1. Who is responsible?
For the platform website, account administration, security, subscription billing, and direct support, the data controller is ActinHub. Contact: noreply@actinhub.com.
For workforce, attendance, leave, qualification, staffing, client, and payroll-related data inside a customer workspace, the relevant Customer normally determines the purposes and means and is therefore the data controller. We generally act as its data processor under a data-processing agreement. Questions about employment records or a workspace decision should first be directed to that organization.
2. Data we process
- Account and identity data: name, email address, authentication information, organization membership, role, verification status, and security settings.
- Workforce and operational data: employee identifiers, contact details, contracts, availability, schedules, attendance, breaks, corrections, leave, qualifications, documents, requests, approvals, comments, and audit history.
- Client-service data: client companies, sites, contacts, staffing requests, assignments, time decisions, disputes, commercial rates, invoices, credits, and reconciliation references.
- Billing data: plan, subscription status, invoice details, payment status, tax and billing identity. Payment-card data is handled by the payment provider and is not stored in full by us.
- Technical and usage data: IP address, timestamps, device and browser information, session identifiers, tenant context, security events, request identifiers, queue and delivery status, and diagnostic logs.
- Communication data: support requests, notification preferences, email and push delivery information, announcements, and workspace messages.
3. Purposes and legal bases
Processing is governed by the GDPR and the Danish Data Protection Act (databeskyttelsesloven). Depending on the context, processing is based on performance of a contract or steps requested before contract formation (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c)), legitimate interests (Article 6(1)(f)), or consent (Article 6(1)(a)). Our legitimate interests include operating a secure and reliable service, preventing abuse, supporting customers, maintaining auditability, improving performance, and establishing or defending legal claims.
Customers are responsible for identifying their own legal bases for workforce processing under Danish employment and data-protection law, including any additional Article 9 condition and national-law basis required for special-category data.
4. Cookies, sessions, and push notifications
Under the Danish cookie rules, storage or access that is not technically necessary requires prior information and consent. ActinHub uses necessary cookies and browser storage to maintain secure sessions, protect forms against cross-site request forgery, remember essential state, and provide tenant-specific offline functionality. Optional technologies will be activated only with the required consent. Web-push notifications require browser permission and can be withdrawn in browser or account settings.
5. Recipients and service providers
Data is accessible only to authorized users and personnel who need it. We may use vetted providers for hosting, infrastructure, backups, email, push delivery, monitoring, customer support, and payment processing. Stripe may process billing and payment data when Stripe billing is enabled. Customer-authorized payroll or accounting exports are disclosed to the recipient chosen by the Customer.
We require processors to protect data and use it only on documented instructions. We may disclose information where required by law, necessary to protect rights or security, or involved in a corporate transaction subject to appropriate safeguards.
6. International transfers
Where a recipient processes personal data outside the European Economic Area and no adequacy decision applies, we use an appropriate transfer mechanism such as the European Commission’s Standard Contractual Clauses and, where necessary, supplementary safeguards. Customers should review the agreed subprocessor information for their deployment.
7. Retention
We retain account and contract data while the relationship is active and thereafter as required by statutory retention periods or legitimate claim-preservation needs. Security logs are retained for a proportionate period. Workspace data is retained and deleted according to Customer instructions, the contract, backup cycles, and applicable law. Some records—such as issued invoices, credits, approvals, and audit evidence—may require longer retention and should not be silently rewritten.
8. Automated processing
ActinHub may rank potentially suitable workers using configured qualifications, position fit, availability, scheduling conflicts, and recorded operational preferences. The result is a recommendation for an authorized human decision-maker. We do not use the platform to make solely automated decisions that produce legal or similarly significant effects on behalf of Customers.
9. Security
We use technical and organizational safeguards appropriate to risk, including access controls, tenant separation, encryption in transit, password hashing, multi-factor authentication capabilities, audit records, restricted support access, backups, and operational monitoring. No system is completely risk-free. Users must protect credentials and report suspected incidents promptly.
10. Your rights and complaints
Subject to the legal conditions, you may request access, rectification, erasure, restriction, data portability, and objection. Where processing relies on consent, you may withdraw it prospectively. Requests concerning workspace employment or client records should normally be addressed to the relevant Customer; we assist Customers with valid requests as required.
You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, through datatilsynet.dk. You may also contact another competent supervisory authority where applicable.
11. Changes and contact
We may update this policy when processing activities, legal requirements, or service features change. Material changes will be communicated appropriately. Privacy questions and requests relating to processing for which we are controller may be sent to noreply@actinhub.com.