Privacy Notice

This page states the notice for every country we serve. Where a section names a country, it applies only to customers in that country; the sections for other countries do not apply to you and are shown for completeness.

Covers kwikapps.app, our public website, the account emails we send to KwikTime administrators, and the KwikTime app with every KwikAPPS module that runs inside it. Last updated 17 October 2026.

This website has no sign-up, no forms and no cookies. It does not build a profile of you, does not share anything with advertisers, and cannot identify you by name.

Who is responsible

KwikAPPS OPC, a One Person Corporation registered in the Philippines, SEC Reg. No. 2026080263876-03, Unit 705 Landsdale Tower, 86 Mother Ignacia, Paligsahan, Quezon City, Philippines, is the controller for the website and account information described here. For the KwikTime app, see The KwikTime app below.

Data Protection Officer: dpo@kwikapps.app.

Our registration with the National Privacy Commission has been filed and is awaiting the Commission’s validation; this notice will be updated when it is validated.

What we collect

• Anonymous usage statistics — pages viewed, referring site, approximate country, device and browser type, and which options on the page were chosen. No cookies, no name, no email address, no precise location, and nothing that tracks you across other websites.
• Your page preferences — industry, country, language and role, saved in your own browser so the page fits you when you return. They are not sent to us, and clearing your browser’s site data removes them.
• What you send us — if you email us, your message and address.
• KwikTime account emails — for companies using KwikTime, the administrator’s email address and company name, used to send notices about the account (for example, trial reminders). These are service messages, not marketing.

Why we process it

To run and improve this website, to answer you, and to provide the KwikTime service a company has signed up for. Our lawful bases are our legitimate interest in running our website, and the performance of the service contract.

Who else processes it

We use carefully selected service providers for website hosting, analytics, email and database services, each bound by data-processing terms and acting only on our instructions. Some of them process data outside your country; where they do, we rely on contractual safeguards that give your data the protection the law requires (for the EEA and the UK, the European Commission’s Standard Contractual Clauses and the UK addendum). We do not sell your data. A list of the providers we use is available on request to dpo@kwikapps.app.

How long we keep it

Usage statistics are kept in aggregate and are not combined with anything else. Correspondence is kept for up to two years from our last exchange, or longer where the law requires it for a contract or tax record. Account-email records are kept only for the current account period, except for the records listed under What we keep after an account is deleted.

Your rights

Under the Data Privacy Act of 2012 (RA 10173) you may ask to be informed, to access your data, to correct it, to object to its processing, to have it erased or blocked, to obtain a copy, and to claim damages. You may also complain to the National Privacy Commission at privacy.gov.ph.

Under the GDPR and the UK GDPR you may ask to access, correct, erase or restrict your data, to receive it in a portable form, and to object to its processing. You may also complain to your data-protection supervisory authority — in the UK, the Information Commissioner’s Office at ico.org.uk.

Depending on your state (for example, under the California Consumer Privacy Act), you may ask to know what we hold about you, to correct it and to delete it. We do not sell or share personal information, and we will not treat you differently for making a request.

You may ask to access, correct or delete your data, and exercise any other right the data-protection law of your country gives you, including complaining to its data-protection authority.

Write to dpo@kwikapps.app; we respond within 15 working days.

The KwikTime app

This part covers the KwikTime app: on phones and tablets from the app stores, and in a web browser. It also covers every KwikAPPS module that runs inside the app, such as KwikHR (hiring and employee records) and KwikSafe (safety records), including modules in beta testing. It applies in every country where the app is used.

Who is responsible

A company that uses KwikTime decides what it records about its workers and why. That company, the employer, is the controller of its workers’ data. KwikAPPS OPC processes that data for the employer and only on its instructions. KwikAPPS OPC is the controller of the account data of the people who set up and run a company’s account. If you are a worker, your employer is your first point of contact.

What the app collects, and how

• Account details. The name, email address and role of each person who signs in. For the company: its name, its country and, if given, its tax ID. When a company signs up, we also record the IP address the sign-up came from, to stop the same business from starting a second trial.
• Tax details for invoices (Philippine profile). When a company signs up it may give its business tax number (TIN). We use it to allow one free trial per business; a company can sign up without it, and then has no trial. For a sole proprietor the TIN is sensitive personal information, and giving it is your consent to this use. In the Philippine profile, before the first payment, the administrator gives the business’s BIR Form 2303 (a photo or PDF). The app reads it on the device first; the document and what was read are then sent to us and kept with our invoicing records, because the invoices we issue to the business rely on them. We store the registered name, registered address, TIN with its branch code, business style, RDO code and VAT status. The TIN and the reading are stored encrypted, and every time anyone opens the full TIN, who did it and why is recorded. If the device cannot read the document, a KwikAPPS staff member reads it; we do not send it to any outside reading service, and would name one in our list of service providers before we ever did. The tax law requires the buyer’s details on the invoices we issue (National Internal Revenue Code sections 113 and 237); where it does not, we use them because the company asked for them on its invoice. Only the company’s administrators can see them in the app, besides the KwikAPPS staff who issue invoices. We share them only with the Bureau of Internal Revenue, as the law requires, and with the hosting provider that stores them for us. They are kept for as long as our tax records must be (at least 5 years, under section 235 of the same Code, and up to 10 years under our books policy). You may see them, and ask for a correction, from the plan page.
• Worker records. What the employer enters about each worker: name, job role, employee ID, photo, phone number and home address, employment and pay details, and the times the worker checks in and out. If the employer fills in a worker’s bio-data, it can also hold the worker’s date and place of birth, civil status, sex, height, weight, blood type, nationality, religion, emergency contact, education, work history, references and signature, and government ID and tax numbers (in the Philippine profile: SSS, PhilHealth, Pag-IBIG and TIN). Worker records can also hold documents the employer uploads, such as a police clearance, birth certificate or medical certificate, and the employer’s performance reviews and records of infractions.
• Job applicants (KwikHR). If the employer uses KwikHR to hire, the app holds what the employer records about each applicant: name, the job applied for, the stage of the application, interview notes and scores, any offer made, documents the applicant provides (such as a CV, an ID or a certificate), the documents the applicant signs with the evidence of signing, and whether the applicant agreed to be contacted. The employer is the controller of this data, as it is for worker records.
• Contribution status, where a country’s rules need it. Some countries work out an employer’s social-security contributions differently depending on a worker’s status — for example whether they are a citizen, a permanent resident or a work-pass holder, and the date permanent residency began. Where that applies, the employer records it so the contribution is worked out at the right rate, and the app keeps the wages counted toward that country’s yearly contribution limit. It is visible only to the company’s administrators, not to other staff. We do not ask for, or store, any national identity, passport or work-pass number for this — only the status itself — and we do not check anyone’s status: the employer sets it and is responsible for keeping it right. Where a country’s rules do not use it, these fields stay empty.
• Face data. Face check-in is optional. Each employer decides whether to use it, and is responsible for asking each worker for consent. When a worker is enrolled, the app takes photos of the worker’s face and turns them into a face template, a set of numbers used to recognise that face. The enrolment photos are not uploaded. The template is stored in the organisation’s cloud database, so the employer’s other devices can recognise the worker. Matching a face to a template happens on the device. A worker whose recorded answer is No is never face-matched; they can be checked in with the code on an ID card the employer issues, or by an entry an administrator makes.
• Camera. Used to check a worker in or out by face, to scan an ID card, and to take the photos you choose to attach.
• Precise location. Read while the attendance screen is open, so each check-in and check-out records where it was made. It is also read when you tag the position of a site or of a safety incident, and approximately when you ask for access to a project. The app does not use your location in the background.
• Photos and videos you attach. For example to daily logs, reports, safety records and worker files. If the employer switches on check-in video clips, a short clip is recorded at each check-in and check-out.
• Microphone. Used only while you record a video to attach to a record.
• Signatures. On consent forms and on signed hand-over records. A hand-over record also stores the public IP address of the device that signed it.
• ID-card check. If the employer issues worker ID cards, anyone who scans the QR code on the front of a card can check whether the card is valid. For a valid card, the check shows the company and the worker’s photo, name, role and ID number.
• Notifications. If you switch notifications on, a device token from your phone’s or browser’s push service, so that alerts can reach you.
• Error reports. When something goes wrong, the app keeps a short technical note on the device: the time, where in the app it happened and the error message. These notes stay on the device. The organisation’s database keeps one status record per device, linked to the signed-in account, which its administrators can read: the device name, the app version, when the device last checked in and how much data it used this month. If KwikAPPS support asks, you can choose to send a summary of your recent notes to support: the time and type of each problem and the app version, without the error text. Support deletes a sent summary within 7 days. We use no third-party crash-reporting service.
• Service health. To keep the service running, KwikAPPS support staff can see a summary for each company: how many of its devices have checked in recently, which app versions they run, and how many attendance records our server refused and why. The summary does not show who used a device or any attendance record, and every time staff open it, that access is logged.

Why the app uses it

To record attendance, work out time records and pay, keep the employer’s records, run the company’s account, send service messages, and keep the service secure. Face data is used only to recognise a worker for attendance. The app shows no advertising, does not track you across other companies’ apps or websites, and we do not sell personal data.

Who else processes it

We use service providers in these categories, each bound by data-processing terms:

• a cloud database and sign-in service, which stores the organisation’s records and sends sign-in emails such as password resets;
• an email delivery service, for service emails such as welcome, trial and security notices;
• hosting for the web app and this website;
• the push service of your phone or browser maker, only if you switch notifications on;
• a public IP-lookup service, only when a hand-over record is signed.

If a company connects its own cloud drive, the app stores the company’s archived video clips and photos there, in the company’s own account. Face matching runs on the device, and in the store app spoken confirmations use the phone’s own speech engine. Signing in with an account from another service is not offered in the store app.

If a company switches on KwikAI Connect and gives the app a key to its own AI provider’s account, or connects its own AI assistant, the questions its users ask and the records needed to answer them go to that provider under the company’s own account and terms. That provider is the company’s choice, like its own cloud drive, not one of ours. We store the key encrypted, use it only to answer that company’s users, and never use the data to train an AI model.

A list of the providers we use is available on request to dpo@kwikapps.app.

How long it is kept

• Check-in video clips: deleted from the phone after 30 days. A copy archived to the company’s own cloud drive stays until the company deletes it.
• Face templates: until the employer erases them, or the day a company confirms the deletion of its account.
• Attendance and payroll records: for as long as the employer’s law requires. In the app’s Philippine profile, the keep period is 3 years for attendance records and 10 years for payroll records. In other countries, it is the period that country’s law sets.
• Everything else in a company’s account: for as long as the account is open, then as described below.

Deleting your data, and withdrawing consent

To delete your own login or a whole company, use Settings › Delete account in the app, or follow the steps on Delete your account. You do not need to be able to sign in.

To withdraw consent to face scanning, tell your employer: an administrator can erase your face template at any time. To ask for your worker records to be corrected or erased, ask your employer too. You can also write to dpo@kwikapps.app, and we will pass your request to your employer.

What we keep after an account is deleted

When a company is deleted, its workers, attendance records, photos and logins are deleted. When you delete your own login, the login is deleted. In both cases we keep only these records of our own:

• after a company is deleted, the company’s name and a one-way code made from its tax ID (the tax number itself is deleted when the company is), and its trial record (the sign-up email address and, where it was recorded, the sign-up IP address), so the same business cannot start another trial. They are deleted 3 years after the company is deleted;
• after a company is deleted, our billing records for the company: its plan and payment status. We keep them for as long as tax law requires, then delete them. In the Philippine profile, which governs our own books, that is 5 years from the day after the deadline for filing the annual tax return for the year the company was deleted;
• a deletion log: who asked for the deletion (their email address), when, and what was deleted. It holds no worker data. Each entry is deleted after 5 years;
• security incident records, which hold no free text. They are deleted after 90 days.

Changes

If this notice changes materially we will update the date at the top. The English text is the authoritative one.