Data Privacy and Information Security

The GDPR (General Data Protection Regulation) is a new EU Regulation which will replace the 1995 EU Data Protection Directive (DPD). It is a law on data protection and privacy for all individuals within the European Union (EU). The GDPR aims primarily to give control back to individuals over their personal data and to simplify the regulatory environment. Being a regulation, not a directive, it forces all countries within EU to implement GDPR by May 25, 2018.

The regulation builds on many of the requirements from the 1995 directive for data privacy and security, but includes new provisions to strengthen the rights of data subjects, the individuals whose personal data is processed, and it adds harsher penalties for companies and organizations that fail to comply with the regulation.

Quinyx has its main establishment in Sweden and our lead supervisory authority is Datainspektionen.

Under the GDPR, you have certain rights related to the processing of your personal data. These are listed below.

Quinyx is in its capacity as data controller responsible for ensuring that your personal data is processed in accordance with applicable law and that your rights are taken into account when we process your personal data. If you want to use your rights, please contact us at dataprivacy@quinyx.com. You can also contact our DPO, which will be assigned as of 25th of May, at dpo@quinyx.com if you experience that Quinyx do not live up to your rights.

At Quinyx, we will take all reasonable and possible actions to notify any recipients of your personal data as set out in chapter 5 above regarding any rectification, erasure or restrictions carried out by us. At your request, we will also inform you of which third parties we have shared your personal data with.

You have the right to request access to personal data

You have the right to request an abstract from our data record regarding our use of your personal data. You also have the right to request a copy of the personal information being processed at no cost. However, we may charge you a reasonable administrative fee to provide you with additional copies of the personal data. If you make your access request by electronic means such as email, we will provide you with the information in a commonly used electronic format.

Contact: dataprivacy@quinyx.com

You have the right to request rectification of your personal data

We will at your request, or at our own initiative, rectify, anonymise, erase or complement personal data that you or we discover is inaccurate, incomplete or misleading. You also have the right to complement the personal data with additional data if relevant information is missing.

Contact: dataprivacy@quinyx.com

You have the right to request erasure of your personal data

You have the right to request that we erase your personal data if we do no longer have an acceptable reason for processing the data. Given this, erasure shall be made by us if:

• the personal data is no longer necessary for the purposes for which it was collected,
• you object to the processing of your personal data based on our legitimate interest and there is no overriding legitimate ground for the processing,
• the personal data has not been lawfully processed,
• we are required to erase the personal data due to a legal obligation, or
• you are a child and we have collected the personal data in relation to the offer of information society services.

However, there might be requirements under applicable law, or other weighty reasons, which entail in us not being able to immediately erase your personal data.  In such case, we will stop using your personal data for any other reasons than to comply with the applicable law, or the relevant weighty reason.

Contact: dataprivacy@quinyx.com

You have the right to restrict processing

This means that we temporarily restrict the processing of your personal data. You have the right to request restriction of the processing when:

• you have requested rectification of your personal data in accordance with the section “You have the right to request rectification of your personal data” above during the time period we are verifying the accuracy of the data,
• the processing is unlawful and you do not want the personal data to be erased,
• Quinyx, in its capacity as data controller, does no longer need the personal data for the purposes for which it was processed, but you require us to retain the information for the establishment, exercise or defence of legal claims, or
• you have objected to our legitimate interest for the processing in accordance with the section “You have the right to object to the processing” below during the time period we determine whether the legitimate interest overrides your privacy rights.

Contact: dataprivacy@quinyx.com 

You have the right to object to the processing

You have the right to object to such processing of your personal data based upon our legitimate interest (please see chapter 4 above). If you object to such processing, we will only continue with the processing if we have a compelling legitimate reason for the processing that outweighs your interest, rights or freedoms, or unless continued processing is necessary for the establishment, exercise or defence of a legal claim.

Contact: dataprivacy@quinyx.com

You have the right to lodge a complaint with the data protection authority

You have the right to lodge any complaints regarding our processing of your personal data with the data protection authority. The supervisory authority for Quinyx is Datainspektionen, Sweden. https://datainspektionen.se

Should you experience that Quinyx and the DPO do not live up to GDPR and the data subject rights, read more about how to report to Datainspektionen. https://datainspektionen.se

We only process personal data that is required for Quinyx to fulfil its intended purposes as a workforce management system, which include:

• Human resource management
• Work time scheduling
• Work task scheduling and execution
• Work time reporting
• Communication

By default, it is possible to store and process the following personal data in the system:

• Name
• Address
• Telephone no.
• Email address
• Social security no. / civic registration no.
• Next of kin’s name and contact info.
• Organisational affiliation, such as home department and cost centre
• Employment contract
• Availability
• Work shifts
• Time punches
• Absences
• Qmail messages

Your employer is ultimately responsible for which personal data they choose to store and process in the system. Your employer may also choose to add customized personal data fields to store additional data that is required to simplify their workforce management process.

We do not share your personal data with any parties other than your employer, and we conform to industry best practices regarding data security to ensure that your personal data is safe.

Your personal data is stored as long as your employer chooses to keep it in the system. Typically, this is limited to your period of employment, however your employer may choose to keep some or all of your personal data in the system after your employment ends in order to comply with local legislation. After your personal data has been removed from the system, some or all of it may be kept in backups for a limited time in accordance with the terms of service that have been agreed upon between us and your employer.

Turn to your employer to get an exact summary of which personal data is stored on you.

You must turn to your employer to request a full deletion of your personal data from the system, as some or all of the data may be required to be kept for a certain period in order to comply with local legislation.

The app uses a method called "geofencing" in order to determine if you are within the required range of your workplace for punching in and out, and also to provide a push notification reminding you to punch in or out when you reach or leave your workplace. With geofencing, an app tells the operating system to send it a signal if and when the phone is within X meters of coordinates Y and Z. It requires location data to be activated at all times. Geofencing has a few major advantages:

1. It uses significantly less battery power than traditional geolocation as it only uses cell tower triangulation, i.e. no additional hardware is activated in order to determine your position. Therefore, Quinyx positioning does not consume any power. However, accuracy is increased if you already have Wi-Fi enabled.
2. It does not require the app to save or transmit any location data to the app provider. Instead of the app/phone providing location data to Quinyx servers, Quinyx provides the workplace's coordinates to the phone, and the phone tells the app if it's within required range for punching in and out.

We do not store any information regarding your location or movements.

Quinyx uses cookies on www.quinyx.com. By browsing the website, you consent to the use of cookies.

Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows a website, service or a third ­party to recognize you and make your next visit easier and more useful to you.

Cookies can be "persistent" or "session" cookies.

In addition to our own cookies, we may also use various third­ parties cookies to report usage statistics of the website and deliver advertisements.

You can learn more about cookies and the following third ­party websites:

• AllAboutCookies: http://www.allaboutcookies.org/
• Network Advertising Initiative: http://www.networkadvertising.org/

View Quinyx Information Security as PDF.

Download Quinyx Data Processor Agreement as PDF.

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.