request access to, rectification, erasure and restriction of your personal data under the conditions of the GDPR. Portability applies to data you have provided and that we process by automated means on the basis of consent or a contract. Where processing is based on legitimate interest, you may object on grounds relating to your particular situation. You can always object to direct marketing, without giving a particular reason. You can withdraw your consent at any time without affecting earlier lawful processing.

Send your request to privacy@klox.be. In principle, we respond free of charge within one month of receipt. For complex or numerous requests, this may be extended by up to two months. We notify you of the extension and the reason within the first month. Only where there is reasonable doubt about your identity do we ask for appropriate additional information. A statutory retention obligation or the need for a legal claim may limit erasure. For data we process for your employer, we forward a request received directly to the employer and support its handling.

You can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, via www.dataprotectionauthority.be, or with another competent supervisory authority, in particular where you habitually reside, work or where the alleged infringement took place. You retain the right to bring proceedings before a competent court. Prior contact with Klox is not required for this.

We amend this Policy when our processing operations or the applicable rules change. The version and date are shown on this page. We inform data subjects appropriately about material changes before the changed processing. A policy change is not consent and does not in itself change the arrangements with a customer. Where a new processing operation requires consent, we ask for it separately.

Last updated: 11/10/2026.