Privacy Policy

HyrDal (“we”, “us”) provides check-in and check-out software for teams. This policy explains what personal data we process, why, and the choices you have. It applies to this website, the HyrDal web dashboard and the HyrDal mobile app.

1. Who is responsible

For the website and for anyone who contacts us, HyrDal, based in Kosovo, is the data controller. For employee data inside the app, your employer is the controller and HyrDal processes that data on its behalf, as a processor, under a data processing agreement.

2. What we collect

• Account data: name, username, email, phone number, role, company, the managers you’re linked to and profile photo. If your company fills them in, also date of birth, gender, address, personal number, bank account (IBAN), pay rate, date joined and working time (full- or part-time). Passwords are stored only as a secure hash, never in readable form.
• Attendance data: check-in and check-out times, shifts and the notes and projects on them, working hours, time-off requests and decisions, days off per year and public holidays. Shifts recorded offline are marked as such, and shifts added or corrected by hand show who did it.
• Location data: only between check-in and check-out. During a shift the app records where the phone is about every five minutes, also when the app is closed, and stops when you check out. Admins and managers see your last position while you’re checked in and the route of each shift. On Android, positions from fake-location apps are flagged.
• Messages: chat messages you send to colleagues in the app.
• Technical data: login sessions, language preference and push notification tokens, used to keep you signed in, show HyrDal in your language and send you notifications.
• Company data: for the company account, details your admin enters, such as company name, contact person, billing email, registration and VAT numbers, offices, logo and photos.
• Contact data: what you send us through the contact form or by email.

3. Why we use it

• To provide the service your employer has signed up for (performance of a contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interest).
• To reply to questions and demo requests (legitimate interest or your consent).
• To meet legal obligations, such as accounting and record-keeping.

We never sell personal data and we do not use it for advertising.

4. Who we share it with

Your data is visible to people in your company according to their role: employees see their own records, managers see the workers linked to them and admins see the whole company. We use a small number of service providers who only process data on our instructions:

• our hosting provider, which stores the data and runs the service;
• Mailjet, which delivers emails such as password links;
• Expo, which delivers push notifications to phones;
• OpenFreeMap, which provides the map images in the app and dashboard. It receives the map area being viewed, not your location data.

We disclose data to authorities only when the law requires it.

5. How long we keep it

Attendance and account data is kept for as long as your company uses HyrDal, and deleted or returned when the contract ends, unless the law requires us to keep it longer. When someone is deactivated, they can no longer sign in, but their hours stay for payroll. Location points are deleted automatically after 12 months, and expired login sessions are removed. Contact requests are kept for up to 24 months.

6. Your rights

Under the GDPR and Kosovo’s Law on the Protection of Personal Data, you have the right to access, correct, delete, restrict or export your personal data, and to object to processing. For data inside the app, please contact your employer first; we will help them respond. You can also lodge a complaint with your data protection authority.

7. Deleting your account or data

You can ask for your HyrDal account and its data to be deleted at any time, whether you use the mobile app or the web dashboard:

• Email us at contact@hyrdal.com from the email address on your account, with the subject “Delete my account” and the name of your company. Or ask your company’s admin to request it for you.
• We confirm the request with you and let your employer know. If the law requires them to keep your working hours for payroll, they can export them first.
• We delete your account within 30 days and email you when it’s done.

What is deleted: your account and profile (name, username, email, phone number, photo, date of birth, gender, address, personal number, bank account and pay rate), your shifts and working hours, location points, time-off requests, login sessions and push notification tokens.

What is kept: messages you sent stay in your colleagues’ chats, shown as “Deleted account” instead of your name, and the company’s activity log notes that the account was deleted.

8. Security

We protect data with access controls by role, encrypted connections and separated company accounts. Passwords are hashed, login attempts are limited, and sessions expire after 90 days without use. You can sign out every other device at any time, and changing your password does it for you. No system is perfectly secure, but we work to protect your data and will notify affected companies of a breach as the law requires.

9. Cookies

See our Cookie Policy.

10. Contact

Questions about privacy? Email contact@hyrdal.com. We may update this policy from time to time and will change the date above when we do.