KalendGO Privacy Policy

Last updated: 4.12.2025

1. Introduction

This Privacy Policy sets out the rules for processing personal data in connection with the use of the KalendGO platform, available at www.kalendgo.com and as mobile applications for iOS and Android.

KalendGO is a SaaS platform designed for managing work schedules, time tracking and HR and payroll settlements in organisations that employ shift workers.

Depending on the type of data and the relationship with the user, KalendGO may process personal data:

as the controller of personal data, or
as a processor of personal data on behalf of the employer (the KalendGO client).

We make every effort to ensure that personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and other applicable laws.

2. Controller of Personal Data

The controller of personal data is KalendGO, with its registered office in Jaworze, Tax ID (NIP) 9372776523, REGON 543350780.

Contact: biuro@kalendgo.com

3. Types of Data Collected

3.1. KalendGO as data controller

KalendGO is the controller of personal data in respect of the data of:

users representing clients (e.g. business owners, account administrators),

persons contacting KalendGO,

users, with regard to technical and statistical data,

candidates for employment / cooperation,

data processed for KalendGO's marketing and communication purposes.

3.2. KalendGO as processor

KalendGO processes the personal data of employees, contractors and other persons employed by the client solely as a processor, on the basis of a personal data processing agreement (Art. 28 GDPR).

4. Scope of data processed by KalendGO as controller

The controller of employees' personal data is their employer (the KalendGO client). KalendGO does not use employee data for its own purposes and processes it solely in accordance with the controller's instructions. If you are an employee or another person whose personal data is processed in connection with your employer's use of the KalendGO platform, any questions, demands or requests concerning the processing of your personal data (in particular concerning the exercise of rights under the GDPR) should be addressed directly to your employer, who is the controller of your personal data.

When the KalendGO mobile application is used and the employee activates the time-tracking function with geolocation verification, KalendGO processes data on the location of the user's mobile device (GPS data and network location data).

Location data is processed solely for the purpose of:

a) confirming the employee's presence at the place of work when starting and ending a work shift;

b) verifying whether the employee is at the location designated by the employer as the place of work.

KalendGO processes location data in accordance with the following rules:

a) the data is obtained only at the moment the employee actively uses the function to record the start or end of a work shift; the data is not collected continuously or in the background;

b) the data is stored on secure servers of the cloud infrastructure provider (Supabase) located within the European Union;

c) access to the employee's location data is held solely by the employer acting as the controller of the employee's personal data;

d) location data is not shared with third parties for marketing purposes or for any purposes other than those indicated above.

The employee is entitled to refuse access permissions to location data in the system settings of their mobile device and to withdraw them at any time. Failure to consent to the processing of location data may make it impossible to use the time-tracking function with geolocation verification.

With regard to the processing of employees' location data, KalendGO acts as a processor within the meaning of Art. 28 GDPR, acting on behalf of and on the basis of documented instructions from the employer, who is the controller of the employee's personal data.

5. Purposes of data processing (as controller)

KalendGO processes personal data as a controller for the following purposes:

concluding and performing the agreement for the use of the platform,
servicing user accounts,
communication relating to the operation of the platform,
handling requests and enquiries,
ensuring the security of the system,
analysing and improving the functionality of the platform, carrying out marketing activities (marketing communication is addressed solely to businesses and persons representing businesses, using business contact details),
conducting recruitment processes and taking steps towards establishing cooperation with candidates.

6. Recipients of Data

Personal data is processed on the basis of:

Art. 6(1)(b) GDPR – performance of a contract,
Art. 6(1)(c) GDPR – legal obligations,
Art. 6(1)(f) GDPR – the legitimate interest of KalendGO,
Art. 6(1)(a) GDPR – consent (where applicable).

Detailed information on the relationship between data categories, processing purposes and legal bases is presented in the table below.

Data categories, processing purposes and legal bases
Data category	Personal data	Purpose of processing	Legal basis (GDPR)
Identification and contact data of users	first name and surname, email address, phone number	Creating and servicing a user account, performance of the agreement for the use of the platform	Art. 6(1)(b)
Login and authentication data	login, password (in encrypted form)	Ensuring secure access to the platform	Art. 6(1)(b)
Communication data	content of correspondence, customer service requests	Contact with the user, handling enquiries and complaints	Art. 6(1)(b) or (f) (ensuring efficient communication and user support, and establishing, pursuing or defending claims)
Technical data	IP address, system logs, device data	Ensuring system security, preventing abuse	Art. 6(1)(f) (protection of the IT system and prevention of unauthorised access, and establishing, pursuing or defending claims)
Location data	GPS data and network location data of the employee's mobile device	Verification of the employee's presence at the place of work when recording the start and end of a work shift (processed on behalf of the employer, who is the controller of the employee's data)	Art. 28 GDPR – entrustment of processing; the legal basis for processing rests with the employer as the controller of the employee's personal data
Analytical data	statistical data concerning the use of the platform	Analysis and development of the platform's functionality	Art. 6(1)(f) (development and improvement of KalendGO services) or (a) (where required)
Marketing data	contact details, information about consents	Conducting KalendGO's marketing communication	Art. 6(1)(f) (promotion of KalendGO's own services)
Billing and accounting data	invoicing data, payment history	Fulfilment of accounting and tax obligations	Art. 6(1)(c)
Security-related data	security logs, system events	Detecting incidents and protection against abuse	Art. 6(1)(f) (ensuring business continuity and the security of the platform, and establishing, pursuing or defending claims)
Data of candidates for employment or cooperation	first name and surname, contact details, information contained in the CV and application documents	Conducting the recruitment process and taking steps towards concluding an agreement	Art. 6(1)(b) (steps prior to entering into a contract, and establishing, pursuing or defending claims)
Data of candidates for future recruitment purposes	contact details, CV	Including the candidate in future recruitment processes	Art. 6(1)(a) (the candidate's consent)

Providing personal data is voluntary, but in some cases it is necessary in order to conclude or perform the agreement for the use of the KalendGO platform. Failure to provide data may result in the inability to create an account or to use certain functionalities of the platform.

Personal data will not be used for automated decision-making, including profiling, in a manner producing legal effects for users.

7. Transfer of Data Outside the EEA

KalendGO receives personal data in the following ways:

directly from the user – in particular when registering an account, using the platform, contacting KalendGO by email, contact forms or other communication channels;
from the KalendGO client (the employer) – in respect of personal data entered into the platform by the client in connection with the use of KalendGO services, in particular data concerning account users and data processed on behalf of the employer;
automatically while using the platform – by recording technical data and information about user activity, such as IP address, system logs, device and browser information;
from third parties – to a limited extent, e.g. from providers of authentication, payment or communication services, if the user has used such functionality.

As a controller, KalendGO processes in particular:

7.1. Identification and contact data

first name and surname,
email address,
phone number,
login credentials (login, password in encrypted form),
identification and contact data of candidates for employment or cooperation provided as part of the recruitment process.

7.2. Communication data

the content of correspondence,
customer service requests,
contact history,
correspondence and information provided by candidates for employment or cooperation during the recruitment process.

7.3. Technical data

IP address,
device and browser data,
system logs and information about activity in the application.

8. Recipients of data

Data may be transferred to:

service providers and subcontractors cooperating with KalendGO (in particular providers of IT and cloud infrastructure, communication, analytics, bookkeeping, accounting, audit, legal, advisory, marketing and operational support services),
public authorities – where required by law.

9. Transfer of data outside the EEA

Where personal data is transferred outside the European Economic Area (EEA), KalendGO ensures that such transfer takes place only to countries for which the European Commission has confirmed an adequate level of personal data protection, or with the application of appropriate safeguards provided for in the GDPR, in particular standard contractual clauses approved by the European Commission.

10. Data retention period

The retention period for personal data depends on the purpose for which it is processed. KalendGO applies the following criteria for determining that period:

Performance of the contract and account servicing: data is processed for the term of the service agreement and, after its termination, for the period necessary to secure or pursue any claims (i.e. until the claims become time-barred under the provisions of the Civil Code) and to fulfil legal obligations (e.g. tax, accounting).
Technical purposes and security: technical data and system logs are stored for the time necessary to ensure IT security, manage the system and detect abuse, but no longer than until they cease to be useful for those purposes.
Marketing purposes: data is processed until consent is withdrawn or an effective objection is raised by the user.
Recruitment: data is stored until the end of the recruitment process and, where separate consent has been given for future recruitment, until that consent is withdrawn, but no longer than 2 years.
Data processed on behalf of the employer: the retention period follows from the processing agreement concluded with the Client and from its instructions.

11. Rights of data subjects

Persons whose data is processed by KalendGO as controller have the following rights under the GDPR:

Right of access to data – you have the right to obtain confirmation as to whether we process your personal data and to receive a copy of it together with information on how it is processed.
Right to rectification – you have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure (“right to be forgotten”) – in specific cases you may request the deletion of your personal data.
Right to restriction of processing – you have the right to request a temporary restriction of processing if you contest the accuracy or lawfulness of the data.
Right to data portability – you have the right to receive your personal data in a structured, commonly used format and to transfer it to another controller.
Right to object – you have the right to object to processing based on the legitimate interest of the controller.
Right to withdraw consent – if processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
Right to lodge a complaint with a supervisory authority – you have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) if you consider that the processing of data infringes the GDPR.

With regard to data processed on behalf of the employer, requests should be addressed directly to the employer as the data controller.

You may exercise any of these rights by contacting us by email at: biuro@kalendgo.com

We respond to requests concerning the exercise of the above rights without undue delay, and no later than within one month of receiving them. If, in the cases provided for by the GDPR, handling a request requires more time, this period may be extended by a further two months, of which we will inform you together with the reasons for the extension.

The exercise of data subjects' rights is in principle free of charge, unless a request is manifestly unfounded or excessive.

12. Data security

KalendGO applies appropriate technical and organisational measures to protect personal data, including encryption, access control and security monitoring.

13. Changes to the Privacy Policy

The Privacy Policy may be updated. Users will be informed of material changes via the platform or by email.