Privacy Policy
Last updated: June 21, 2026
This document is available in English only. It is a legal text, so only the English wording is binding — we would rather not put an unreviewed translation in front of you.
1. Introduction
MIZROP("we", "our", or "us") operates a workforce management platform for small and medium-sized businesses. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our web application, mobile application, or any related services (collectively, the "Service").
We are committed to processing personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Data Controller
The data controller responsible for your personal data is MIZROP. You can contact us regarding data protection matters at privacy@mizrop.com.
3. What Personal Data We Collect
3.1 Account and Profile Data
- Full name and email address
- Business name and workspace details
- Phone number (optional, for SMS notifications)
- Profile photo (optional)
- Job position, department, and hourly wage (for payroll purposes)
- Date of birth (for age-based labor law compliance)
- Bank/IBAN information (encrypted, optional)
- BSN / tax identification number (encrypted, optional — Netherlands only)
- Emergency contact information (optional)
3.2 Work and Scheduling Data
- Shift schedules and work hours
- Clock-in and clock-out timestamps
- Break records
- Leave requests and approvals
- Availability preferences
- Skills and certifications
- Task completion records
3.3 Location Data
When you clock in or out via the mobile app, we collect your GPS coordinates solely to verify that you are within your assigned workplace geofence. Location data is not stored permanently — only the verified result (within / outside range) is saved alongside your time entry.
3.4 Device and Technical Data
- Device tokens for push notifications (FCM)
- IP address (for audit logs and security)
- Browser / OS type (for support purposes)
3.5 Communications
Messages sent through the in-app messaging feature are stored to provide the messaging service. Voice messages and media files are stored in encrypted cloud storage.
4. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Providing the workforce management service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Payroll calculation and reporting | Legal obligation (Art. 6(1)(c) GDPR) |
| Labor law compliance (e.g. Dutch ATW) | Legal obligation (Art. 6(1)(c) GDPR) |
| Sending shift and leave notifications | Legitimate interest (Art. 6(1)(f) GDPR) |
| Security, fraud prevention, audit logs | Legitimate interest (Art. 6(1)(f) GDPR) |
| Marketing communications (opt-in only) | Consent (Art. 6(1)(a) GDPR) |
5. How We Share Your Data
We do not sell your personal data. We share data only with the following processors:
| Processor | Purpose | Location |
|---|---|---|
| Google Firebase (FCM) | Push notifications to mobile devices | USA (SCCs) |
| Stripe | Subscription billing and payment processing | USA (SCCs) |
| Twilio (optional) | SMS notifications | USA (SCCs) |
| Cloud Storage Provider | File and document storage | EU |
| Email Provider (SMTP) | Transactional emails | EU or USA (SCCs) |
SCCs = Standard Contractual Clauses (EU-approved mechanism for international transfers).
6. Data Retention
- Active account data: retained for the duration of your subscription.
- After account deletion: data is soft-deleted immediately and permanently deleted after 30 days, unless a longer retention period is required by law (e.g. payroll records may be kept for 7 years under Dutch law).
- Audit logs: retained for 7 years (legal obligation).
- Push notification tokens: deleted when you sign out or uninstall the app.
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access: request a copy of your personal data.
- Right to rectification: correct inaccurate data.
- Right to erasure: request deletion of your data ("right to be forgotten").
- Right to data portability: receive your data in a machine-readable format.
- Right to restriction: limit how we process your data.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: where processing is based on consent.
To exercise any of these rights, contact us at privacy@mizrop.com. You can also download your data directly from the app: Settings → Download My Data. We will respond within 30 days.
You also have the right to lodge a complaint with your national supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
8. Cookies
The web application uses only essential cookies (authentication session, language preference). No third-party tracking or advertising cookies are used.
9. Security
We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest for sensitive fields (BSN, IBAN), role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.
10. Children's Privacy
Our Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via an in-app notification at least 30 days before the changes take effect.
12. Contact
For any questions about this Privacy Policy or our data practices:
Email: privacy@mizrop.com