End User Privacy Notice

1. Roles and Responsibilities

The employer or other organization using the Service ("Customer") acts as the Data Controller and determines the purposes and means of processing personal data.

Workant acts as the Data Processor and processes personal data only on documented instructions from the Customer in accordance with the Data Processing Agreement and applicable data protection laws.

2. What Personal Data Is Processed

Depending on how your employer uses the Service, the following categories of personal data may be processed:

• Identification data (name, employee ID, username)
• Contact details (email address, phone number)
• Employment information (job title, department, manager, contract details)
• Working time and absence data (working hours, leave, sickness absences)
• System usage and access logs
• Other HR-related information entered by your employer

Special categories of personal data (such as health data) are processed only where required by law or explicitly enabled by your employer in accordance with applicable legislation.

3. Purposes and Legal Basis of Processing

Your personal data is processed for purposes such as:

• Managing the employment relationship
• HR administration and reporting
• Workforce planning and compliance
• Providing access to and operating the HR system
• Ensuring information security and system integrity

The legal basis for processing is determined by your employer and may include the performance of an employment contract, compliance with legal obligations, or the employer's legitimate interests.

4. How Data Is Processed

Workant processes personal data:

• Solely on the instructions of your employer
• Using EU-based cloud infrastructure (including Vercel)
• With appropriate technical and organizational security measures such as encryption, access control, logging, and backups
• Only for as long as necessary to provide the Service and in accordance with your employer's retention policies

5. Recipients and Sub-Processors

Your personal data may be processed by Workant and its approved sub-processors that provide infrastructure, support, security, and related services.

All sub-processors are contractually bound by data protection and confidentiality obligations in accordance with the GDPR.

6. International Data Transfers

Personal data is primarily processed within the European Union and the European Economic Area.

If personal data is transferred outside the EU/EEA, appropriate safeguards, such as EU Standard Contractual Clauses, are applied.

7. Data Retention

Your personal data is retained in the Service for as long as your employer maintains your user account and as required for employment-related and statutory purposes.

After termination of your employer's contract with Workant, personal data is returned to the employer or securely deleted in accordance with the Data Processing Agreement and applicable law.

8. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request erasure (where legally applicable)
• Request restriction of processing
• Object to processing in certain circumstances
• Request data portability
• Lodge a complaint with a supervisory authority

9. Contact

For questions regarding the processing of your personal data in the Workant Service, please contact:

You may also contact Workant as Data Processor: