Privacy Policy

At Kraaft, respecting your privacy is essential. This Privacy Policy is intended to explain our data practices, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR").

It describes the information we collect, why we collect it, how we use and share it, and the measures we take to protect the confidentiality and security of your information. It also explains your data protection rights and how to exercise them.

Unless otherwise stated, when we refer to "Kraaft", "our", "ours" or "we", we mean Kraaft SAS, a simplified joint-stock company (SAS) with share capital of €2,278.66, registered with the Nanterre Trade and Companies Register under number 847 598 117, with its registered office at 14 rue d'Uzès, 75002 Paris, France.

This privacy policy ("Privacy Policy") applies to all of our applications, services, features, software and websites (together, the "Services").

⛔️ Minimum age. Our Services are intended for professional use and are not directed at individuals under the age of 15. We do not knowingly collect data relating to individuals below this age.

1. The role of Kraaft and your employer

Kraaft's role varies depending on the category of data concerned.

Kraaft acts as a Processor for:

worksite data;
the personal data of our Clients' end users.

For this data, your employer (or the entity that gives you access to Kraaft, our "Client") is the Controller: it determines the purposes and means of the processing. Kraaft processes this data on its behalf and on its instructions, in order to provide the Services set out in the contract.

Kraaft acts as a Controller for:

the data of its own Clients (contractual relationship, billing);
the data of its prospects and its marketing data;
the data of its employees (HR).

2. The information we process

Kraaft receives or collects information when we operate and provide our Services, in particular when you install, access or use them.

2.1. Information you and your employer provide

Account information: to create your Kraaft account, your employer provides us with, or you provide, basic information such as your last name, first name, work email address, phone number and role. You can also add further information to your profile, such as a photo.

Content you generate: we process the content you create and share through our Services: text messages, audio messages, photos, videos, completed forms, location data (if enabled) and documents you upload. This content is processed to provide the communication and worksite-tracking features on behalf of your employer.

Support information: if you contact us with a support request, we process the information you provide in order to assist you (for example: description of a problem, screenshots, exchanges with support).

2.2. Information collected automatically

Usage and log information: we collect information about your activity on our Services, such as the features you use and the date and time of your activities. This information helps us diagnose problems, and improve and secure our Services.

Device and connection information: we collect information about your device (model, operating system) and your connection (IP address) when you use our Services. This technical data is essential to ensure the compatibility and security of our Services.

Cookies: we use only cookies strictly necessary for the operation and provision of our Services, in particular for our web services. They help us remember your preferences and secure your session. We do not use any advertising or analytics cookies.

3. How we use the information (purposes of processing)

For worksite data and end-user data, we use the information we process solely on the instructions of your employer (the Controller) and for the purpose of:

Providing, improving and securing our Services: operating and providing our Services, which includes user assistance, bug fixing, personalizing the experience and protecting against threats.‍
Ensuring contractual compliance: fulfilling our contractual obligations towards your employer.‍
Complying with legal obligations: processing information to comply with a legal obligation.

The legal basis for this processing is the performance of the contract between us and your employer (Article 6(1)(b) GDPR), which itself relies on the legal basis of the performance of your employment contract or your employer's legitimate interest.

For processing where Kraaft is the Controller, the legal bases are:

Contractual necessity and legal obligation for managing client accounts and billing;‍
Consent and legitimate interest for prospecting and marketing;‍
Legitimate interest for support logging and platform security;‍
Legal obligation and performance of the employment contract for HR management and payroll.

4. Hosting and sharing of information

Data hosting: your data is securely hosted on the servers of our processor Google Cloud Platform (GCP), located within the European Union (Belgium and the Netherlands).‍
Sharing of information: we do not sell, rent or share your personal data for commercial purposes. We may use sub-processors (listed below and in the Data Processing Agreement entered into with your employer) that help us provide our Services. They are subject to strict confidentiality and security obligations.‍
Data transfers outside the EU: Kraaft does not transfer your personal data outside the European Union. Should one of our sub-processors do so, such transfer would be governed by appropriate safeguards compliant with the GDPR.

4.1. Sub-processors involved in processing application users' data

If you are a Kraaft user (you access the application via your employer), the following sub-processors are involved in processing your data in the course of providing the Services. For this data, Kraaft acts as a processor on behalf of your employer.

4.2. Sub-processors involved in processing Clients' and prospects' data

If you are a Kraaft Client or prospect (commercial, contractual or marketing relationship), the following sub-processors are involved in processing your data. For this data, Kraaft acts as a controller.

5. Data retention periods

We retain your personal data only for as long as necessary for the purposes described, extended where applicable by statutory limitation or archiving periods.

Once the applicable periods have expired, the deletion of your data is final and irreversible. Kraaft may only retain anonymized data for statistical purposes. In the event of litigation, the relevant data is retained for the entire duration of the handling of the matter.

Full deletion cycle: deletion from the production database is immediate upon instruction; data disappears from backups managed by Kraaft after 30 days; backups managed by Google Cloud Platform are erased within a maximum of 180 days. The total time for the complete and final deletion of all copies may therefore reach approximately 7 months (210 days).

6. Your rights and how to exercise them

In accordance with the GDPR, you have several rights concerning your personal data:

Right of access: to know whether we process data concerning you and to obtain a copy.‍
Right to rectification: to request the correction of inaccurate or incomplete information.‍
Right to erasure ("right to be forgotten"): to request the deletion of your personal data. Your account will then be anonymized: your contributions (messages, photos) will remain visible but will no longer be associated with your name.‍
Right to data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.‍
Right to object and to restriction of processing: to object to or request the restriction of the processing of your data in certain circumstances.‍
Post-mortem directives: you may set directives regarding the fate of your personal data after your death, and where applicable designate a third party responsible for carrying them out.

How to exercise your rights?

For worksite data and your end-user data, since your employer is the Controller, you must send any request directly to your employer. In accordance with our contractual and legal obligations, Kraaft will assist your employer in responding to your request as quickly as possible.

If you contact Kraaft directly, we will redirect you to your employer and notify them of your request to ensure it is handled promptly. Kraaft acts only on the written and documented instructions of its Client.

You may also delete your account directly from the application's settings. This action results in the anonymization of your contributions as described above.

For processing where Kraaft is the Controller (client relationship, prospecting, HR), you may exercise your rights by contacting us at dpo@kraaft.co. Proof of identity may be requested in case of doubt. We respond as quickly as possible, with a maximum of three months for complex requests. We may refuse to respond to any manifestly unfounded or excessive request, in particular a repetitive one.

7. How do we protect your data?

We implement appropriate technical and organizational measures to ensure the security and confidentiality of your data and to prevent any risk of destruction, loss, alteration or unauthorized access.

These measures include, in particular, securing infrastructure, encrypting communications, secure authentication mechanisms, and internal control and security-awareness procedures.

A detailed description of the security measures implemented by Kraaft is available at: www.kraaft.co/securite.

8. Contact

For any question relating to this Privacy Policy or the processing of your personal data, we invite you to contact our Data Protection Officer (DPO):

By email: dpo@kraaft.co

If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the competent supervisory authority:

CNIL – Complaints Department

3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Phone: +33 1 53 73 22 22 — www.cnil.fr

9. Changes to the Privacy Policy

We may amend this Privacy Policy at any time to adapt it to new legal requirements and to any new processing we may implement. The applicable version is the one published on our Services on the date of your consultation.

Last update @25 août 2026

‍