← Back to Wrok

Privacy Policy

Last updated: June 29, 2026

One section pending confirmation. Section 9 (International Transfers) is awaiting confirmation of the specific transfer safeguards used by each processor. All other sections, including the identity of the data controller, are final. Questions: privacy@wrokapp.com.

1. Introduction

Wrok ("Wrok", "we", "our", "us") is a shift scheduling and team management application for employers and their teams. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable national data protection laws. Our website is wrokapp.com.

This policy explains what personal data we collect, why we collect it, the lawful basis for each use, who we share it with, how long we keep it, and the rights you have over it.

2. Data Controller

The data controller responsible for your personal data is:

Where your employer (the Boss who created the workplace) uploads or manages data about you as part of running their workplace, that employer may act as a separate or joint controller for employment record-keeping purposes. In that case the employer is responsible for the lawfulness of its own use of your data, and you may also direct requests to them.

3. Personal Data We Collect

We collect and process the following categories of personal data:

4. Purposes and Lawful Bases

We only process your personal data where we have a lawful basis under the GDPR. The table below maps each category to its purpose and lawful basis.

DataPurposeLawful basis
Account data Create and operate your account; authenticate you; provide the service. Contract (Art. 6(1)(b)).
Schedule and employment data Generate schedules, manage shifts, swaps, day-off requests, attendance and tasks. Contract (Art. 6(1)(b)); for the employer's workforce management, legitimate interest (Art. 6(1)(f)).
Sick and vacation data (special category) Record leave so the workplace can be staffed and managed. Art. 6(1)(b) plus Art. 9(2)(b) (processing necessary for carrying out obligations and exercising rights in the field of employment law).
Push notification tokens Deliver push notifications about schedule changes, swaps, and workplace events. Consent (Art. 6(1)(a)) - you opt in.
Crash and error reporting Detect, diagnose, and fix crashes and errors to keep the app stable and secure. Legitimate interest (Art. 6(1)(f)). On by default with an easy opt-out in settings.
Usage analytics Understand how the app is used and improve it (anonymized events only). Consent (Art. 6(1)(a)) - strictly opt-in, off by default.
Location data (clock-in) Verify workplace attendance when you check in. Consent (Art. 6(1)(a)) - only when you trigger check-in.
Purchase data Manage subscriptions and provide access to paid features. Contract (Art. 6(1)(b)).
Retained worker record after deactivation Keep a deactivated worker's name and work history so the employer can continue to manage the workplace and meet record-keeping obligations. Legitimate interest and employment record-keeping (Art. 6(1)(f); Art. 6(1)(c) where a legal retention duty applies). See Section 7.
Consent records Demonstrate that consent was obtained and honour your choices. Legal obligation / legitimate interest (Art. 6(1)(c) and (f)).

5. Special-Category (Health) Data: Sick and Vacation

A record that a worker is on sick leave can reveal information about that person's health and is therefore special-category data under Article 9 GDPR. We process this data on the basis of Article 9(2)(b): processing is necessary for the purposes of carrying out the obligations and exercising the specific rights of the employer or the worker in the field of employment law, as authorised by EU or national law. We collect only what is needed to manage staffing (that a person is absent and the dates) and apply role-based access controls so that only authorised people in the workplace can see it. We do not collect medical diagnoses or doctor's notes through the app.

6. Data Sharing Between Roles

To enable workplace management, certain data is visible to other roles within the same workplace:

7. Data Retention

We keep personal data only as long as necessary for the purposes for which it was collected, and then delete or anonymize it, unless a longer period is required by law.

8. Processors and Third-Party Services

We use the following processors and service providers. Each processes data only on our instructions under a data processing agreement (DPA), except payment providers who act as independent controllers for payment data.

We do not sell your personal data.

9. International Transfers

Some of the processors above may process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the relevant data processing agreements (DPAs). [CONFIRM SPECIFIC TRANSFER MECHANISM AND PROCESSOR LOCATIONS]. You can request a copy of the relevant safeguards by contacting privacy@wrokapp.com.

10. Your Rights

Under the GDPR you have the right to:

You can exercise export and account-deletion rights directly in the app. For any other request, contact privacy@wrokapp.com.

11. Data Security

12. Cookies and Tracking

The mobile application does not use cookies. Analytics and crash reporting are governed by the bases in Section 4: analytics is strictly opt-in, and crash reporting runs on legitimate interest with an opt-out. You can change these choices at any time in the app's Privacy & Legal settings. The web app presents a cookie/consent banner for tracking preferences.

13. Children's Privacy

Wrok is not intended for anyone under the age of 16. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. The "Last updated" date above indicates the most recent revision.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at privacy@wrokapp.com.