Privacy Policy

1. Introduction

TTK SOLUTIONS d.o.o., Knespolje bb, 88220 Knespolje, Bosnia and Herzegovina ("TTK Solutions", "we", "us" or "our") respects your privacy and is committed to protecting the personal data it processes in connection with the peopleHub platform.

peopleHub is a platform designed for organizations and their employees and is available through a web application and mobile apps for iOS, Android and Huawei devices, including distribution via the Apple App Store, Google Play and the Huawei AppGallery ("Service").

Depending on the features an individual employer has activated, peopleHub enables management of employee requests, time tracking, documents, payslips, internal notifications and communication, equipment, surveys and training, and, where enabled, meal ordering.

peopleHub is not intended for the general public and is not intended for children as end users. Access to peopleHub is generally granted to an employee by their employer.

This Privacy Policy explains:

• which personal data peopleHub may process;
• for what purposes the data is processed;
• on what legal bases;
• with whom the data may be shared;
• how long the data is retained;
• how we protect the data;
• what rights you have regarding your personal data.

The scope of data processed depends on the features your employer has activated and how they are used.

2. Who is responsible for processing your data?

When using peopleHub, different roles in data protection may apply.

2.1. Your employer as controller

Your employer, i.e. the organization that has granted you access to peopleHub, is generally the controller for personal data processed for the purpose of managing the employment relationship.

This applies in particular to:

• employment data;
• leave and annual holidays;
• time tracking records;
• payroll and payslip data;
• employee requests;
• equipment data;
• internal surveys and activities;
• documents related to the employment relationship;
• other data whose purpose and manner of processing is determined by the employer.

The employer determines which peopleHub features it uses, which data it enters and processes, who has access to that data, and how long the data needs to be retained, in accordance with applicable regulations.

Since peopleHub allows configuration of its own custom fields, forms, requests and other features, the data processed through the platform may differ between individual users of the Service.

The employer is also responsible for ensuring that the data and content it enters or enables to be entered through peopleHub are lawful, appropriate and necessary for the specific business purpose.

2.2. TTK Solutions as processor

When TTK Solutions processes employee data on behalf of the employer and in accordance with its documented instructions, TTK Solutions acts as a processor.

This includes, in particular, hosting, storage, display and technical processing of data necessary to provide peopleHub's features.

TTK Solutions does not use the employee data it processes on behalf of the employer for its own advertising, nor does it sell it to third parties.

TTK Solutions processes data within the scope of its role as processor and in accordance with its contractual obligations toward the employer as controller.

2.3. TTK Solutions as an independent controller

TTK Solutions may act as a controller for certain data necessary for its own business operations and technical management of the Service, for example:

• security and audit logs;
• data necessary to prevent misuse;
• technical and diagnostic data;
• communication with users and customer support;
• data necessary to establish and defend legal claims;
• data necessary to administer its own business relationship with customers.

In such cases, TTK Solutions independently determines the purpose and manner of processing in accordance with applicable regulations.

If you are unsure who is responsible for a particular processing activity, you may contact the peopleHub administrator at your employer or TTK Solutions using the contact details in Section 19.

3. What data do we process?

Depending on the features used by your employer, peopleHub may process the following categories of data.

3.1. Account and identity data

We may process:

• first and last name;
• peopleHub ID or employee code;
• employer name;
• department;
• job title;
• employment status;
• user role and permissions;
• work email address;
• mobile phone number, if used by the employer;
• profile photo, if you upload one yourself;
• user interface language;
• data necessary for authentication.

Passwords are stored as a cryptographic hash and are not stored in plain text.

If sign-in via Microsoft Entra ID is enabled, we may process basic identifiers of the organizational Microsoft account, such as name, work email address and tenant identifier, for authentication purposes.

3.2. Employment data

Employment data may be entered directly into peopleHub or synchronized from the employer's HR/ERP system. This may include:

• organizational affiliation;
• department;
• job title;
• employment status;
• data necessary for the organizational structure;
• other data the employer chooses to use within its HR processes.

3.3. Family member data

If the employer enables benefits related to employees' children, an employee may voluntarily enter: the child's first and last name, the child's date of birth, and other data necessary for the specific benefit.

This data is not required for general use of peopleHub.

3.4. Requests, approvals and workflows

peopleHub may process the content of employee requests, including:

• annual leave;
• leave of absence;
• sick leave;
• business trips;
• equipment requests;
• expenses;
• loans or advances;
• other requests enabled by the employer.

We may also process attachments, photos, documents, comments, approval or rejection decisions, the date and time of individual activities, and data about the user who performed a given action.

Special categories of personal data

Documents or photos uploaded by a user may contain special categories of personal data, including health data. For example, a photo of a medical certificate or sick-leave slip may contain health data.

TTK Solutions does not use such documents for advertising, profiling or other purposes of its own. When we process them as part of the employer's HR processes, we process them as a processor acting on the employer's instructions.

peopleHub does not analyze or automatically interpret the health-related content of such documents unless a specific feature expressly provides for such processing and appropriate legal and technical safeguards have been put in place for it.

3.5. Payroll and financial data

If the employer uses the relevant module, peopleHub may provide access to digital payslips. Payslips are generally generated in the employer's payroll system, while peopleHub provides secure access to them for the employee.

We may also process data about available payslips, access dates, download dates, loan data, advances, and the amounts and statuses of financial requests.

3.6. Working time

If the feature is enabled, peopleHub may process time-tracking records, clock-ins and clock-outs, monthly confirmations, data on hours worked, and data required for employer reporting.

3.7. Equipment

If the employer uses the equipment management module, we may process data about equipment assigned to the employee, such as equipment type, inventory number, assignment date, return date, and equipment status.

3.8. Internal communication and engagement

peopleHub may process survey responses, quiz answers, comments, messages, attachments to messages, read receipts, reactions and likes, data on participation in training, and results of activities enabled by the employer.

3.9. Meal ordering

If the module is activated, we may process meal orders, meal selections, dietary labels entered by the user, and data necessary for delivery.

If a user manually selects a delivery location on a map, the address or location they chose may be processed. peopleHub does not access the device's GPS location to determine the delivery location.

3.10. Technical and diagnostic data

We may automatically process IP address, date and time of requests, request logs, device model, operating system, app version, language and time-zone settings, error data, app crash data, performance data, and data necessary for account security.

If needed to send push notifications, we process the device's push token and platform (iOS/Android).

3.11. Security and audit data

To protect the Service, we may log sign-in attempts, failed sign-in attempts, security events, PIN entry attempts, changes to user settings, and other events relevant to system security.

This data is used to detect and prevent misuse, brute-force attacks and other security incidents.

3.12. Support communication data

If you contact us, we may process your name, email address, message content, files or other attachments you send us, and data necessary to resolve your request.

4. How do we collect data?

We may obtain data:

Directly from you

When you edit your profile, submit a request, upload a document, upload a photo, order a meal, take part in a survey or activity, or contact support.

From your employer

The employer may provide or synchronize basic employee data from its HR/ERP system.

Automatically

Technical, security and diagnostic data may be collected automatically while you use the Service.

Through Microsoft

If sign-in via Microsoft Entra ID is enabled, basic organizational account data may be received from Microsoft for authentication purposes.

5. Legal bases for processing

Depending on the specific processing activity, the legal basis may include:

Performance of a contract

When processing is necessary to provide peopleHub's features or to perform a contractual relationship.

Legal obligation

When particular processing is necessary to comply with legal obligations, for example obligations related to employment, tax, accounting or time-tracking records.

Legitimate interest

When processing is necessary for system security, preventing misuse, maintaining and improving the reliability of the Service, resolving technical issues, protecting legal claims, or administering a business relationship.

Where processing relies on legitimate interest, we carry out an appropriate balancing assessment where required.

Consent

When consent is required for a specific optional processing activity, for example for certain voluntary data or features.

Consent may be withdrawn at any time for future processing based on that consent. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Special categories of personal data

When processing involves special categories of personal data, including health data, additional conditions and an appropriate legal basis apply under applicable regulations.

Within HR features, that purpose and legal basis is generally determined by the employer as controller.

6. Purposes of processing

We process personal data for the purposes of:

• creating and administering a user account;
• authentication;
• providing peopleHub's features;
• managing employee requests;
• time tracking;
• enabling access to documents and payslips;
• internal communication;
• equipment management;
• surveys, training and other internal activities;
• meal ordering, if the feature is enabled;
• sending push and email notifications;
• maintaining security;
• preventing fraud and misuse;
• diagnosing technical issues;
• providing customer support;
• complying with legal obligations;
• establishing or defending legal claims.

7. Sharing data with other parties

We do not sell personal data and do not use employee data for third-party advertising.

Data may be made available to:

• your employer and its authorized users;
• our subprocessors, as necessary to provide the Service;
• competent authorities, when legally required;
• other recipients, when there is an appropriate legal basis for doing so.

7.1. Subprocessors

Depending on the peopleHub configuration, we use the following providers:

Subprocessors process data only to the extent necessary to provide their services and, where applicable, under an appropriate data processing agreement.

The list of subprocessors may be updated as we change service providers or introduce new technical components.

7.2. Content entered by users

peopleHub enables employers and authorized users to enter, upload, publish and exchange various types of content, including text, documents, photos, comments and other materials.

The employer is responsible for the content that it or its authorized users enter, upload or publish through peopleHub, and for ensuring that such content is lawful, appropriate and compliant with applicable regulations.

peopleHub must not be used to publish, store or distribute content that is unlawful, threatening, violent, pornographic or sexually explicit, discriminatory, racist, constitutes hate speech, is defamatory, or is otherwise contrary to applicable regulations or the rights of third parties.

TTK Solutions, in its role as processor, generally does not determine the content that the employer or its users enter into peopleHub, nor is it responsible for the lawfulness of such content, which is under the employer's control.

The employer is responsible for establishing appropriate rules, controls and procedures for content its users publish through peopleHub.

If TTK Solutions receives a report or otherwise becomes aware of content that is clearly unlawful, poses a security risk, or represents a serious violation of these rules, it may take appropriate technical or organizational measures, including restricting access to the content or feature, to the extent permitted by applicable regulations and contractual obligations.

This provision does not limit any liability of TTK Solutions that cannot be excluded or limited under applicable regulations.

8. International data transfers

peopleHub primarily uses infrastructure located in the European Union, including hosting with Hetzner Online GmbH at a selected EU location.

However, certain technical service providers may be companies established outside the EU/EEA, or may in certain circumstances process data outside the EU/EEA.

TTK Solutions is headquartered in Bosnia and Herzegovina.

Where the processing of personal data involves a transfer of data outside a country in which applicable data protection regulations establish specific rules for international transfers, TTK Solutions applies appropriate mechanisms permitted under applicable regulations.

For users from the EU/EEA, where applicable, mechanisms provided for under Chapter V of the GDPR may be used, including adequacy decisions, the European Commission's Standard Contractual Clauses (SCCs), or other permitted mechanisms.

TTK Solutions and the relevant customer, where necessary, agree on appropriate data protection mechanisms and other contractual measures.

TTK Solutions takes appropriate technical and organizational measures to protect data during such processing.

9. Data retention and deletion

We retain personal data only for as long as necessary for the purpose for which it was collected, or as necessary to comply with legal obligations, perform a contract, or protect legitimate interests.

When TTK Solutions acts as a processor, data retention periods are determined by the employer as controller, in accordance with applicable regulations and its internal rules.

TTK Solutions handles data in accordance with the employer's documented instructions and agreed rules on retention, deletion or return of data.

Once the need for processing ends, or in accordance with the employer's instructions and applicable contractual obligations, data is deleted, returned or anonymized, unless there is a legal obligation to retain it further.

If particular data is needed for a judicial, administrative or other legal proceeding, it may be retained until the proceeding concludes and the relevant limitation periods for legal claims expire.

10. Your rights

Depending on applicable regulations, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data when the conditions for doing so are met;
• request restriction of processing;
• object to particular processing;
• request data portability, where applicable;
• withdraw consent where processing is based on consent;
• lodge a complaint with the competent data protection supervisory authority.

Some rights may be limited where there is a legal obligation to retain data or another legally permitted reason.

If the data is part of a record controlled by your employer, we may forward your request to the employer as controller.

We respond to data subject requests without undue delay and, as a rule, within one month of receiving the request. In cases permitted under applicable regulations, this period may be extended, and we will inform you accordingly in due time.

10.1. Automated decision-making and profiling

peopleHub does not currently carry out automated decision-making that produces legal or other significant effects for users, nor does it create employee profiles for the purpose of making such decisions.

If a feature involving automated decision-making or profiling subject to specific requirements of applicable regulations is introduced in the future, this Privacy Policy will be updated accordingly.

11. Account and data deletion

Employee user accounts are managed by the employer's administrator. The employer may create, modify, deactivate or remove employee user accounts within the features available in peopleHub.

TTK Solutions manages the user accounts and access of organizations that use peopleHub.

Deletion of a user account or data may be requested from the employer or directly from TTK Solutions at legal@ttk.solutions.

Where the employer is the controller, TTK Solutions will process the request in cooperation with the employer and in accordance with its instructions.

Deleting an account does not necessarily mean immediate deletion of all data. Data that must be retained due to a legal obligation, accounting, the employment relationship, a legal proceeding, or another valid legal basis may be retained for the necessary period.

12. Data security

We apply appropriate technical and organizational measures to protect personal data. These measures may include:

• TLS/HTTPS encryption of data in transit;
• access control based on user roles;
• restricting administrator privileges;
• protecting user passwords through secure hashing;
• PIN hashing;
• protection against brute-force attacks;
• security and audit logs;
• backups;
• restricting access to documents;
• infrastructure protection;
• monitoring of system availability and security;
• security incident response procedures.

Data stored on peopleHub infrastructure is protected by appropriate technical measures, including encryption where supported and applicable.

TTK Solutions applies an information security management system in accordance with ISO/IEC 27001, along with appropriate technical and organizational measures to protect information assets and personal data.

In the event of a security incident involving personal data, TTK Solutions acts in accordance with applicable regulations, its own security incident management procedures, and its contractual obligations toward the relevant controller.

Where TTK Solutions acts as processor, it will notify the relevant controller of an incident that may constitute a personal data breach, in accordance with applicable regulations and agreed procedures.

Although we take reasonable and appropriate protective measures, no system for transmitting or storing data can be guaranteed to be completely secure.

13. Cookies and similar technologies

The peopleHub web application uses cookies and/or local storage only to the extent necessary for:

• authentication;
• maintaining a user session;
• security;
• basic app settings.

peopleHub does not use third-party advertising cookies and does not use personal data to track users across other companies' websites.

Where Cloudflare Turnstile is used, a technical token or other security signal may be processed as needed to verify that a request is not from an automated bot.

14. Mobile app permissions

peopleHub may request the following permissions.

Camera

Used when a user chooses to photograph a document, photograph an attachment for a request, or set a profile photo.

Photos / gallery

Used to select an existing photo or document that the user wants to upload.

Push notifications

Used to notify you about request status, approvals, internal posts, and other events enabled by the employer.

peopleHub does not require access to:

• precise GPS location;
• approximate device location;
• contacts;
• microphone;
• call history;
• SMS messages.

If a user enters a meal delivery location on a map, that location is selected manually and is not obtained by reading the device's GPS sensor.

15. Tracking, advertising and data sales

peopleHub is not an advertising platform. We do not:

• sell personal data;
• rent out personal data;
• use employee data for third-party advertising;
• build employee profiles for advertising purposes;
• track users across other companies' apps or websites for advertising purposes.

The technical tools used for security, diagnostics, and providing the Service's features are not used to sell personal data.

16. Children's data

peopleHub is intended for employees and is not intended for children as users.

In certain cases, an adult employee may enter data about their child, for example to claim benefits the employer provides for employees' children. Children do not use peopleHub as end users.

Data about children is processed only for the specific purpose for which it was submitted by the employee or employer, and is not used for advertising or profiling.

The employer is responsible for ensuring the lawfulness of any processing of children's data it collects or processes through peopleHub.

17. Apple App Store, Google Play and Huawei AppGallery

peopleHub is available through the Apple App Store, Google Play and the Huawei AppGallery, and may become available through other app stores as well.

Information about the categories of data collected and shared in these stores should correspond to the actual technical implementation of the app and this Privacy Policy.

Depending on the current rules of each platform, the declared categories may include:

• personal data;
• contact data;
• user content;
• photos and documents;
• financial data related to payslips or loans;
• in-app activity data;
• diagnostic data;
• identifiers related to push notifications.

Apple

peopleHub does not use personal data for tracking users for advertising purposes, or for linking data from the app with data from other companies for advertising purposes.

Google Play

Data necessary for peopleHub to function may be processed and shared with infrastructure and technical service providers acting within their functions, including the subprocessors described in Section 7.

Huawei AppGallery

Data necessary for peopleHub to function may be processed and shared with infrastructure and technical service providers acting within their functions, including the subprocessors described in Section 7.

Other platforms

If peopleHub is distributed through other app stores, we will adapt our privacy disclosures to the rules and categories required by that specific platform.

We will regularly align the information in app stores with the actual implementation of peopleHub.

18. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time in order to:

• reflect changes to peopleHub;
• introduce new features;
• change service providers;
• respond to changes in the law;
• improve the clarity or transparency of our processing.

The date of the last amendment is shown at the top of this Policy.

If an amendment represents a significant change to the way we process personal data, we will take appropriate steps to notify users before or at the time the change takes effect, where required under applicable regulations.

19. Contact

For questions about this Privacy Policy, the protection of personal data, or exercising your rights, you may contact us at:

TTK SOLUTIONS d.o.o.
Knespolje bb
88220 Knespolje
Bosnia and Herzegovina

Email: legal@ttk.solutions

For questions relating to the processing of data within your employment relationship, you may also contact your employer's peopleHub administrator or HR department.

20. Closing note

This Privacy Policy describes how peopleHub processes personal data at the platform level.

For specific HR processing activities, your employer may have additional privacy policies, internal rules, retention periods and legal bases that apply to its processing of personal data.

If there is a discrepancy between this Policy and your employer's specific policy relating to a particular HR process, the information and rules determined by your employer as controller shall apply to that process, in accordance with applicable regulations.

peopleHub / TTK Solutions d.o.o. — Version 1.0, August 2026