About the privacy
The company responsible for the processing of your data under this Privacy Policy is:
Fodoj GmbH
Prinzregentenstrasse 54, 80538 Munich, Germany (commercial register: Amtsgericht München, HRB 248587; managing director: Kirill Shirinkin; VAT ID: DE324875035)
+49 89 54197048
At Fodoj GmbH, we recognize the importance of protecting your personal information and we are committed to treating it responsibly and in accordance with data protection laws.
This privacy policy explains how Fodoj GmbH processes personal data on the website claimora.com and in the Claimora application (app.claimora.com). Fodoj GmbH is the controller for the data of website visitors, of the companies that sign up for and pay for Claimora (HR contacts and billing data), and for the data needed to operate and secure the service and to measure the use of the app by visitors who are not signed in. For the data of the employees and external workers that a company manages in Claimora (such as time records, absences and contracts), that company, as employer, is the controller, and Fodoj GmbH processes the data on its behalf as a processor within the meaning of Article 28 GDPR, as set out in section E (Data protection) of our Terms and Conditions.
Personal information
Personal data is any information that identifies you or makes you identifiable. When you visit claimora.com, technical data such as your IP address, browser and the page requested are processed by our hosting provider Cloudflare to deliver the website; the pricing page also loads Stripe's pricing table from Stripe's servers. claimora.com itself has no forms. When a company signs up for Claimora, we collect the first, middle (optional) and last name and e-mail address of the HR user, a password (stored only in hashed form), and the company name, country and language; the sign-up form is protected by hCaptcha, which processes technical data about your browser and device to tell humans from bots. For billing we pass the HR user's e-mail address, the company name and country to Stripe; payments are handled by Stripe and we never receive card details. When you use the app, our server sends our analytics provider PostHog a record of each page the app displays to you, described in detail below, including the page address, the origin of the previous page, your browser, operating system and device type, the interface language and, where applicable, the country that Cloudflare derives from your IP address, but never the IP address itself; for signed-in users, the app also stores the IP address of the last request and the approximate location that Cloudflare derives from it (country, region, city, postal code, coordinates and time zone), unless their company has switched location tracking off.
You can browse claimora.com without providing any personal data beyond the technical data your browser sends. Personal data are processed lawfully in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG) and, where applicable, the Spanish Organic Law 3/2018 (LOPDGDD).
Purpose, duration and legitimation of the treatment:
The data that the user provides us will be processed for the following purposes:
- Answer the enquiries you send us by email to team@claimora.com or by phone. We process the data you give us (name, email address, phone number and the content of your message) to answer your request. The legal basis is our legitimate interest in answering enquiries and, where the enquiry concerns a contract, the performance of that contract or pre-contractual measures (Article 6(1)(f) and (b) GDPR). We keep these data for as long as needed to deal with your request and afterwards only as long as required by law.
- Provide the Claimora service to our customers. When an employer uses Claimora, Fodoj GmbH processes the personal data of its employees and external workers as a processor (article 28 GDPR), only on the employer's instructions. This covers identification and account data, contract data, working-time records with breaks, approvals and their change history, vacation and sick-leave days, and the sick notes or medical certificates that employees upload. Those certificates are health data under article 9 GDPR, and in the app only the employee who uploaded them can open them. It also covers the IP address and the approximate location derived from it (country, region, city, postal code, coordinates and time zone), which are stored as each user's last location (updated only when the IP address changes) and copied onto a time entry when an employee starts it and, if it is stopped with the clock, when it is stopped; HR can see these locations and managers the last location of their team. The employer can switch location tracking off; then no location is stored and the stored last location is deleted. It further covers the measurement of how the employer's users use the app, which Fodoj GmbH carries out with PostHog to maintain and improve the app, as described in the next point. The employer, as controller, decides the purposes, is responsible for the legal basis and must inform its staff. Claimora does not currently delete these data automatically. They are kept while the employer's account is active, and after the contract ends they are deleted at the employer's request (team@claimora.com). The employer remains responsible for keeping working-time records for the statutory periods (4 years in Spain under article 34.9 of the Workers' Statute; in Germany, at least 2 years under section 16(2) ArbZG).
- Operate, secure and improve the Claimora app. In the app we use a session cookie and, if you choose "remember me", a remember-me cookie, which are necessary to keep you signed in. To measure how the app is used, our server sends our analytics provider PostHog one page-view event for each page the app successfully displays in your browser, including the sign-in, sign-up, password recovery and invitation acceptance pages; nothing is sent for redirects, errors, API or AI-assistant requests, partial page loads, link prefetches, bots, requests without a browser user agent, or file downloads. Each event contains the page address without query strings, fragments or credentials (paths of signed file-download links are redacted), the origin of the previous page (scheme, domain and port, without its path, query string, fragment or credentials) or an indication of direct access, the referring domain, your browser and its version, operating system and device type (desktop, mobile or tablet), the country that Cloudflare derives from your IP address (left out for signed-in users whose company has switched location tracking off), the internal name of the screen and the interface language. For signed-in users, events are linked only to the numeric user ID, never to the name or e-mail address, and are grouped under the company's numeric ID; they also carry the user's employment type (employee or external), roles and language. When a company signs up, an event recording its creation is sent with the new user's numeric ID, the company's numeric ID and the same user details. For visitors who are not signed in, events are linked to a pseudonymous identifier that our server calculates from the IP address and the browser's user agent with a secret key and the current date, so it changes every day and the IP address cannot be read from it; PostHog creates no profile for these visitors. PostHog never receives your IP address, no analytics script runs in your browser, and the app sets no cookies and uses no browser storage for this measurement. Individual requests are no longer stored in our database, and no IP address or location is stored for visitors who are not signed in. The sign-up form uses hCaptcha to block bots; for this, hCaptcha receives data from your browser. We process these data on the basis of our legitimate interest in providing a secure service and improving it (Article 6(1)(f) GDPR); for the users of a client company, we measure the use of the app on behalf of that company as its processor (Article 28 GDPR), and PostHog acts as our subprocessor. The data sent to PostHog currently have no defined deletion period. The activity log that the app used to keep in our own database (time, page, referrer, IP address, approximate location, browser and device of each request) has been deleted from it.
- Manage the contract and billing with our customers. To manage the subscription we process the company's name and country and the e-mail address of its HR user. Payments are handled by Stripe, to which we send that e-mail address and the company's name and country; card and payment details are entered only on pages hosted by Stripe and we never receive them. Stripe informs us of the status of the subscription and of payments. The legal basis is the performance of the contract with the customer, our legitimate interest in managing that contract through the customer's contact person, and our legal obligations (article 6(1)(b), (f) and (c) GDPR). We keep these data for the duration of the contract and afterwards for as long as commercial and tax law requires.
- Detect and fix errors and monitor the performance of the service. The app no longer sends new error reports or performance measurements to Rollbar or Sentry. Disabling these integrations does not establish deletion of previously transmitted data. Server logs (requests and their parameters, except passwords, tokens and other secrets) are stored in Google Cloud Logging. The legal basis is our legitimate interest in providing a secure and reliable service (Article 6(1)(f) GDPR).
Transfer or communication of personal data and international transfers:
We only share your data with third parties when the law requires it, or with service providers that process it on our behalf: Google Cloud (app, database and file storage in the europe-west1 region, Belgium; also background jobs and technical logs), Cloudflare (website hosting and network proxy for the app, which also provides approximate location based on your IP address), Mailgun (email delivery, EU region), Stripe (payments), PostHog (product analytics, hosted in PostHog's EU cloud in Germany) and hCaptcha (bot protection on the sign-up form). The website and the app serve their fonts from our own servers. Within Claimora, the data of employees and external collaborators can be seen by the HR staff and managers of their company, according to the roles that company assigns. If you connect an AI assistant to Claimora, the provider you choose receives the data you authorise it to access; you choose that provider, not Fodoj GmbH.
Some of the service providers we use are based in the United States or operate global networks, so personal data may be processed outside the European Economic Area. This applies in particular to Cloudflare (website delivery and security), Stripe (payments), PostHog (product analytics, which does not receive your IP address; PostHog, Inc. is a US company, although our project is hosted in its EU cloud in Germany), and hCaptcha (protection against automated sign-ups). Where such a transfer takes place, it is based on an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework, for certified providers) or on the Standard Contractual Clauses adopted by the European Commission (Art. 45 and Art. 46(2)(c) GDPR). You can request further information on these safeguards at team@claimora.com.
Data update:
It is important that in order for us to keep personal data up to date, the user informs us whenever there has been any modification in them, otherwise, we are not responsible for their veracity.
The user guarantees that the personal data provided is true, guaranteeing that all the information provided corresponds to the real situation, that it is up-to-date and accurate, being obliged to communicate any modification.
Third Party Data:
If the user provides personal data of third parties to Fodoj GmbH, for example when an HR user enters employees' data in Claimora, the user guarantees that they have a valid legal basis for doing so, that they have informed the persons concerned as required by data protection law, and that the information is accurate and truthful.
Mandatory nature of the information requested:
In the Claimora sign-up form and in the form for accepting an invitation, the required fields and acceptance of the Terms of Service are mandatory; without them the account cannot be created or activated.
Rights of the interested parties:
You have the right to access your personal data and obtain a copy of it, to rectification, to erasure, to restriction of processing and to data portability, and to object to processing based on our legitimate interests. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal. You also have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. You can exercise your rights by e-mail to team@claimora.com. If your data are managed in Claimora by the company you work for or with (for example time records, absences or contracts), that company is the controller of those data: please address your request to it. If you contact us instead, we will forward your request to that company and help it to respond.
If you consider that your rights have not been properly addressed, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR), for example the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es). The supervisory authority competent for Fodoj GmbH is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, www.lda.bayern.de).
Treatment of data of minors:
Whoever provides the data through the forms on this website and accepts its treatment declares to be over 14 years of age, access and use of the portal to minors of that age is prohibited. If at any time, the Responsible Party detects that a person under 14 years of age has provided personal data, we will proceed to cancel them. Likewise, parents or guardians may in any case contact Fodoj GmbH to block the access account of minors under their care who have registered by falsifying their identity.
Social networks:
The object of tools like Facebook, Twitter, Instagram, etc. or other social networks is to give visibility and diffusion to the activities carried out by our organization. These tools store personal data on the servers of the respective services and are governed by their own privacy policy. It is recommended to review and read the conditions of use and privacy policy of the social network at the time of registration, taking into account the different configuration possibilities in relation to the degree of privacy of the user profile on the social network.
Likewise, the Responsible Party reserves the right to eliminate from its social networks any information published by third parties that violates the law, encourages them to do so or contains messages that violate the dignity of people or institutions. As well as the right to block or report the profile author of these messages.
Cookies treatment:
A cookie is a small file that is downloaded and stored on the user's computer when the user accesses a web page. Cookies allow the web, among other things, to store and retrieve information about the browsing habits of the user or their equipment and, depending on the information they contain and the way they use their equipment, they can be used to recognize the user.
claimora.com does not set cookies of its own; only the pricing page embeds Stripe's pricing table, and Stripe may set its own cookies there. The Claimora app uses a session cookie, which is strictly necessary to keep you signed in, and, only if you tick "Remember me", a cookie that keeps you signed in for two weeks. Our usage measurement with PostHog is carried out from our servers and uses no cookies or other browser storage. On the sign-up page, hCaptcha may set cookies to protect the form against bots, and in the HR area Stripe may set cookies for payment processing. You can block or delete cookies in your browser settings; without the session cookie you cannot sign in to the app.