Privacy Statement — TimeViking
Last updated: 12 October 2026
1. Who we are
TimeViking is a service of Software Services BV, Meldertsestraat 8/4008, 3545 Halen, Belgium, enterprise number BE 0895.317.225, e-mail info@timeviking.com. We are the controller for the processing of personal data on our website and for the management of customer accounts and subscriptions.
For the hours and the employee data that a customer enters in the service, the customer is the controller and we are the processor. This is set out in the data processing agreement. This statement covers what we process ourselves as controller.
2. Which data, why and on what basis
| What | Why | Basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Name, e-mail, company name, language, password (hashed) at registration | To create and secure an account | Contract (b) | As long as the account exists |
| E-mail address, company name, name and language of a new registration, reported by e-mail to the administrator of the service | To know about new customers, to be able to help them and to notice abuse | Legitimate interest (f) | As long as that e-mail is needed, at most 2 years |
| IP address, browser, time of registration | To prevent abuse and fraud (limits, evidence) | Legitimate interest (f) | 90 days, then erased |
| Result of the robot check (reCAPTCHA) | To prevent registrations by robots | Legitimate interest (f) | Kept with the registration |
| Signing in with Google or Microsoft: e-mail and a technical ID | Signing in without a password | Contract (b) | As long as the account exists |
| Invoice data: name, address, e-mail, VAT number, country, type of customer | Invoices and VAT | Legal obligation (c) and contract (b) | The statutory retention period for invoices (10 years) |
| Evidence of the customer's location: country of the billing address, of the IP address and of the payment method | VAT on electronic services (EU Implementing Regulation 282/2011, Art. 24b) | Legal obligation (c) | Same as invoices |
| VAT check with VIES (consultation number) | Evidence that a VAT reverse charge was justified | Legal obligation (c) | Same as invoices |
| Payments (via Mollie): amount, status, payment method, country of the card or account | To pay for the subscription | Contract (b) | Same as invoices |
| Messages through the contact form | To answer your question | Legitimate interest (f) | 2 years |
| Technical logs (errors, sign-ins) | To secure the service and keep it running | Legitimate interest (f) | 90 days |
| E-mails from the service (confirmation of your registration, invitations, reminders, invoices and notices about your subscription) | To provide the service and keep you informed | Contract (b) | As long as the account exists |
| API key for Odoo (of a bot user or a personal one) and the address and database of the customer's Odoo | To make the connection with Odoo work | Contract (b); for the content: processor | As long as the connection exists; the key is stored encrypted |
| Leave data of a customer's employees (type, period, balance; sickness is health data) | To show, request and synchronise leave with Odoo, on behalf of the customer | We are processor; the basis lies with the customer (for sickness Art. 9) | As long as the environment exists, then deleted (§6) |
| Audit log (who changed what in an environment) | Security and evidence for the customer | Legitimate interest (f); for the content: processor | As long as the environment exists |
Notification of a new registration
For every new registration, the administrator of the service (the owner of Software Services BV) receives an e-mail with the e-mail address, the company name, the name and the language of the new customer. No password, IP address or confirmation link is included. We do this to be able to help new customers and to notice abuse.
Connection with Odoo
The customer connects its own Odoo. For this we store the address and the database name of that Odoo and an API key, encrypted and never in logs. The key is that of a bot user, or the personal key of a user who wants to have their own hours synchronised with Odoo; the latter can always delete it themselves. In Odoo we only read and write what the service needs (hours, projects, tasks, employees and, if the customer allows it, leave).
Leave data in the service
If a customer uses leave in the service, we process, as processor (not as controller), the type of leave, the period, the status of the request and the balance of the customer's employees. If the type indicates sickness, that is health data (GDPR Art. 9). The following rules therefore apply:
- Colleagues only see that someone is "absent", not why. Only the employee, their manager and the administrator see the type.
- We do not read or store the reason that someone enters in Odoo for leave.
- For leave, the audit log only keeps the status, who decided, the dates and the type; never a note or reason.
- Leave data stays as long as the environment exists, is included in the export and is deleted with it (see §6).
If you want to know what your employer does with your leave data, or to exercise your rights, please contact your employer first.
We do not sell data and do not use it for advertising.
Website visitor statistics
We count visits to the website ourselves, on our own server, without cookies and without an external service. Per day we only store the number of visits per page, with the language version, the domain, the domain of the referring site (not the full address), the campaign codes utm_source, utm_campaign and ref from the address, and the type of device (computer, phone or tablet), derived from the browser information. We do not store your IP address or the browser information itself. To count unique visitors, we make an irreversible code per day from your IP address and browser with a random salt that changes every day and is never stored: so we cannot recognise you, not even from one day to the next. Robots are not counted. Legal basis: legitimate interest (knowing which pages are read). The counts are anonymous and stay with us.
3. Recipients (sub-processors and third parties)
| Who | For what | Where |
|---|---|---|
| Our hosting partner | Servers, databases and backups | European Union |
| Our own mail server | Sending the service's e-mails | On our servers in the European Union |
| Mollie B.V. | Payments | EU (Netherlands) |
| Google (reCAPTCHA) | Robot check at registration and the contact form | United States (EU-US Data Privacy Framework) |
| Google and Microsoft (signing in) | Only if you choose to sign in that way | United States (EU-US Data Privacy Framework) |
| The European Commission (VIES) | Checking VAT numbers | EU |
| Plausible Analytics | Website visitor statistics, without cookies and without a personal profile (only if switched on) | EU |
A customer's Odoo is not our sub-processor: the customer connects it itself and remains responsible for it.
4. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (GDPR Art. 15–21). Send an e-mail to info@timeviking.com; we reply within one month. An administrator of the environment can export all data of the environment in the app itself (Settings › Subscription › Export everything) and have the environment deleted.
You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
5. Cookies and reCAPTCHA
See the cookie policy. The app only uses necessary cookies (the session). On the registration page and the contact form, Google reCAPTCHA loads, which sets cookies and sends data to Google. We use it to prevent abuse by robots (legitimate interest); Google's privacy policy also applies on those pages.
6. After a subscription ends
After the trial or after cancellation, an environment stays read-only for 60 days: you can still view and export everything. After that we delete the environment's database and the logins. What we are legally required to keep (invoices, payments, the evidence for VAT) is kept for as long as the law requires. Backups disappear after 35 days.
7. Security
Every customer has its own database and its own database user. Passwords are stored hashed; keys for Odoo and the secret of the module are stored encrypted. Two-step verification is available and can be made mandatory per environment. Access for our own administration always requires two-step verification.
8. Changes
We update this statement when the service changes. We notify the administrators of the environments by e-mail of important changes.