Kore app privacy

This page covers the Kore mobile and desktop app. If you are looking for how this website handles data, see the website privacy page instead.

Kore is an app for running a construction company. It records when people start and stop work, so their employer can pay them correctly, and it helps the company plan its sites and keep track of its clients and quotes. Below is what it stores, who can see it, and how to get it removed.

This matters more than it sounds, because the answer depends on who you are.

If you are a worker: your employer is the data controller. They decide that your hours are recorded, who reviews them, and how long they are kept. Kore operates the software on their behalf, as a processor. To have your data corrected or deleted, ask your employer first — we act on their instructions, not around them.

If you signed your company up: you are the data controller for everyone you invite and for the clients you add, and you carry the duties that come with that under the GDPR. Kore is the controller only for your own account and billing details.

Kore is run by Salvatore Cartillone, based in Belgium. Contact: contact@getkore.be.

• Name, email address and role — to identify you and decide what you can see.
• Clock-in and clock-out times, and breaks — the core purpose, recording hours worked.
• The worksite you clocked in at — so hours reach the right job.
• Planned shifts — optional, and only if your employer chooses to plan.
• Hourly rate, pay totals and advances on pay — visible only to the people your employer allows, not to other workers.
• Language preference — so the app speaks your language.
• A notification token — to send reminders about your shifts.
• Company name and VAT number — checked against the EU VIES register to confirm the business is real.
• Corrections to hours — who changed what, when, and the reason given, so every change can be checked.
• The company’s clients — name, contact person, VAT number, email, phone, address, language and notes, as the company enters them to manage its clients.
• Quotes — the lines, prices and the client’s details on each quote.
• A scrambled (hashed) form of the IP address that asks for a VAT check — to stop the check being abused.
• Worksite addresses — the street, number, postal code and city of each site, as the company enters them, and, when the address was picked from the address search, its exact point on the map, so directions lead to the right place.

• No location tracking. Kore records the worksite you selected — not where your phone is — and it cannot follow you. One exception, on phones only: when you open the Sites page, and only if you allowed it, the app reads the phone’s location once to show which site you are standing at. That reading stays on the phone: it is compared with the sites and then forgotten, never stored, and never sent by the app to Kore or anyone else. Nothing reads your location on any other page, in the background, or on a computer.
• No contacts, photos, microphone or camera.
• No advertising identifiers. Nothing is sold or shared with advertisers, ever.
• No tracking pixels in our emails.

Under the GDPR, your employer relies on legal obligation — Belgian employers must keep accurate records of working time — and on contract, because recording hours is how you get paid what you are owed.

We do not rely on consent for these, because your hours are not optional to record. That also means you cannot be penalised for refusing consent to something you were never asked to consent to.

Inside your company, what each person sees depends on the permissions your employer sets. A worker sees their own hours; a manager or administrator may see their team’s. Pay figures are restricted.

Outside your company, your data is handled only by the services that make the app work:

• Supabase — database and sign-in. European Union.
• Resend — sends invitation and account emails. European Union.
• Google Firebase — delivers push notifications. May involve transfers outside the EU under the EU–US Data Privacy Framework.
• VIES (European Commission) — checks a VAT number is valid. European Union.
• Photon, the address search run by komoot (Germany) — when someone adds or edits a site or a client and types its address, the typed text is sent to find the real address (and, for a site, its exact point). Only that text: not who is typing, nor which company. When an address is entered by hand, only its postal code is sent, to fill in the city.
• Your phone’s own maps service (Apple or Google) — on a phone, a site whose address has no exact point is placed on the map with the phone’s built-in address lookup, which receives that address. And when you tap Directions, the site’s address or point is handed to the maps app you pick (Apple Maps, Google Maps or Waze).

We do not sell your data, and we do not share it with anyone else unless the law requires it.

Working-time records are kept as long as your employer’s legal obligations require — in Belgium this is generally five years for payroll and social-security records. Your employer sets the actual period, because it is their duty.

Clients and quotes stay in Kore while the company uses it, until the company deletes them.

If a company stops using Kore, its data is deleted within 90 days of the account closing, unless we are legally required to keep it longer.

Under the GDPR you can ask to see the data held about you, correct it, have it deleted where no legal duty requires it to be kept, receive a copy in a portable format, or object to and restrict certain processing.

Workers should ask their employer, who is the controller. If they do not respond, or you are not satisfied, contact us and we will help.

You can also complain to the Belgian supervisory authority — the Gegevensbeschermingsautoriteit / Autorité de protection des données, Rue de la Presse 35, 1000 Brussels — at dataprotectionauthority.be.