Privacy Statement
TIKKIT — how we handle personal data
This statement explains which personal data we process, why, for how long, and which rights you have in that regard.
1. Who we are, and in what capacity
TIKKIT is a software application for the registration and the declaration of working time, operated by Forganiser NV, Namenstraat 13-15, 2000 Antwerpen, Belgium, enterprise number BE0634.966.453.
We process personal data in two different capacities, and which rights you can exercise with us depends on that.
A. We are the controller for the data of visitors to our website, of persons who use our contact form or send us an e-mail, of contact persons at undertakings that register or take out a subscription, and of contact persons at undertakings that we approach as a potential customer. For those data we determine the purpose and the means ourselves, and you can exercise your rights directly with us.
B. We are the processor for all data which an employer enters into the platform about its staff: identity data, hours worked, absences, overtime, rosters and everything else that is in that employer's workspace.
Are you an employee, and do you use TIKKIT because your employer has chosen to do so? Then your employer is the controller, not us. We process your data solely at the request of your employer and in accordance with its instructions. If you wish to know which data about you are kept, to have them corrected, or to object, please address your employer. Should we nevertheless receive such a request directly, we pass it on to your employer and give it the assistance it needs in order to answer you. We may not modify or delete your data on our own initiative.
2. Which data we process as controller
| What | For what purpose | Legal basis | For how long |
|---|---|---|---|
| Name, e-mail address, telephone number, undertaking, enterprise number, VAT number, billing address | Management of the registration, the subscription and the invoicing; support | Performance of the agreement (art. 6.1.b GDPR) | Duration of the agreement; accounting records 7 years |
| Acceptance of our conditions: which version, in which language, at what moment, from which IP address | Proof that conditions were accepted, and which | Legitimate interest (art. 6.1.f GDPR) — proof of the contractual relationship | Duration of the agreement + the statutory limitation period |
| Content of the contact form or of your e-mail, and the moment of your consent | Handling and following up your question | Consent (art. 6.1.a GDPR) | 2 years after the last contact |
| Business contact details of undertakings that we approach as a potential customer | Commercial prospecting between undertakings | Legitimate interest (art. 6.1.f GDPR) | 2 years after the last contact, or immediately upon objection |
| Whether and when a commercial e-mail sent by us was opened | Measuring whether our messages arrive and are relevant | Legitimate interest (art. 6.1.f GDPR) | 12 months |
| Technical log files of the web server, including the IP address | Security, error tracing, combating misuse | Legitimate interest (art. 6.1.f GDPR) | 90 days |
You may object at any time, via privacy@forganiser.com, to the processing operations that rest on our legitimate interest — including the prospecting and the measuring of e-mail openings. We then stop that processing immediately.
3. Which data your employer enters, and which we handle as processor
For the sake of completeness, and so that employers can pass this statement on to their staff. Your employer determines which of these functions it uses.
| Category | Source | Retention period |
|---|---|---|
| Identity: first name, surname, staff number, e-mail address, telephone number, language | Entered by the employer or completed by the staff member | For as long as the staff member is active + 5 years after deactivation |
| Password (hashed with bcrypt; irreversible and never readable, not even by us) | The staff member | For as long as the account exists |
| Two-step verification, where activated by the staff member: the shared key encrypted with AES-256-GCM and the hash values of ten recovery codes. No device identification, no telephone number, no biometrics | The staff member | Until the verification is switched off; is deleted together with the account |
| Working time: clock-in and clock-out moments, breaks, totals | The staff member in real time, plus corrections by a responsible person | See article 5 |
| Overtime, absence requests and correction requests, with their approval | The staff member + a responsible person | See article 5 |
| Assignment to roster, department and establishment | The employer or a responsible person | For as long as the assignment applies |
| Log of all changes: who, when, from which IP address, which value before and after | Automatically upon every change | Appended only, never modified; not deleted automatically |
| Subscriptions for push notifications | The staff member, by their own choice | Until the notifications are switched off |
| Conversations with the built-in assistant | The staff member, when the assistant is used | 90 days, then permanently deleted |
| Data for social security declarations (Dimona, Checkinatwork), including the national register number | The employer, when it uses those functions | For as long as the statutory retention obligation of the employer runs |
| Optional, and only where your employer switches that function on: one location point of the device at the moment of a clock-in or clock-out — or the finding that the device refused the location | Your browser, after your consent on the device | Is deleted together with the working-time registration |
What we expressly do not do: we collect no biometric data, no continuous or background location, no behavioural data, and we build no profiles. Where the location function is switched on, it concerns one point at the moment of a registration — never a movement trail. If you refuse the location on your device, that refusal is recorded only as a status and your registration is never blocked.
The registration of working time itself rests on a legal obligation of the employer, and not on the consent of the staff member. A staff member can therefore not object to it and cannot request its erasure for as long as the statutory retention period runs. The log of changes rests on the same basis: a registration that can be altered afterwards without anyone noticing is not a reliable registration.
4. Who receives data
Within the organisation of your employer. Responsible persons and the employer see the data of the staff members within their remit. The employee representative, where your employer assigns that role, receives exclusively aggregated, anonymised figures. The social inspectorate receives, upon its request and via a separate access, the complete, unaltered history; that is a legal obligation of your employer.
Our service providers (sub-processors). Each of them is contractually bound to equivalent obligations and may use the data solely in order to deliver the service to us.
| Service provider | For what purpose | Which data | Where |
|---|---|---|---|
| OVH | Hosting, database, back-ups, file storage | All data in the platform | European Union |
| Microsoft (365 / Graph) | Sending our e-mails | Name and e-mail address of the recipient and the content of the message | European Union |
| Spryng (Esendex) | Sending SMS messages | Mobile number and the text of the message | Belgium |
| Stripe | Payments, subscriptions, VAT calculation | Data of the customer undertaking and the number of users. No names of staff members. Card details never reach our servers | European Union / United States |
| Recommand | Sending our invoices via the Peppol network | Invoice data only: party names, addresses, VAT and enterprise numbers, amounts | Belgium |
| Anthropic | The built-in assistant | Data from the workspace, including names, hours, absences and the content of messages, in so far as the user asks a question about them | United States |
| National Social Security Office | Dimona declarations and presence registrations | Identity data of the declared employee | Belgium (government) |
| European Commission (VIES) | Verification of VAT numbers | The VAT number of the undertaking | European Union |
For our own marketing blog we use a service for generating images. No customer data go there. We never sell personal data.
5. How long we keep data
For the working-time data we work with three windows, which are technically automated:
| Period from the registration | What happens |
|---|---|
| Year 0 to 5 | The data are kept in full. This is the statutory window |
| Year 5 to 10 | The free-text fields (notes, project) are erased. Times, totals and identification numbers remain, so that aggregated figures continue to work |
| From year 10 | Working-time registrations, absences and correction requests are permanently deleted |
Deviating periods: the log of changes is not deleted automatically, because it may be needed in the event of a dispute or an inspection. Conversations with the assistant are deleted after 90 days; where a user deletes a conversation themselves, that is definitive after 7 days. Location points are deleted together with the working-time registration to which they belong and therefore never live longer than it. Identity data of a staff member are kept until 5 years after deactivation. Accounting records 7 years, by law.
Upon the end of your employer's subscription the complete data export remains available for thirty (30) calendar days; we remind the employer thereof by e-mail. Thereafter the data are deleted or anonymised, save for what we are legally required to keep for longer. The statutory retention obligation for the working-time registration remains with the employer: it is for the employer to make an export in good time.
6. Transfers outside the European Economic Area
Two data flows leave the EEA:
- Anthropic (United States), for the built-in assistant. Where a user asks it a question, the information that is needed in order to answer that question is sent to that service — that may be names, hours, absences or messages. The transfer rests on the standard contractual clauses of the European Commission in accordance with Chapter V GDPR. The conversations are permanently deleted at our end after 90 days and the data are not used to train third-party models.
- Voice input via your browser. If you use the speech function of the assistant, this takes place via the speech functions of your browser. In Chrome and Edge that browser sends your audio to Google for the conversion into text; Safari does this locally on the device. We ourselves do not receive, store or send any audio — that flow runs directly between your browser and the supplier of that browser. If you do not wish your audio to leave your device, use the keyboard input or Safari.
In addition, Stripe may process data outside the EEA for the payment processing, on the basis of its own safeguards in accordance with Chapter V GDPR.
The assistant does not take decisions about staff. No decision-making based solely on automated processing within the meaning of article 22 GDPR takes place. Every action takes place within the rights of the user asking the question, and on that user's instruction.
7. How we secure the data
- In transit: all connections to the platform and to the database are encrypted (TLS).
- At rest: encryption of the database at the level of the hosting infrastructure.
- Passwords: hashed with bcrypt. A hash is irreversible: we cannot see or retrieve your password.
- Two-step verification: optional. The shared key is encrypted with AES-256-GCM under a master key that exists only in the server environment and is not held in the database; of the recovery codes we keep only hash values. A copy of the database alone therefore does not yield a working second factor, and the recovery codes cannot be recovered by anybody — not even by us.
- Logins: limited per user and per IP address, with an additional limit on the web server itself.
- Access control: every action in the platform is checked against the rights of the user before it is carried out.
- Log: every change is recorded with the user, the moment, the IP address and the value before and after.
One accuracy caveat, which we mention deliberately. IP addresses that were recorded in our log before 6 August 2026 were read from a request header that could be filled in by the sending party itself. Those historical IP addresses can therefore not be used as proof of the origin of a request. Addresses that were recorded thereafter come from the last network hop that our own infrastructure observes. Every access request or security investigation concerning the earlier period must take this caveat into account.
8. Your rights
Are you an employee, and does it concern data that your employer entered into the platform? Then please address your employer — see article 1.
For the data in respect of which we are the controller, you have the right of access (art. 15), rectification (art. 16), erasure (art. 17, in so far as no statutory retention obligation stands in the way), restriction (art. 18), portability (art. 20) and objection (art. 21 — and always against direct marketing). Where a processing operation rests on your consent, you may withdraw that consent at any time, without consequence for what happened before.
For the working-time registration itself, the limitation set out in article 3 applies: it rests on a legal obligation.
How to exercise them. Send your request to privacy@forganiser.com. We answer within one month. We may ask you for proof of identity where we have reasonable doubt, solely in order to avoid providing your data to somebody else.
What the platform already offers you itself. A staff member can amend their own profile data, export their own working-time data, propose a correction for a registration that is not correct, and switch off their push notifications themselves.
Complaint. You may at any time lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels — www.gegevensbeschermingsautoriteit.be. We kindly ask you to contact us first, so that we can resolve the matter.
9. Cookies
The platform and our website use exclusively strictly necessary cookies. We place no analytics, advertising or social media cookies. See our separate cookie statement for the complete list.
10. Changes to this statement
We adapt this statement whenever the platform or the service providers engaged change. In the event of a material change we inform our customers by e-mail, at least thirty calendar days before the change takes effect. The version and the date are stated at the top of this page.