KLOKUP

Privacy policy

Effective November 1, 2026.

Who we are

KLOKUP is a time clock service provided by Sak Pase Solutions Inc., Ottawa, Ontario, Canada. This policy explains what personal information we collect, why, where it is stored, how long we keep it and how you can exercise your rights. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Person in charge of privacy

The person in charge of the protection of personal information at Sak Pase Solutions Inc. answers every question and request about your information. Write to them through the contact form, subject “Privacy and my data”.

Two roles

For the accounts of businesses and their managers, Sak Pase Solutions Inc. is responsible for the information. For employees' information, the employer that uses KLOKUP is responsible: we process it on the employer's behalf and only to provide the service. Employees should send their requests to their employer first; we help the employer answer.

What we collect

Account: name, email address, password (stored only as an irreversible hash), business name, phone number if given, country, time zone and language.
Employees, as entered by the employer: name, role, phone, email, hourly rate, hire date, language and a personal PIN.
Each clock-in: date and time, type (arrival, break, return, departure), the IP address and a random identifier stored in the phone's browser. If the employer turns on the GPS zone, the phone's position and its accuracy, read only at the moment of clocking in, never in the background.
Schedules, absences, leave balances, requests and the history of every correction, with who made it and why.
Messages sent through the contact form.
Payment: handled by Stripe. KLOKUP never sees or stores card numbers; we keep the plan, amounts and dates.

Why we use it

Only to provide and secure the service: record clock-ins, calculate hours, overtime, leave and labor cost, prevent fraud (one phone per person, GPS zone, refused attempts), send service emails (welcome, reminders, alerts, weekly hours), bill paid plans and answer your messages. We do not sell personal information, we do not use it for advertising and we do not build profiles.

Consent

The business consents when it creates its account. The employer informs its employees that it uses KLOKUP and, if it turns on the GPS zone, that their position is checked when they clock in. If an employee is under 14, the employer obtains the consent of the person with parental authority. You can withdraw your consent at any time; the service then stops for you.

Who else processes it, and where

We use service providers bound by contract to protect the information and to use it only for us: Supabase (database and sign-in, servers in the United States, region us-east-1), Vercel (website hosting), Resend (sending emails) and Stripe (payments). Your information is therefore stored and processed outside Quebec and outside Canada, mainly in the United States, where it may be accessible to authorities under local laws. Before such transfers, we assess the protection they offer, as Law 25 requires.

How long we keep it

Clock-ins, timesheets and history: as long as the employer's account is active, because the employer needs them for payroll and its legal obligations. The employer can archive an employee at any time.
Wrong PIN attempts: erased after 24 hours.
When an account is closed, its information is deleted within 30 days, except what the law requires us to keep (for example, billing records).

How we protect it

Encrypted connections (HTTPS) everywhere; access limited by role in the database, so each business sees only its own data and each employee only their own, with their PIN; passwords stored as irreversible hashes; wrong PINs limited per connection; a history of every change. Only the people who need it to run the service can access the information.

Your rights

You can ask to see the information we hold about you, have it corrected, receive it in a structured, commonly used format, have it deleted, or withdraw your consent. Write to us through the contact form, subject “Privacy and my data”. We answer within 30 days. If you are not satisfied, you can file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Privacy incidents

If an incident creates a risk of serious harm, we notify the people concerned and the competent authorities (the Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada) promptly, and we keep a register of incidents.

Cookies and storage in your browser

KLOKUP uses no advertising or tracking cookies. Your browser keeps only what the service needs: your sign-in session, your language and, on the clock-in page, the random phone identifier used against fraud.

Changes

We will post any change to this policy on this page, with its new date, and tell account holders by email when the change is significant.

Write to the person in charge of privacy