Privacy Policy

Version 2026-11-04. The English version is binding.

This Privacy Policy explains how Chaordic GmbH processes personal data when you visit gethourmark.com and when you use Hourmark at app.gethourmark.com. It is written to meet the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

1. Controller and contact

Chaordic GmbH, Langackerstrasse 5, 6330 Cham, Switzerland, UID CHE-170.553.058, is the controller for the processing described in this policy. Contact for data protection matters: [email protected].

2. Our role: controller or processor

• As controller, we process the data of website visitors and the account data of the people who use Hourmark (section 3).
• As processor, we process the data that our customers enter into Hourmark, such as time entries, leave, expenses, clients and invoices, on our customers' behalf and on their instructions (Annex A of the Terms of Service). For that data, the organization you work for or deal with is the controller; please address requests about it to them. We will assist them.

3. What we process, why, and on what legal basis

3.1 Visiting the website

• Delivery and security. The website is delivered by Cloudflare. When you visit it, your browser sends technical data (IP address, date and time, page requested, browser and operating system, referring page). Cloudflare processes it to deliver the pages and protect them against attacks. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).
• Language and region. When you open the start page, we use your browser's language setting and the country Cloudflare derives from your IP address to show you a suitable version. We do not store this information.
• Your choice of version. If you choose a region or language in the footer, a cookie (hm_site, one year) remembers that choice. It is strictly necessary to provide the function you asked for.
• Website statistics. We count visits to this website with Plausible Analytics, provided by Plausible Insights OÜ (Estonia) and hosted in the EU. Plausible sets no cookies and stores nothing on your device. For each page view, for clicks on links that lead off this website (such as to sign up) and for how far a page is scrolled and how long it stays open, your browser sends the page address, the referring page and the event to this website, which forwards it to Plausible together with your browser's user agent and your IP address. Plausible derives the country and the type of device and browser, and counts unique visitors with an identifier calculated from the IP address, user agent and website with a key that is replaced every day; it then discards the IP address and does not store the identifier, so visitors cannot be recognised across days or websites. We see only aggregate statistics. Legal basis: our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR). You may object at any time by writing to us. The statistics script also checks for a setting that our own staff use to exclude their visits, and reads nothing else from your device.
• We use no advertising or tracking cookies, and load no third-party scripts, fonts or embedded content: everything is served by this website.

3.2 Using Hourmark (account data)

• Account. Name, email address, password (stored only as a hash), language preference, email verification status, and your memberships and roles in organizations. Purpose: providing your account and the Service. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) or, where you use Hourmark for your employer or client, their and our legitimate interest in providing it to you (Art. 6(1)(f) GDPR).
• Sign-in sessions. When you sign in, we set a session cookie that is strictly necessary for staying signed in. For each session we store when it was created and last used, your browser's user agent and your IP address, so that you can recognise your sessions and we can detect misuse. A session expires 30 days after it was last used and is then deleted.
• Protection against automated sign-ups. The sign-up form asks your browser to solve a small computational task and checks hidden fields and timing. We count sign-up attempts per IP address in memory (not stored) and record used one-time tokens without any personal data. Legal basis: our legitimate interest in protecting the Service and third parties from abuse (Art. 6(1)(f) GDPR).
• Emails. We send the emails needed to operate your account and the Service (verification, password reset, sign-in links, invitations, approvals and notifications), and emails that our customers send through Hourmark, such as invoices to their clients.
• API tokens. If you create API tokens, we store them only as hashes, with their name and expiry.
• Audit log. Significant changes in an organization are logged with the person who made them, as part of the customer's data.
• Support. If you contact us, we process your message and contact details to answer it (Art. 6(1)(b) or (f) GDPR).
• Legal obligations. We keep data where the law requires it, for example accounting records (Art. 6(1)(c) GDPR).

We do not sell personal data, do not use it for advertising, and do not make decisions based solely on automated processing that produce legal effects for you or similarly affect you.

4. Recipients and sub-processors

We share personal data only with service providers who process it on our behalf and under contract, and where the law requires it.

Exchange rates are fetched from the European Central Bank; no personal data is sent.

5. Transfers abroad

The data of Hourmark is hosted in the European Union, which Switzerland recognises as providing adequate protection. Where a provider processes data in a country without adequate protection (for example Cloudflare in the United States), the transfer is based on the provider's certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework or on the EU Standard Contractual Clauses, as recognised by the Swiss Federal Data Protection and Information Commissioner.

6. How long we keep data

• Accounts whose email address is never verified are deleted after 7 days (on instances with open sign-up), together with organizations that nobody else has joined and that hold no issued documents.
• Sessions are deleted when they expire; links for verification, password reset and sign-in expire after at most 48 hours and are deleted 7 days after they expire.
• Account data is kept for as long as you have an account. Data in an organization is kept until the organization deletes it or is deleted; members who leave are archived by the organization rather than deleted, because the organization's records (for example time and working-time records) refer to them.
• Backups are kept for up to 30 days.
• Data we must keep by law (for example accounting records: 10 years) is kept for that period.

7. Your rights

Within the limits of the applicable law, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time where processing is based on consent. To exercise these rights, write to [email protected]. To delete your account, write to us; for data an organization holds about you, contact that organization (section 2).

You may lodge a complaint with a supervisory authority, in particular in the EU member state of your residence or work, or, in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC).

8. Security

We protect data with appropriate technical and organisational measures, including encryption in transit, separation of each organization's data in the database, passwords and tokens stored only as hashes, role-based permissions and an audit log. No system is perfectly secure; please use a strong, unique password and keep your API tokens secret.

9. Business use

Hourmark is a service for businesses and is not directed at children.

10. Changes

We may update this policy when our processing or the law changes. The version and date are shown at the top; we inform account holders of material changes by email or in the Service.