Skip to content
WorkOrders.

Privacy policy

This translation is for information. If the versions differ, the Slovenian text applies.

This page explains which personal data we process on the WorkOrders website and app, why, for how long, and what rights you have under the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

Provider
UniCode, programske rešitve in programiranje, Sebastian Novak s.p. (hereinafter UniCode s.p.)
Registered office
Štihova ulica 13, 1000 Ljubljana, Slovenia
Registration number
9021817000
Tax number
64110273
E-mail
info@unicode.si
Website
unicode.si

We have not appointed a data protection officer because Article 37 GDPR does not require it. For any data protection question, write to info@unicode.si.

2. When we are controller and when processor

We are the controller for data of visitors to this website, for data provided when a company registers, and for sign-in and security data.

Data that a company enters into WorkOrders (employees and other users, hours, work orders, travel orders, expenses, clients and their contact persons, invoices, quotes, schedules) is processed on behalf of that company. The company is the controller and we are the processor under the data processing agreement.

If you are an employee or client of a company that uses WorkOrders, contact that company to access, correct or delete your data. We help them with this; you can also send the request to us and we will forward it.

3. What data we process and why

Data: Registrant’s name, surname, e-mail and phone, hashed password, company details (name, VAT ID, address), time and version of the accepted terms
Purpose: Concluding and performing the contract, confirmation of the contract, proof of acceptance
Legal basis (GDPR): Performance of a contract, Art. 6(1)(b); legitimate interest in proof, Art. 6(1)(f)
Data: IP address, browser and time of sign-in, list of sessions and trusted devices, two-factor settings (encrypted secret, passkey public keys, hashed recovery codes)
Purpose: Account security, reviewing and revoking sessions, preventing abuse
Legal basis (GDPR): Legitimate interest in service security, Art. 6(1)(f); performance of a contract, Art. 6(1)(b)
Data: E-mail address and name of the recipient of notifications (sign-in code, invitation, reminders)
Purpose: Sending notifications that the app needs or that you turn on
Legal basis (GDPR): Performance of a contract, Art. 6(1)(b)
Data: Content the company enters into the app
Purpose: Providing the app on behalf of the company
Legal basis (GDPR): Determined by the company as controller; we act under the data processing agreement (Art. 28)
Data: Messages you send us by e-mail
Purpose: Replies, support and troubleshooting
Legal basis (GDPR): Performance of a contract or legitimate interest, Art. 6(1)(b) and (f)
Data: Random browser identifier, your cookie choice and its time (no IP address)
Purpose: Proof of consent to analytics cookies
Legal basis (GDPR): Legal obligation to demonstrate consent, Art. 6(1)(c) with Art. 7(1)
Data: Only with your consent: online identifier, public pages visited, device, approximate location
Purpose: Measuring visits to public pages with Google Analytics; never inside the app after sign-in
Legal basis (GDPR): Your consent, Art. 6(1)(a)

We do not sell data or use it for advertising or for training AI models. We do not collect special categories of personal data under Article 9 GDPR; companies must not enter them in notes and descriptions.

4. Do you have to provide the data

Name, e-mail, password and company details are needed to conclude the contract; without them an account cannot be created. Consent to analytics is voluntary and does not affect your use of the website or the app.

5. Who receives the data

  • Hosting and database: a server in Slovenia that we operate ourselves.
  • Sending e-mail: Neoserv d.o.o. (Slovenia) or Resend, Inc. (USA), as processor.
  • Google Ireland Limited and Google LLC (Google Analytics), only if you consent to analytics, as processor.
  • Systems the company connects to WorkOrders itself (for example fin., Jira, Plane or webhook endpoints) receive data on the company’s instruction and under its responsibility.
  • The company’s clients see only the work orders, invoices and quotes that relate to them in the client portal.
  • Public authorities, where required by law.

App data is stored in Slovenia. It leaves the EU only when e-mail is sent through Resend and for analytics if you consent. These transfers rely on the EU-US Data Privacy Framework and standard contractual clauses. We host fonts and images on the website and in the app ourselves, so your browser does not contact Google or Unsplash when you visit.

6. How long we keep data

Data: Company data and app content
Retention: Until the contract ends. We then export it on request and delete it within 30 days at the latest, unless the law requires otherwise.
Data: Proof of acceptance of the terms and data processing agreement
Retention: Until the contract ends and until the limitation periods for contractual claims expire.
Data: Sessions (IP, browser)
Retention: A session is valid for 14 days from last use; expired and revoked sessions are deleted after 30 days.
Data: Sign-in history (IP, browser, result)
Retention: 12 months.
Data: Trusted devices for two-factor sign-in
Retention: 30 days or until revoked.
Data: Cookie choice
Retention: 2 years from the last change.
Data: Analytics data at Google
Retention: Up to 14 months.
Data: Support e-mails
Retention: As long as needed to handle the request, at most 2 years.
Data: Backups
Retention: At most 30 days; deleted data remains in backups during that time but is not used.

If you exercise a right under the GDPR, we may keep the relevant data until the procedure ends (Article 21 ZVOP-2).

7. Your rights

  • Access (Art. 15) and portability (Art. 20): on request we send you your data in a machine-readable format.
  • Rectification (Art. 16): you edit your name and settings in the app under My profile; the company administrator corrects other data.
  • Erasure (Art. 17) and restriction (Art. 18): write to us or to your company’s administrator.
  • Objection (Art. 21) to processing based on legitimate interest: write to us.
  • Withdrawing consent (Art. 7(3)): choose Cookie settings in the page footer. Withdrawal does not affect the lawfulness of earlier processing.

We reply without undue delay and within one month at the latest. Exercising your rights is free of charge.

Complaint to the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, phone +386 1 230 97 30, www.ip-rs.si.

8. Automated decision-making

The app automatically calculates hours, amounts and reminders, for example a reminder when a day has no entries. It does not automatically take decisions with legal or similarly significant effects, so this is not decision-making under Article 22 GDPR.

9. Security

Connections are encrypted with TLS, passwords are hashed with bcrypt, tokens for connected systems are encrypted with AES-256-GCM, and refresh tokens are kept in a secure HttpOnly cookie. Company data is kept separate, roles control access within a company, and a company can require two-factor sign-in for all users. If a security breach puts your rights at risk, we will notify the Information Commissioner and you, as required by Articles 33 and 34 GDPR.

10. Changes

We tell you about material changes in the app or by e-mail before they take effect. The effective date is at the top of this page. Cookies are described on a separate page.