Privacy Policy

1. Introduction

WorkApp ("we", "us", "our") is committed to protecting the privacy and personal data of our users. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our field team management platform, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and applicable Romanian data protection legislation (Law 190/2018).

By using WorkApp, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller for personal data processed through WorkApp is:

3. Categories of Personal Data Collected

We collect and process the following categories of personal data:

3.1 Account Data

• Full name, email address, phone number
• Company name and company identification data
• Password (stored encrypted using bcrypt hashing)
• Profile picture (optional)
• User role within the organization

3.2 Work Activity Data

• Daily activity reports and work hours
• Client assignments and project information
• Team assignments and organizational structure

3.3 Payment Data

• Subscription plan and billing cycle
• Payment transaction records (processed securely via Stripe)
• We do NOT store credit card numbers or CVV codes

3.4 Technical Data

• IP address, browser type, operating system
• Access timestamps and session data
• Device information for mobile access

4. Legal Basis for Processing

We process your personal data based on the following legal grounds (Art. 6 GDPR):

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our service, manage your account, and fulfill subscription obligations.
• Legitimate interest (Art. 6(1)(f)): Processing for analytics, service improvement, security monitoring, and fraud prevention.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with tax, accounting, and regulatory requirements.
• Consent (Art. 6(1)(a)): Where applicable, for marketing communications and optional features. You may withdraw consent at any time.

5. How We Use Your Data

• To provide and maintain the WorkApp platform and its features
• To manage your account, team structures, and company settings
• To process payments and manage subscriptions via Stripe
• To generate reports, analytics, and business insights for your company
• To send service notifications and critical updates
• To ensure platform security and prevent unauthorized access
• To comply with legal obligations and respond to lawful requests
• To improve our services through aggregated, anonymized analytics

6. Data Sharing and Third Parties

We share personal data only with the following categories of recipients, under appropriate safeguards:

• Stripe Inc. (Payment processing) - PCI DSS compliant. Privacy: stripe.com/privacy
• MongoDB Atlas (Database hosting) - Data encrypted at rest and in transit
• Google Cloud Platform (Cloud infrastructure and file storage) - ISO 27001 certified
• Cloudflare (CDN and DDoS protection) - SOC 2 Type II certified
• SendGrid (Email delivery) - For transactional emails only

We do NOT sell your personal data to third parties. All data processors are bound by data processing agreements (DPAs) in compliance with Art. 28 GDPR.

7. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). In such cases, we ensure adequate protection through:

• EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules of service providers

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy:

• Account data: Until account deletion or 2 years after last activity
• Work activity data: For the duration of the active subscription + 1 year
• Payment records: 10 years (as required by Romanian fiscal legislation)
• Technical logs: 90 days for security purposes

9. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Correct inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restriction (Art. 18): Restrict the processing of your data
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interest
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at office@workapp.ro. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Password hashing with bcrypt
• JWT-based authentication with token expiration
• Optional Two-Factor Authentication (2FA) via Google Authenticator
• HTTPS/TLS encryption for all data in transit
• Database encryption at rest (MongoDB Atlas)
• Rate limiting and brute force protection
• Regular security audits and monitoring

11. Cookies

WorkApp uses essential cookies and local storage to maintain your session and preferences. We do not use third-party tracking cookies or advertising cookies. Essential cookies include:

• Authentication tokens (JWT stored in local storage)
• Language preferences
• Session management data

12. Children's Privacy

WorkApp is a B2B service designed for business use and is not directed at children under 16 years of age. We do not knowingly collect personal data from children.

13. Supervisory Authority

If you believe that the processing of your personal data infringes GDPR, you have the right to lodge a complaint with the Romanian Data Protection Authority:

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. Continued use of WorkApp after changes constitutes acceptance of the updated policy.

15. Contact Us

For any questions or concerns about this Privacy Policy or your personal data, please contact us: