Privacy Policy

1. Introduction

ICTORA ("we", "our", or "us") is committed to protecting your privacy and handling personal data transparently and securely.

This Privacy Policy explains how we collect, use, process, disclose, and safeguard information when you use the ICTORA workforce management and time tracking platform.

2. Information We Collect

2.1 Information You Provide

When you create an account, use our services, or contact us, we may collect:

  • Name, email address, and phone number
  • Company name, role, and work-related details
  • Payment and billing information
  • Employee and workforce-related data uploaded or managed by employer accounts, including attendance records, schedules, absences, and compliance documents
  • Communications and support requests sent to us

2.2 Information Collected Automatically

When you access our platform, we may automatically collect:

  • Device information (browser type, operating system, device identifiers)
  • IP address and approximate geographic location
  • Usage data (pages visited, features used, timestamps, session activity)
  • Cookies and similar technologies

3. How We Use Your Information

We process your information to:

  • Provide, maintain, and improve our services
  • Process transactions and manage subscriptions
  • Communicate with you regarding updates, support, and service-related notices
  • Provide workforce management and compliance functionality
  • Detect, prevent, and address technical, fraud, or security issues
  • Monitor platform performance and reliability
  • Comply with applicable legal obligations

4. Legal Basis for Processing (GDPR)

Under GDPR, we process personal data on the following legal bases:

  • Contract — to provide the services requested by customers
  • Consent — where explicit consent has been provided
  • Legal obligation — to comply with applicable laws and regulations
  • Legitimate interest — for platform security, fraud prevention, analytics, and service improvement

5. Data Controller & Data Processor Roles

When employer accounts use ICTORA to manage employee data, the employer acts as the Data Controller and ICTORA acts as the Data Processor under GDPR.

Employers are responsible for:

  • Ensuring they have a lawful basis for processing employee data
  • Informing employees appropriately
  • Managing their own internal compliance obligations

ICTORA processes workforce-related data solely on behalf of employer accounts and in accordance with applicable agreements and instructions.

6. Workforce & Compliance Data

Certain workforce-related information uploaded by employer accounts may contain employment-related or sensitive data, including:

  • Absence records
  • Workforce compliance records
  • Medical certificates
  • Labour regulation documents
  • Employment contracts

ICTORA processes such information solely for workforce administration and compliance functionality provided through the platform.

7. Sharing Your Information

We do not sell personal data.

We may share information with trusted third-party providers who support the operation of our platform, including:

  • Hosting and cloud infrastructure providers
  • Payment processors
  • Security and monitoring providers
  • Analytics and communication providers

We may also disclose information:

  • When required by law
  • To protect our legal rights
  • In connection with a merger, acquisition, restructuring, or asset sale

8. Service Providers & Infrastructure

ICTORA uses third-party infrastructure and service providers that may process data on our behalf under GDPR-compliant contractual safeguards and applicable data processing terms.

Current providers may include:

  • Amazon Web Services (AWS) — hosting and infrastructure
  • Airwallex — payment processing and billing services

These providers may process limited personal data as necessary to deliver their services securely and reliably.

9. Data Retention

We retain personal data only as long as necessary to:

  • Provide our services
  • Fulfill contractual obligations
  • Comply with legal obligations
  • Resolve disputes
  • Enforce agreements

Workforce and compliance records may be retained in accordance with applicable labor law requirements.

10. Your Rights

Under GDPR, individuals may have the right to:

  • Access their personal data
  • Request correction of inaccurate information
  • Request deletion of personal data
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent where applicable
  • Lodge a complaint with the Belgian Data Protection Authority (APD/GBA)

11. Security

ICTORA implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction.

While we implement industry-standard security measures, no electronic transmission or storage system can be guaranteed to be 100% secure.

12. International Data Transfers

Data is primarily processed within the European Economic Area (EEA).

Where international transfers are necessary, ICTORA relies on appropriate safeguards such as:

  • Standard Contractual Clauses (SCCs)
  • GDPR-compliant provider agreements
  • Other legally recognized transfer mechanisms

13. Minors & Employment Data

ICTORA is intended for workforce management and employment-related administration.

Employer accounts are responsible for ensuring that any employee data processed through the platform complies with applicable labor laws and age-related employment regulations in their jurisdiction.

ICTORA does not knowingly collect personal data directly from minors outside the context of lawful workforce administration managed by employer accounts.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The “Last Updated” date indicates the latest revision. Material changes may be communicated through the platform or by email.

15. Contact Us

For questions regarding this Privacy Policy or personal data processing, please contact: privacy@ictora.com