Privacy Policy
Effective 28 September 2026
1. Who we are and what this Policy covers
In this Policy "Clock", "we", "us" and "our" mean Klok AD (doing business as Clock Software), Ofis 504, Sgrada B8, Biznes Park Varna, 9009 Varna, Bulgaria, registration number 207049288, and Clock Software Ltd, 27 Redcliffe Gardens, London SW10 9BH, United Kingdom, company number 08008667. Klok AD develops and operates the Clock service and is the main operating company; its processing is governed by the law of the European Union and Bulgaria. From 1 January 2027 Klok AD is the contracting company for all customers. Full company details are on our Legal page.
This Policy describes how Clock handles personal data as a data controller — that is, personal data of people who deal with Clock directly: visitors of our websites, prospective customers, contacts of Affiliated Hotels, partners and suppliers, and applicants.
It does not cover the personal data processed in the Clock service and in the guest-facing apps (booking engine, online check-in, guest portal, guest messaging) — reservations, guest profiles, payments and similar. That data is processed on behalf of the Affiliated Hotels: the Affiliated Hotel is the controller and Clock is the processor, acting on its instructions under Addendum 1 (Data Processing) to the Service Terms. If you are a guest of an Affiliated Hotel, the hotel's own privacy notice governs your data, including the cookies used on its booking and check-in pages; requests concerning it should be addressed to the hotel.
Clock's products are designed for businesses. If you contact us about using them, we treat you as a business contact unless you tell us otherwise. Our relationship with Affiliated Hotels is governed by the Service Terms.
2. What we collect
Depending on how you deal with us: identification and contact details (name, business, role, address, email, telephone); the content of your enquiries and correspondence; contractual and billing details of the business you represent; usage data of our websites (IP address, device and browser information, pages visited, approximate location) collected through cookies and similar technologies; and, for applicants, the information in your application. We do not seek special categories of data and ask you not to send them to us.
3. Why we use it, and on what legal basis
Responding to enquiries, demos, quotes and correspondence — our legitimate interest in running our business and, where you represent a customer, the performance of the contract with that customer.
Contracting, invoicing, support and account management — performance of the contract with the business you represent, and our legal obligations (accounting, tax).
Marketing — newsletters, product news, invitations and, where lawful, direct marketing to business contacts: our legitimate interest in promoting our products, or your consent where the law requires it. You can opt out at any time (section 8).
Improving our websites and products — our legitimate interest, using aggregated usage statistics; non-essential cookies and analytics run only with your consent (section 5).
Security, fraud prevention and the establishment or defence of legal claims — our legitimate interest.
Compliance with law — where a law or a competent authority requires it.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Who receives your data
We share personal data only with: service providers acting on our instructions (listed in Appendix 1); our two companies, between themselves; professional advisers; and public authorities where the law requires. Our providers are established in the EEA or the United Kingdom, or in countries covered by an adequacy decision, or are bound by the EU standard contractual clauses; details are available on request.
5. Cookies and analytics
Our websites use cookies and similar technologies. Strictly necessary cookies (session, security, language) require no consent. Analytics and marketing cookies — including Google Analytics and Microsoft Clarity — are set only after you accept them through the cookie banner shown on your first visit. You can withdraw your consent at any time by deleting the cookies in your browser, after which the banner is shown again; your browser settings also let you refuse cookies altogether, although some features may then not work.
6. How long we keep it
We keep personal data only as long as necessary for the purpose it was collected for, using the following criteria: for enquiries and prospective customers, as long as there is an active relationship or a reasonable expectation of one; for contacts of Affiliated Hotels, for the duration of the agreement and any period during which claims may be made under it; for contractual, invoicing and accounting records, for the period required by accounting and tax law (up to ten years); for applicants, for the duration of the recruitment process unless you agree to be considered for future positions; for website analytics, for the period set in the analytics tool. Where you ask for deletion earlier and no legal obligation prevents it, we delete without undue delay.
7. Security
Clock applies technical and organisational measures appropriate to the risk — access control, encryption in transit and at rest, staff confidentiality undertakings and training, monitoring and incident response — and reviews them regularly. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.
8. Your rights
You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing (including to direct marketing at any time), to receive it in a portable format, and — where processing is based on consent — to withdraw that consent without affecting earlier processing. Write to hello@clock-hs.com; we respond within one month. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority; the authority competent for Clock is the Bulgarian Commission for Personal Data Protection (cpdp.bg).
9. Changes
We may update this Policy. Material changes are announced on our website and, where you have an account or subscription with us, by email; the version and date at the top always identify the current text.
Appendix 1 — Service providers of Clock as controller
Providers that process personal data on Clock's behalf for the purposes in this Policy. (This list concerns Clock's own operations. The sub-processors engaged for the Clock service on behalf of our customers are listed separately in Addendum 1 (Data Processing), Schedule C, to the Service Terms.)
CRM and marketing: HubSpot, Mailchimp
Support ticketing: Freshdesk
Hosting and storage: Amazon Web Services (Ireland), Google Cloud
Workflow automation: Zapier
Data exports, storage and reporting: Stitch Data, Google Drive, Microsoft OneDrive, Google Looker Studio
Website analytics: Google Analytics, Microsoft Clarity
Proposals and internal tools: Glide, AppSheet, Google Drive
Accounting and billing: QuickBooks, Chargebee, PayPal, Stripe, GoCardless
Change log v1.0 → v2.0 (remove before publication)
Scope narrowed to Clock as controller. Sections 5 ("Our Security Measures" on "Customer Personal Data", data centres, staff control, encryption) and 6 ("Data Incidents") of v1.0 were processor-side language; replaced by a short controller-side security section and a pointer to Addendum 1 for customer data (section 1.3).
References updated: "General Terms and Conditions for End Users of Clock PMS Suite – Labelled Software" → Service Terms; "Data Processing Agreement" → Addendum 1; company roles after 1 January 2027; link to the Legal page for entity details.
Guest-facing apps kept out of scope: Clock acts there as processor for the Affiliated Hotel (booking, check-in, portal, messaging, and the cookies on the hotel-branded pages); the hotel's notice governs (section 1.3). Any use by Clock of aggregated usage data for service improvement belongs in Addendum 1, not in a notice to guests — to be checked in Addendum 1.
Terminology: "Affiliated Hotel(s)" used throughout, consistent with the Service Terms.
Legal bases stated per purpose (Art. 13 GDPR) and consent by disclosure removed — v1.0's "by disclosing any personal data to us you explicitly accept… profiling… cookies" is not valid consent under the GDPR/ePrivacy rules; cookies now consent-based via banner (section 5).
Added mandatory items missing in v1.0: right to lodge a complaint with a supervisory authority (CPDP named as the competent authority; no other authority listed — the Art. 77 right to complain elsewhere exists by law and the text does not exclude it), retention criteria under Art. 13(2)(a) (criteria rather than fixed periods, except the statutory accounting retention), international transfer safeguards, statement on automated decision-making.
Appendix 1 relabelled as providers of Clock-as-controller, with an explicit pointer to Addendum 2 to prevent confusion between the two lists.
Cookie consent is managed by the HubSpot cookie banner; withdrawal is described via browser cookie deletion (re-triggers the banner) — no settings link needed.