Privacy Policy

Who we are

Kraze is operated by novalogica, a Portuguese company ("novalogica", "we", "us"). novalogica is the data controller for the personal data described in this policy, unless stated otherwise below.

You can reach us at contacto@novalogica.pt for general enquiries, or at suporte@novalogica.pt for support and account-related requests.

Scope of this policy

This policy covers the kraze.pt marketing website and the Kraze application (including any customer-specific subdomain, such as [company].kraze.pt). It does not cover third-party websites or services that Kraze may link to.

Kraze is business-to-business software. Organizations that subscribe to Kraze ("customers") use it to manage their own employees, contractors and workspace members ("end users"). Where a customer inputs personal data about its end users into Kraze, that data is processed as described in the section "Our role: controller and processor" below.

Information we process

Depending on how Kraze is used, we process the following categories of personal data:

• Account and organization data: name, work email, phone number, job title, company name and billing details for administrators and account owners.
• Employee and workspace data: names, contact details, department, role, employment dates, and other HR records that a customer organization stores in Kraze to manage its people.
• Time and attendance data: timesheets, time entries, project and task assignments, and leave or absence records submitted through the platform.
• Usage and technical data: log data, device and browser information, IP address, and analytics events generated while using kraze.pt or the Kraze application.
• Communications: messages sent to our support or contact addresses, and any information you choose to include in them.

How we use this information

We use personal data to:

• Provide, operate and maintain the Kraze platform and its features (time tracking, leave management, people management and related modules);
• Create and administer accounts, workspaces and organizations, and authenticate sign-in;
• Respond to support requests and communicate about the service, including maintenance and security notices;
• Monitor, secure and improve the platform, including detecting and preventing abuse;
• Comply with legal obligations, such as tax, accounting and employment-related record-keeping that a customer organization may be subject to.

Legal basis for processing

Where the GDPR applies, we rely on one or more of the following legal bases, depending on the processing activity: performance of a contract with you or with the organization you belong to; our legitimate interests in operating, securing and improving the service; compliance with a legal obligation; and, where applicable, your consent (for example, for optional cookies or marketing communications, which you can withdraw at any time).

Our role: controller and processor

For account, billing and website-visitor data, novalogica acts as the data controller.

For employee and workspace data that a customer organization enters into Kraze to manage its own people (such as timesheets, leave records or employee profiles), the customer organization is generally the data controller, and novalogica acts as a data processor, processing that data only on the customer's instructions and for the purpose of providing the service. If you are an employee of a Kraze customer and have questions about how your data is used, please contact your employer in the first instance.

Data hosting and security

Kraze data is hosted on infrastructure located in the European Union. We use encryption in transit (TLS 1.3) and encryption at rest (AES-256) for data stored on our platform, together with access controls and organization-level data isolation.

No system can be guaranteed to be completely secure. We work to apply appropriate technical and organizational measures proportionate to the risk, and we review them periodically.

Data retention

We retain personal data for as long as needed to provide the service to the relevant organization, and afterwards for as long as required to meet legal, accounting or dispute-resolution obligations. When a customer's subscription ends, we retain their data for a limited period to allow export or reactivation, after which it is deleted or anonymized, unless a longer retention period is required by law or agreed with the customer.

Sharing and sub-processors

We do not sell personal data. We may share personal data with:

• Service providers that support the operation of Kraze, such as cloud hosting, email delivery and analytics providers, acting under contractual confidentiality and data-protection obligations;
• Professional advisers, auditors or authorities, where required by law or to establish, exercise or defend legal claims;
• A successor entity in the event of a merger, acquisition or asset transfer, subject to the same commitments described in this policy.

International data transfers

Kraze's core hosting infrastructure is located in the European Union. Where a specific service provider we use processes data outside the European Economic Area, we take steps intended to ensure that data receives an equivalent level of protection, such as relying on providers subject to appropriate legal safeguards.

Your rights under the GDPR

If the GDPR applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Request that inaccurate or incomplete data be corrected;
• Request erasure of your personal data, subject to legal and contractual limitations;
• Request restriction of, or object to, certain processing;
• Receive your data in a portable format, where applicable;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with your national data protection authority (in Portugal, the Comissão Nacional de Proteção de Dados, www.cnpd.pt).

If you are an employee or member of a Kraze customer organization, we recommend contacting that organization first, as it is usually best placed to action your request; you may also contact us directly at contacto@novalogica.pt.

Cookies and similar technologies

kraze.pt and the Kraze application use cookies and similar technologies that are strictly necessary for core functionality, such as keeping you signed in and remembering your language and display preferences. We do not currently use non-essential analytics or advertising cookies on kraze.pt; if that changes, we will update this policy and provide a way to manage your preferences.

Children

Kraze is intended for business use by working-age adults and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time to reflect changes to our services or legal requirements. We will update the date at the top of this page when we do, and, for material changes, we will take reasonable steps to notify affected customers.

Contact us

For questions about this policy or to exercise your data protection rights, contact us using the details below.

• Data requests: contacto@novalogica.pt
• Support: suporte@novalogica.pt