jeCheck Privacy Policy

Effective date: October 20, 2026

This Policy explains how the jeCheck team ("jeCheck", "we", "us") processes personal data when you visit https://jecheck.io, register for and use the jeCheck service (the web workspace at https://app.jecheck.io, the mobile apps and the API, together the "Service"), contact us or receive our emails.

The website and the Service are operated by Individual Entrepreneur "DADENOVA" (Aknur Bakhytovna Dadenova, IIN 910812400209, 90/54 Kanysh Satpayev Street, Block 4, Almaly District, Almaty, Republic of Kazakhstan). Contact details are on the Legal notice page.

The Policy follows the principles of the EU General Data Protection Regulation (GDPR): lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality.

1. Who is responsible for your data

1.1. jeCheck as controller. We determine the purposes of processing for data of website visitors, people who submit a request, customer administrators and contact persons, community forum members and recipients of our emails.

1.2. jeCheck as processor. Customer companies use the Service to work with their staff: they add users, schedules, audits, tasks and tests, and upload photos and videos. For this data, the customer company (your employer or client) is the controller, and jeCheck processes it only on that company's behalf and in accordance with the Terms of Service. If you are a customer's employee and want to know about your data or exercise your rights, please contact your employer first; we will help them respond to your request.

1.3. For any questions about personal data, contact us at [email protected] (subject: "Personal data").

2. What data we process

2.1. Account and contact data: first and last name, email address, phone number, job title, company name, country, interface language, password (stored as a hash).

2.2. Billing data: selected plan, invoice and payment history, company details for invoicing. Card details are processed by the payment provider; we receive only the payment status and limited details about it (for example, the last digits of the card).

2.3. Data customers enter into the Service (we process it as a processor, see Clause 1.2): staff and user data, locations and positions, work schedules and clock-in/clock-out records, including geolocation at the time of clock-in, audit results, photos, videos and audio recordings, tasks and comments, test results including camera snapshots in strict test mode, HR documents.

2.4. Requests and correspondence: support messages, messages to the website chat consultant, demo requests, community forum posts, emails to us.

2.5. Technical and usage data: IP address, device and browser type, operating system, language, pages and features you use, date and time of actions, error and security logs, mobile device identifier for push notifications.

2.6. Cookies and similar technologies — see Section 8.

2.7. We do not seek to process special categories of data (health, religious or political beliefs, biometrics for identification, etc.) and ask customers not to enter them into the Service without a lawful basis. Camera snapshots in strict test mode are used to ensure the integrity of a test attempt, not for biometric identification.

3. Purposes and legal bases

Purpose	Data	Legal basis
Registration, providing the Service, sign-in and account maintenance	account, technical data	performance of a contract
Payments, invoicing, accounting and tax records	billing data, account	performance of a contract; legal obligation
Responding to requests, support, handling demo requests	requests, contacts	performance of a contract or pre-contractual steps; legitimate interest
Service notices (security, changes to terms, invoices)	contacts	performance of a contract; legitimate interest
Marketing emails about the product and useful content	name, email, usage data	consent or legitimate interest (for existing customers), with the option to unsubscribe at any time
Security, preventing abuse and fraud	technical data, logs	legitimate interest
Analytics and improving the website and Service	usage data, cookies	consent (for non-essential cookies); legitimate interest for anonymized statistics
Protecting rights and complying with legal requirements	data needed for this	legal obligation; legitimate interest

Where we rely on legitimate interest, we assess that it is not overridden by your rights and interests. You can object to such processing (Section 7).

4. AI features

4.1. Some features of the Service (audit analysis and reports, the AI assistant, creating tests and checklists, transcribing recordings, the website consultant) use artificial intelligence models from third-party providers. Only the part of the data needed for a specific request is sent to the provider.

4.2. We use AI providers on terms under which the data sent is not used to train their models and is retained only for a limited time for security purposes.

4.3. AI output is for assistance only. Decisions with legal or similarly significant effects on individuals are made by people, not solely by automated means.

5. Who we share data with

5.1. We do not sell personal data and do not share it with third parties for their own marketing.

5.2. We share data only to the extent necessary to operate the Service, with the following categories of recipients (processors) bound to us by data protection agreements:

cloud infrastructure providers — server, database and file hosting;
content delivery and attack protection networks, bot protection for forms;
email and SMS delivery and receipt providers, push notification services;
payment providers;
artificial intelligence model providers (Section 4);
web analytics and customer support services.

An up-to-date list of processors is available on request at [email protected].

5.3. Within a company account, a user's data is visible to other users of that company within the permissions set by the customer.

5.4. We may disclose data where required by law, a court order or a lawful request from a public authority, or to protect the rights, safety and property of jeCheck, our customers and others. In a reorganization or sale of the business, data may pass to a successor, who must comply with this Policy.

6. International data transfers

Our servers and providers may be located in different countries. Where data is transferred to a country that does not provide a level of protection recognized as adequate for the country of origin, we apply appropriate safeguards — Standard Contractual Clauses approved by the European Commission or equivalent mechanisms — together with supplementary technical measures (encryption in transit and at rest). You can request a copy of the safeguards we use at [email protected].

7. Your rights

7.1. Depending on applicable law, you have the right:

of access — to find out whether we process your data and obtain a copy;
to rectification — to correct inaccurate or complete incomplete data;
to erasure ("right to be forgotten") — to have data deleted where there is no longer a basis for keeping it;
to restriction of processing — to temporarily restrict processing, for example while the accuracy of data is being verified;
to data portability — to receive data you provided in a structured, machine-readable format or have it transferred to another service;
to object — to processing based on legitimate interest, and to direct marketing at any time without giving reasons;
to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal;
not to be subject to a decision based solely on automated processing that has legal effects on you;
to lodge a complaint with a data protection supervisory authority in the country where you live, work or where the alleged infringement took place.

7.2. You can change most account data in your profile. You can unsubscribe from emails via the link in any email. For other requests, email [email protected]. We respond within one month; for complex or numerous requests this may be extended by two further months, in which case we will let you know. To protect your data, we may ask you to verify your identity.

7.3. If your request concerns data entered into the Service by your employer or client (Clause 1.2), we will forward it to that company and help it respond.

8. Cookies and similar technologies

8.1. Essential cookies enable sign-in, security, form protection and remembering your language and currency. The website and Service cannot work without them, so consent is not required.

8.2. Analytics cookies help us understand how the website and Service are used and improve them. Where required by law, we use them only with your consent.

8.3. You can delete or block cookies in your browser settings; some features may then not work properly.

9. How long we keep data

account data — while the account is active; after deletion, up to 30 days to allow recovery and export, after which it is deleted, and removed from backups within no more than 90 days;
data customers enter into the Service — on the customer's instructions and within the periods set out in the Terms of Service;
payment and accounting records — for the period required by law;
support requests — up to 3 years after the request is closed;
website requests that did not lead to a contract — up to 2 years;
mailing data — until you unsubscribe; after that we keep only your address on a suppression list so we don't email you again;
technical security logs — up to 12 months.

When the retention period ends, data is deleted or irreversibly anonymized.

10. How we protect data

We apply technical and organizational measures appropriate to the risks: encrypted connections (TLS), password hashing, role-based access control on a least-privilege basis, logging of access to sensitive data, separation of different companies' data, regular backups, software updates, and confidentiality obligations for staff. If a data breach poses a risk to your rights, we will notify the supervisory authority and the affected individuals within the timeframes set by applicable law, and our customers without undue delay.

11. Children

The Service is intended for businesses and their staff and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with their data, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy. The current version, with its effective date, is always available at https://jecheck.io/en/privacy. We will notify you of material changes in advance by email or in the workspace.

13. Contact

Send questions, requests and complaints about the processing of personal data to [email protected] with the subject "Personal data".