Privacy

Operator and responsibilities

VerkApp is operated by Benjamín Ragnarsson in Iceland. Privacy questions can be sent to Benjarag7@outlook.com.

The customer company is responsible for the workplace purposes for which it uses employee and customer personal data. VerkApp processes that data on its behalf under the standard data-processing terms. This gives the company no ownership of VerkApp. VerkApp determines the standard service and retention arrangements accepted by customers, subject to lawful instructions and statutory rights.

The operator acts as controller for his own customer relationship, support correspondence and independently determined service-security purposes.

Information and purposes

The current service processes account identifiers, names, email addresses, optional phone numbers, language settings, company membership, roles and invitations. Job records may include customer and contact details, addresses, descriptions, schedules, staffing requirements and change history. Authentication, operation records and technical logs support access control, reliable saving, troubleshooting and security.

Information comes from users, authorised company administrators and use of the service. Company users see information according to their permissions. Operator access is limited to what is necessary to provide support, maintain the service or meet a legal requirement. Additional features involving new categories of data require an updated notice before release.

Legal grounds

The customer company must identify and communicate its lawful basis for workplace processing; accepting these terms is not employee consent. For the operator’s own processing, contract necessity applies where the individual is a party to the service agreement; legitimate interests support proportionate business contact, support and fraud/security protection, subject to a documented balancing assessment. Applicable legal obligations may require specific records. Personal information is not sold or used for advertising under this service policy.

Providers and international processing

Supabase provides authentication and database services; the recorded development database region is London, United Kingdom. Resend delivers account and invitation emails. Cloudflare Pages is the selected host for these public pages. Vercel hosts the separate authentication-link page and manages the domain registration and DNS. Hosting and email providers may process technical request or delivery metadata, including IP addresses and timestamps.

Provider processing can extend beyond the database region and outside the EEA. Before activation, the operator must verify applicable processing agreements, subprocessors, destinations and safeguards, using an applicable adequacy decision or appropriate safeguards such as standard contractual clauses where required. Information about the applicable safeguards can be requested at the contact address. A list of proposed providers and readiness limitations is included in the data-processing terms.

Optional Google address search

Google Places provides optional address suggestions when enabled. When enabled, searches begin only after a manager types, with a short delay. Search text, language, region parameters and a temporary session token are sent through VerkApp’s server to Google; selection may send a place identifier for address details. Employee names, job descriptions and device GPS coordinates are not required for this search. Manual address entry remains available.

Google’s Privacy Policy is incorporated by reference for Google’s processing. VerkApp does not persist suggestion lists or raw search text for analytics. Only the selected street address needed for the user’s job entry will be retained where permitted by Google’s terms. This is limited to completing a street address already known to the user for that user’s job entry; suggested lists and other place data are not stored.

Storage on your device and on this website

The app uses protected device storage for session information, scoped preferences, limited job metadata and references used to resolve uncertain saves. An offline copy does not confer access rights. Unsaved form drafts may remain in memory while the app is open. Device cleanup is triggered when the app detects sign-out or relevant access changes; an offline device cannot receive an immediate remote deletion guarantee.

These static information pages contain no application cookies, analytics scripts or advertising trackers. The hosting provider may still process request logs for delivery and security. Opening an external link involves that provider’s own services and policies.

Retention

• Jobs and related work history: retained while the company account is active and the records remain necessary. Necessity is reviewed at least annually; unnecessary records are removed or irreversibly anonymised.
• Departing employees: access is disabled promptly when departure or revocation is notified. Only identity information needed to explain retained work history is kept. Disabling access does not itself erase historical records.
• Expired or cancelled invitations: unnecessary invitation details are deleted within 30 days after expiry or cancellation. Minimal security evidence follows the security-log rule.
• Routine technical and security logs: retained for up to 30 days. Evidence relevant to a specific incident may be retained longer for a documented purpose, with periodic review.
• Support correspondence: deleted within 12 months after resolution, unless an unresolved dispute or legal obligation requires longer retention.
• Company account closure: the company has 30 days from closure to collect an export. Live customer data is then deleted, except data that law requires to be retained. An earlier lawful deletion instruction can shorten that window.

Work-history audit records follow the job-retention rule, not the shorter routine-log period. Minimal contract/acceptance evidence is retained only as needed to establish the agreement or meet a legal obligation. Any retention exception is limited to necessary information, has restricted access and is reviewed when its reason ends.

Deletion from live systems is distinct from backup expiry. Backup copies must be isolated from ordinary use, expire under the verified provider schedule and have deletion instructions reapplied if restored. The exact backup and provider-log schedules must be confirmed before these terms take effect.

Your rights and requests

Depending on the applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where consent is used, it can be withdrawn. Contact us or your company; requests relating to company-controlled data will be forwarded and assisted appropriately. We may verify identity proportionately. Requests are normally handled within one month, with any legally permitted extension explained.

You can complain to Iceland’s supervisory authority, Persónuvernd. These terms do not remove statutory rights.

Updates

The published notice will show its effective date. Material changes will be communicated before they apply; new purposes or features will be assessed before launch.