Privacy Policy

1. Data Controller

Timero is owned and operated by HOFFET AS, org. no. 923 935 703.

Address: Måltrostveien 2, 3243 Kodal, Norway

Email for privacy inquiries: post@timero.net

We are the data controller for personal data processed on this website and through the service.

This privacy policy applies to both use of timero.no and the Timero app available via the App Store and other platforms.

2. Data Controller and Processor Roles

For personal data related to user accounts, subscriptions, and administration of the Service, HOFFET AS is the data controller.

For personal data that business customers register in Timero (for example employee information, time entries, customer data, and invoice data), HOFFET AS acts as data processor on behalf of the customer, who is the data controller.

Use of the Service entails that a data processing agreement in accordance with GDPR Article 28 is entered into.

The data processing agreement is available on request or is entered into electronically when using the service.

3. What personal data we process

We only process personal data that is necessary for the purposes described below.

3.1 Information you provide to us: Name, email address, phone number, password (stored encrypted) or other login information, information you provide in contact forms, support inquiries, or on your user account, and any payment information (if applicable).

3.2 Information collected automatically: IP address, device and browser information, usage data (pages visited, login times, interaction with the service), and cookies – see section 10.

4. Purpose of processing

We use personal data for the following purposes:

• To deliver the service and manage your user account

• For customer service and to respond to inquiries

• For security, including preventing abuse and unauthorized access

• To improve the website and technical performance

• To comply with legal requirements, e.g., accounting obligations

• For marketing, but only if you have given explicit consent

5. Legal basis (GDPR Art. 6)

We process personal data based on one or more of the following legal grounds:

• Consent (Art. 6(1)(a)) – for newsletters, marketing, or voluntary information

• Contract (Art. 6(1)(b)) – necessary to create user account and deliver the service

• Legal obligation (Art. 6(1)(c)) – e.g., bookkeeping requirements

• Legitimate interest (Art. 6(1)(f)) – e.g., security, operations, and analytics

We perform a balancing of interests when legitimate interest is used.

6. Sharing of personal data

We may share personal data with:

• Infrastructure and hosting providers

• Analytics providers (e.g., Google Analytics)

• Payment providers

For subscription and payment we use:

• Stripe (payment via the website)

• RevenueCat (subscription management in the mobile app)

• Apple App Store and Google Play (for in-app purchases)

Stripe, RevenueCat, and the app stores may be independent data controllers for their processing of payment and transaction data.

We do not store or process full payment card details. Such data is processed directly by the payment providers.

Necessary data processing agreements are in place where required.

We never sell personal data.

7. Transfer of personal data outside EU/EEA

Some of our providers, including Stripe, RevenueCat, and Google, may process personal data in the USA. Transfers are made in accordance with applicable transfer mechanisms, including the EU Commission's Standard Contractual Clauses (SCC) or other lawful mechanisms.

You can contact us for information about which transfers apply to your use.

8. Storage and deletion

Personal data is stored only as long as necessary for the purpose.

Typical retention periods:

• User account: as long as the account is active

• Support inquiries: 12 months

• Accounting data: 5 years (bookkeeping law)

• Marketing consents: until you withdraw consent

You can request deletion of your account at any time, unless we have legal requirements for further retention.

9. Your rights

You have the following rights under GDPR:

• Right of access

• Right to rectification

• Right to erasure

• Right to restriction of processing

• Right to data portability

• Right to object to processing based on legitimate interest

• Right to withdraw consent at any time

To exercise your rights, contact us at: post@timero.net

We respond to all inquiries within 30 days.

You also have the right to complain to the Data Protection Authority (Datatilsynet) (www.datatilsynet.no) if you believe your rights are not being respected.

10. Cookies

We use cookies to ensure functionality, analyse use, and improve the service.

Detailed information about which cookies we use, storage period, and purpose can be found in our cookie declaration: https://timero.net/cookies.

We obtain consent for non-essential cookies in accordance with the ePrivacy Directive.

11. Security

We implement technical and organizational measures to protect personal data, such as:

• Encrypted communication (HTTPS)

• Access control

• Secure storage

• Regular security procedures

12. Changes to the privacy policy

We may update this policy as needed. The current version will always be available on this page. We will notify users clearly of significant changes.

Contact us

If you have questions about privacy or wish to exercise your rights, you can contact us at post@timero.net.