Version of 26 October 2026. This policy supplements article 6 of the terms of service. It describes the data processed by the Kangaruu website and service, why, for how long, with whom, and how to exercise your rights. The French version, available on the French site, prevails in case of discrepancy.
Controller and contact
Tooap SARL, a limited liability company (SARL) with a share capital of €2,000, registered office 18 chemin du Pérollier, 69130 Écully, France — SIREN 878 195 130 (Lyon Trade and Companies Register). For any question or request about your data: contact form.
Two roles depending on the data
- Your account, our exchanges, billing: we are the controller.
- Your employees’ data (time entries, absences, payroll data, activity history, ideas): you remain the controller; we act on your behalf as a processor within the meaning of article 28 of the GDPR, only to provide the Service. You inform your employees of this processing.
Data processed, purposes and legal bases
- Account (e-mail, name, company, role, invitations): to open and secure your space and your Users’ — performance of the contract.
- Time entries, absences, projects, tasks, validations: to produce timesheets and reports — performance of the contract, on your behalf.
- Imported payroll data: to compute hourly costs and project costs — performance of the contract, on your behalf.
- Imported activity history (for example Git): to match activity with time entries — performance of the contract, on your behalf.
- Ideas, challenges, votes, partners, public form answers: to manage your organisation’s innovation — performance of the contract, on your behalf.
- Browser notification subscription, if you enable it: to remind you to log your day — consent, which you can withdraw in your settings.
- Acceptance of the terms (version and date), billing: proof of agreement, accounting obligations — legal obligation and legitimate interest.
- Server logs (IP address, page requested, date, browser): security, troubleshooting, traffic measurement without trackers — legitimate interest.
No data is sold or used for advertising.
Recipients
- Authorised staff of Tooap SARL (support, administration), bound by confidentiality.
- The people you invite: your Users according to their role, and your Advisor with read-only access if you allow it.
- OVH (application hosting and backups, France).
- DigitalOcean (hosting of the kangaruu.io website): server logs.
- Our payment provider, for subscription payments: card data is processed by it alone.
- Your browser’s notification service (Google, Mozilla or Apple), only if you enable notifications: it carries a short message, without your data.
- Formbricks, on forms.compass-financement.com: the information entered in the contact form.
Retention periods
- Account and Customer Data: during the subscription; deleted on request, and at the latest 6 years after the last login. Export your validated timesheets: they support your time records during the tax audit period.
- Acceptance of the terms, invoices: 5 years after the end of the relationship (10 years for accounting documents).
- Server logs: 12 months.
- Backups (encrypted): 14 rolling days.
Security
Encrypted connection (HTTPS), encrypted passwords, session cookies not accessible to scripts, separation of each customer’s data, limited administrator access, encrypted nightly backups, application hosted in France.
Your rights
You may request access to your data, its rectification or erasure, the restriction of or objection to processing, data portability, and set instructions for what happens to it after your death. Write to us using the contact form: we reply within one month. Your employees address requests about their data to you, as controller; we help you answer them. If you believe your rights are not respected, you may lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
Cookies
The Service only sets strictly necessary cookies: the session cookie, which keeps you signed in, and the cookie that protects forms against forged requests. They are exempt from consent. The website remembers your choice on the cookie banner and loads no audience measurement or advertising tool; traffic is measured from server logs, without any tracker in your browser. The contact form is loaded from forms.compass-financement.com (Formbricks), which applies its own cookie rules.