Privacy Policy

This policy explains how Hrono processes users’ personal data under the General Data Protection Regulation (GDPR) and how you can exercise your rights.

Hrono is an internal company system for time tracking and project management. It is used by employees and partners of “Brīvs” Ltd.

1. Controller and contact

The controller of personal data is SIA “Brīvs” (“Brīvs” Ltd.), registration No. 40003826013, legal address: Ieriķu iela 3-201, Riga, LV-1084, Latvia. “Brīvs” Ltd. processes the data as the employer and as the operator of Hrono.

Send questions about the processing of personal data and data subject requests to support@hrono.lv.

2. Data we process

Account data: e-mail address, username, first and last name, password hash, two-factor authentication secret and security key data, time of last login.
Employee profile data in an Organization: name, e-mail address, phone number, position, employment start date, profile picture, Skype username, roles and teams.
Work data: time entries, timers, work days, monthly timesheets, absences and their attached files, tasks, comments, files attached to projects and, where they are recorded, pay rates.
Organization data: name, registration number, legal address and integration settings.
Security and technical data: audit log records of actions in the system, session data, access tokens and error data.

3. Purposes and legal basis

Purpose	Legal basis
Account creation, login and access to Hrono features	Performance of the employment or cooperation contract (GDPR Art. 6(1)(b))
Recording working time, absences and pay	The employer’s legal obligations and performance of the employment contract (GDPR Art. 6(1)© and (b))
Project and task management, teamwork	Performance of the employment or cooperation contract (GDPR Art. 6(1)(b))
System security: audit log, two-factor authentication, protection of the registration and password reset forms against automated abuse	The legitimate interest of “Brīvs” Ltd. in keeping the system and data secure (GDPR Art. 6(1)(f))
Detecting and fixing errors	The legitimate interest of “Brīvs” Ltd. in keeping the system working (GDPR Art. 6(1)(f))
Licence purchase	Performance of a contract (GDPR Art. 6(1)(b))

Hrono makes no automated decisions and performs no profiling that affects you. Hrono uses no analytics or advertising tools.

4. Recipients and processors

Personal data is accessible only to users whose role in the Organization allows it, for example Organization administrators and managers. Outside Hrono, data is passed only to these recipients:

Sentry (sentry.brivs.lv): our self-hosted error monitoring system. It receives the user ID and error data: the error message, the stack trace and database queries.
hCaptcha and Cloudflare Turnstile: check that a human fills in the registration and password reset forms. They receive the verification token and your IP address. The providers of these services may process data outside the European Union.
Yubico: verifies the YubiKey one-time password when you log in with a YubiKey. It receives only the one-time password.
SalePoint (ltech.lv): the licence purchase system. It receives the user and Organization identifiers, the Organization name, your name, e-mail address and the licence tier only when you start a licence purchase.
E-mail delivery: our mail server receives the recipient’s e-mail address and the message content, for example invitations, password reset links and reminders.
Backup orchestrator: the external backup process receives the database backup, which holds all Hrono data.
LDAP directory: when Hrono login is configured with LDAP, the username and password are verified against the configured LDAP server.
Systems connected by the Organization: when an Organization enables an integration, for example Jira or GitLab, Hrono exchanges data with the system the Organization specifies.

We may disclose data to law enforcement agencies, courts or other public authorities when the law requires it.

5. Retention periods

Account and profile data is kept while you have a Hrono account or a membership in an Organization.
Working time and other work data is kept while the Organization exists, or as long as the law requires.
Deleting an Organization deletes all of its data, including the audit log.
A session ends, and its data is deleted, after 24 hours of inactivity or on logout.
Backups are kept for 30 days and then deleted.
Error data in Sentry is kept as long as it is needed to fix errors.

6. Cookies

Hrono uses only one strictly necessary cookie, session_id. It keeps your login session and expires after 24 hours of inactivity. This cookie needs no consent. Hrono uses no analytics, advertising or other tracking cookies.

7. Your rights and how to make a request

You have the right to:

access your personal data and receive a copy of it;
rectify inaccurate data;
request erasure of your data, unless the law requires it to be kept;
request restriction of processing;
receive your data in a structured, machine-readable format (data portability);
object to processing based on legitimate interests.

To exercise these rights, write to support@hrono.lv from the e-mail address linked to your Hrono account. If needed, we will ask you to confirm your identity. We will answer within one month of receiving the request.

8. Right to lodge a complaint

If you believe that your personal data is processed unlawfully, you have the right to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv). We encourage you to contact us first so that we can resolve the matter.

9. Changes to this policy

We will update this policy when the processing of data in Hrono changes. The current version is always available on this page.

Last updated: 1 October 2026.