1. Data Controller and Data Processor

If your employer created your account, your employer is the data controller for the employee data it enters about you, and MopPilot is the data processor acting on your employer's instructions. Requests about that data are directed to your employer. MopPilot is the data controller for its own account and billing data, and for the platform's security and operational logging. We process your data in accordance with the EU General Data Protection Regulation (GDPR).

2. What Data We Collect

We collect the following types of personal data:

Contact Information: Name, email, phone number
Company Information: CVR number, company name, address
Usage Data: Login times, IP addresses, browser information
Task Data: Task descriptions, time records, documents
Employment Data: CPR number, bank details, payroll number, hourly rate, employment dates. CPR and bank details are encrypted.
Working Time and Location: Check-in and check-out times, breaks, and GPS position at check-in
Absence Data: Absence requests including sick leave, which is health data under GDPR Article 9

3. Purpose of Processing

We use your data to:

Deliver and maintain our services
Manage your account and subscription
Communicate with you about your account
Improve our platform and services
Comply with legal obligations

4. Legal Basis

We process your personal data on the following legal bases:

Contract: Necessary to fulfill our agreement with you
Consent: Where you have given consent to processing
Legitimate Interests: To improve our services
Legal Obligation: To comply with legislation

5. Data Retention

We retain your personal data as long as necessary to fulfill the purposes for which it was collected. The retention period depends on the type of data:

Working time records: 5 years after the period (Working Environment Act)
Payroll data: 5 years after the end of the financial year (Bookkeeping Act)
Tax information: 5 years (Tax Control Act)
Employment data: The duration of the employment plus 5 years (Limitation Act)
CPR numbers: The duration of the employment, as long as they are needed
Invoicing data: 5 years (Bookkeeping Act)
Task documents: Deleted automatically 30 days after the task is completed; documents with a tag that requires retention are kept for 5 years
Audit logs, including IP addresses and logins: 365 days, then permanently deleted
Login sessions: 16 hours, or 30 days with "remember me"; expired sessions are removed daily
Database backups: 60 days

Data is kept longer only where legislation requires it.

6. Your Rights

You have the following rights under GDPR:

Right of Access: You can request access to your personal data
Right to Rectification: You can have incorrect data corrected
Right to Erasure: You can request deletion of your data
Right to Data Portability: You can have your data delivered to you
Right to Object: You can object to certain processing

7. Security

We use technical and organizational security measures to protect your personal data, including field-level encryption of CPR and bank details, role-based access control, audit logging of access to sensitive data, and two-factor authentication, which is required for owner and administrator accounts and for any user an administrator requires it for.

8. Contact

If you have questions about this privacy policy or wish to exercise your rights, you can contact us through the platform.

Privacy Policy