Office Shark Privacy Policy

1. Who We Are

Office Shark is operated by:

Legal Company Name: "HOTBOX" d.o.o. SarajevoRegistered Address: Krka 62, 71000 SarajevoCountry: Bosnia and HerzegovinaEmail: box@hotbox.baWebsite: https://hotbox.ba

For privacy questions, requests, or complaints concerning your personal data, you may contact us using the information above.

2. How Office Shark Handles Workplace Data

Because Office Shark is designed for use by organizations, it is important to distinguish between two types of data processing.

When your employer, company, or another organization provides you with access to Office Shark and uses the Service to manage workplace attendance, schedules, breaks, or employee participation, that organization generally determines the purposes for which employee data is processed.

In those circumstances, the organization may act as the data controller and Office Shark may process the relevant data on the organization's behalf.

The organization may determine matters such as:

• which employees are invited to Office Shark;
• which working days and hours apply;
• whether attendance records are maintained;
• how long workplace records are retained;
• which administrators can access workplace information;
• how Office Shark data is used within the organization.

For certain information, such as your Office Shark account, customer support communications, service security, billing, and operation of the platform, Office Shark may act as a data controller.

Where applicable, the respective organization remains responsible for providing employees with any additional notices required by applicable employment and data protection laws.

3. Personal Data We May Collect

The information we collect depends on how you use Office Shark and on how your organization configures the Service.

A. Account and profile information

This may include:

• name;
• email address;
• profile information;
• account identifier;
• company or organization;
• employee or team role;
• authentication information;
• account creation and login information.

B. Workplace activity information

When the Service is used for workplace attendance, we may process:

• check-in timestamps;
• check-out timestamps;
• break start and end timestamps;
• return-to-work timestamps;
• scheduled working hours;
• scheduled workdays;
• attendance status;
• late or early attendance information;
• missed check-out information;
• work and break durations;
• points or game rewards earned from activity;
• food or similar game progress;
• missions and challenges;
• team membership;
• leaderboard information;
• raid or team-game participation;
• other activity generated through the Office Shark system.

C. Schedule information

If your organization uses Office Shark's scheduling features, we may process information such as:

• working days;
• working hours;
• planned breaks;
• schedule adjustments;
• schedule acceptance or rejection;
• schedule-related preferences or settings.

D. Technical information

We may automatically receive technical information needed to operate and secure the Service, such as:

• IP address;
• device type;
• operating system;
• app version;
• language and region settings;
• crash information;
• diagnostic information;
• login and authentication logs;
• security and fraud-prevention information.

E. Support information

If you contact us, we may collect:

• your name;
• email address;
• organization;
• contents of your communication;
• information needed to resolve your request.

F. Information you provide voluntarily

Depending on the features available in your version of Office Shark, you may provide additional information such as profile details, team information, or other information submitted through the Service.

4. Information We Do Not Currently Require

As of the Effective Date of this Privacy Policy, Office Shark does not require access to:

• precise GPS location;
• contacts;
• microphone;
• camera;
• health or fitness information;
• biometric information.

If these technologies are introduced in the future, we will update this Privacy Policy and, where required, provide additional notices or request permissions before using them.

5. How We Use Personal Data

We may use personal data for the following purposes:

Providing the Service

We use information to:

• create and maintain accounts;
• authenticate users;
• operate workplace attendance features;
• calculate attendance-related game progress;
• operate teams, missions, rewards, leaderboards, and raids;
• generate and display schedules;
• provide notifications and reminders;
• provide customer support;
• synchronize information across devices.

Security and reliability

We may use information to:

• protect accounts;
• prevent abuse and fraud;
• detect unauthorized access;
• investigate technical problems;
• monitor and improve service reliability;
• maintain system security.

Service improvement

We may use aggregated or de-identified information to understand how Office Shark is being used, diagnose problems, improve functionality, and develop new features.

Where practical, we use aggregated or de-identified information for these purposes rather than identifiable employee records.

Legal and compliance purposes

We may process information where necessary to:

• comply with legal obligations;
• respond to lawful requests;
• protect our rights;
• establish, exercise, or defend legal claims;
• enforce our Terms of Service.

6. AI-Powered Scheduling

Some Office Shark features may use artificial intelligence to generate or recommend work schedules.

Depending on the feature, the information provided to an AI scheduling system may include information such as working days, working hours, break settings, and other scheduling parameters.

AI-generated schedules are recommendations and may not always be appropriate, accurate, or optimal for an individual employee.

Office Shark does not intend for AI-generated schedules to independently make decisions about:

• hiring;
• termination;
• salary;
• promotion;
• disciplinary action;
• employment status.

Organizations remain responsible for reviewing and using schedule recommendations appropriately.

We will not intentionally provide unnecessary personal information to an external AI service when it is not required for the relevant feature.

If a third-party AI service is used to process information, that provider may act as a service provider or subprocessor, subject to appropriate contractual and security requirements.

7. Legal Bases for Processing

Where applicable data protection law requires a legal basis for processing personal data, the applicable basis may include:

• performance of a contract with you;
• taking steps at your request before entering into a contract;
• compliance with a legal obligation;
• legitimate interests of Office Shark or the relevant organization, where those interests are not overridden by applicable rights;
• consent, where consent is required or appropriately relied upon.

For workplace data processed on behalf of an organization, the organization is generally responsible for determining the appropriate legal basis under applicable employment and data protection law.

8. Who Can Access Your Data

Access to personal data depends on the type of data and the way your organization uses Office Shark.

Your employer or organization may be able to access workplace information associated with your account, including attendance records, schedules, breaks, team information, points, and other information made available through administrative features.

Other employees may see limited information through features such as:

• team membership;
• team progress;
• leaderboards;
• challenges;
• rewards;
• other game features enabled by the organization.

The exact information visible to other users may depend on your organization's configuration.

Office Shark personnel may access personal data only where reasonably necessary to operate, maintain, secure, support, or improve the Service, or where required by law.

9. Service Providers and Third Parties

We may use trusted third-party service providers to help operate Office Shark.

Depending on the technologies used in the Service, these providers may include companies providing:

• cloud hosting;
• databases;
• authentication;
• infrastructure;
• analytics;
• crash reporting;
• email or notification delivery;
• customer support;
• AI processing;
• security services.

Third-party providers are permitted to process personal data only as necessary to provide their services to us or the relevant organization, subject to appropriate contractual or legal safeguards.

We do not sell personal data to data brokers.

We do not use workplace attendance information for third-party advertising.

10. International Data Transfers

Office Shark and its service providers may process or store information in countries other than the country where you live or work.

Where applicable law requires safeguards for international transfers, we will use legally recognized mechanisms and appropriate contractual or technical safeguards.

Information about our relevant service providers and subprocessors is available on request at box@hotbox.ba.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.

For workplace data processed on behalf of an organization, retention may be determined by the organization's instructions, contractual arrangements, and applicable legal requirements.

When an organization requests deletion of workplace data, we will delete or return the relevant data in accordance with our agreement with that organization, subject to legal retention requirements.

For individual Office Shark accounts, we will delete or anonymize personal data when it is no longer needed for the purposes for which it was collected, subject to legitimate retention requirements.

Some information may remain temporarily in encrypted backups before being permanently overwritten.

12. Account Deletion

Where the Service allows you to create a personal Office Shark account, you may request deletion of your account and associated personal data.

You can request deletion through our contact form or by contacting box@hotbox.ba.

When your account is deleted, we will delete associated personal data unless we are legally required or otherwise legitimately permitted to retain particular information.

For workplace accounts controlled by an organization, deletion of the Office Shark account does not necessarily require immediate deletion of attendance or employment records where the organization has a lawful basis or legal obligation to retain them.

13. Your Privacy Rights

Depending on your location and applicable law, you may have rights including:

• the right to know whether we process your personal data;
• the right to access your personal data;
• the right to correct inaccurate information;
• the right to request deletion;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability where applicable;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with the competent data protection authority.

For workplace data processed on behalf of your employer, some requests may need to be handled by the organization acting as the controller.

You may contact us using the information in Section 1, and we will direct the request to the appropriate party when necessary.

14. Complaints

If you believe your personal data has been handled unlawfully, you may contact us first so we can investigate your concern.

You may also have the right to submit a complaint to the competent data protection authority.

In Bosnia and Herzegovina, the relevant supervisory authority is the Agency for Personal Data Protection in Bosnia and Herzegovina.

15. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.

Depending on the nature of the information, these measures may include:

• authentication controls;
• access restrictions;
• encryption in transit;
• secure storage;
• logging and monitoring;
• backups;
• security updates;
• administrative controls.

No internet-based service can guarantee absolute security.

16. Children's Privacy

Office Shark is intended for workplace use and is not directed toward children.

We do not knowingly collect personal data from children for the purpose of providing a child-focused service.

If you believe a child has provided personal data to us in circumstances where this was not appropriate, contact us at box@hotbox.ba.

17. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes such as:

• website functionality;
• authentication;
• security;
• analytics;
• performance measurement.

The use of cookies may be described in a separate cookie notice where required.

The Office Shark mobile application may also collect technical and diagnostic information necessary for functionality and security.

18. Third-Party Links and Services

The Service may contain links to third-party websites or services.

We are not responsible for the privacy practices of third parties that operate independently from Office Shark.

We recommend reviewing the privacy policy of any third-party service before providing personal data to it.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make material changes, we may provide notice through the Service, our website, email, or another appropriate method.

The "Last Updated" date at the top of this Privacy Policy indicates when the policy was most recently changed.

20. Contact Us

For privacy questions, data requests, or concerns, contact:

"HOTBOX" d.o.o. SarajevoAddress: Krka 62, 71000 SarajevoEmail: box@hotbox.baWebsite: https://hotbox.ba

By using Office Shark after an updated Privacy Policy becomes effective, you acknowledge that you have had an opportunity to review the updated policy.