Last updated: 25 October 2026Dernière mise à jour : 25 octobre 2026Zuletzt aktualisiert: 25. Oktober 2026Última actualización: 25 de octubre de 2026
La version anglaise ci-dessous fait foi.Die nachstehende englische Fassung ist maßgeblich.La versión en inglés a continuación es la vinculante.
Privacy Policy
This policy explains how Kiviki Group ("we", "us") handles personal data in connection with HRNexus. We serve organisations in the United States and the European Union and design our practices with the EU General Data Protection Regulation (GDPR) in mind.
1. Our roles
Processor: for employee and HR data that customers upload into HRNexus, the customer organisation is the controller and we process it only on their documented instructions. Employees should direct requests about their HR data to their employer first; we will assist the employer.
Controller: for account, billing, support and website data about our customers' administrators and visitors, Kiviki Group is the controller.
Deployment options: HRNexus can run (1) in our cloud, (2) on a dedicated private server we set up for a customer in an EU data centre (Germany or Finland), or (3) on the customer's own server. For options 2 and 3, the customer can own the hosting account and remove our access at any time; we cannot see customer HR data unless the customer gives us access (for example for setup, maintenance or support), and we act as a processor only for the access granted. In a self-hosted deployment, customer HR data is stored and processed on the customer's infrastructure, and the customer is responsible for hosting, security, backups and any sub-processors it chooses. This policy then applies only to data the customer sends us directly, such as support requests and billing details, and to any access the customer grants us.
2. Data we process
- Account data: name, work email, role, password (stored only as a salted hash), language preference.
- Customer HR data: employee profiles, contact details, job and salary information, leave and attendance records, payroll data, documents and policies uploaded by the customer.
- Billing data: handled by Lemon Squeezy; we receive subscription status, plan, customer name and email, but not full card details.
- Technical data: IP address, browser information, session identifiers and audit logs of actions in the app, used for security.
- Support communications you send to us.
3. Why we use it (legal bases)
- To provide and secure the service and perform our contract with you (Art. 6(1)(b) GDPR).
- To prevent fraud, abuse and security incidents, and improve the service (legitimate interests, Art. 6(1)(f)).
- To meet legal, tax and accounting obligations (Art. 6(1)(c)).
- To send service and billing emails. We do not sell personal data or use customer HR data for advertising or to train AI models.
4. Sub-processors
We use these service providers to run HRNexus:
- Render — application hosting.
- Neon — managed PostgreSQL database.
- Resend — transactional email delivery (e.g. password resets, notifications).
- Lemon Squeezy — payments, invoicing and tax, as Merchant of Record.
- ImprovMX and Google (Gmail) — forwarding and handling of email sent to our support addresses.
Some providers may process data outside your country, including in the United States. Where data from the EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider participates. We will update this list before adding a new sub-processor.
5. Retention
Customer HR data is kept for the life of the subscription and deleted within 30 days after cancellation unless the customer asks for earlier deletion. Billing records are kept as long as tax law requires. Security logs are kept for a limited period, normally up to 12 months.
6. Security
We use HTTPS encryption in transit, hashed passwords and session tokens, role-based access, tenant isolation between companies, rate limiting and audit logging. No system is perfectly secure; if a personal-data breach affects customer data we will notify the affected customer without undue delay.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. EU residents may also complain to their local data protection authority. California residents may request to know or delete their personal information; we do not sell or share personal information for cross-context advertising. To exercise rights, email support@kivikigroup.com.
8. Cookies
HRNexus uses only strictly necessary cookies and browser storage: a secure session cookie to keep you signed in and a setting to remember your language. We do not use advertising or tracking cookies.
9. Children
HRNexus is a business service and not directed to children under 16.
10. Changes and contact
We may update this policy and will post the new version here with a new date. Contact us about privacy at support@kivikigroup.com.