Legal
Privacy Policy
Last updated:
1. Who we are
Vitalocrap ("we", "us", "our") is the provider of employee monitoring and surveillance software ("the Service"), accessible at vitalocrap.com. For the purposes of EU and UK data protection law, Vitalocrap acts as data controller in respect of personal data collected through our website and as data processor in respect of employee monitoring data processed on behalf of our customers. Our governing law is that of Ireland. Enquiries regarding this policy may be directed to us via our contact form.
2. Data we collect
We collect the following categories of personal data: (a) Account data — name, work email address, company name, job title, and billing details provided during registration or purchase; (b) Usage data — pages visited, features accessed, session duration, IP address, browser type, device identifiers, and referral source; (c) Communications data — messages, enquiries, and attachments you send us via our contact form or by email; (d) Payment data — processed by our payment provider; we do not store full card numbers; (e) Monitoring data — data collected by the Service from monitored devices on behalf of your organisation, for which your organisation is the data controller and we act as data processor under a Data Processing Agreement.
3. How we use your data
We use personal data to: provide, operate, maintain, and improve the Service; create and manage your account and process payments; respond to support requests and enquiries; send transactional communications (account notices, security alerts, and invoices); send product updates and marketing communications where you have given consent or where permitted under the soft opt-in rule; conduct internal analytics to improve service quality; detect, prevent, and investigate fraud, abuse, or security incidents; and comply with legal and regulatory obligations.
4. Legal basis for processing (GDPR)
Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") or the UK GDPR applies, we rely on the following legal bases: (a) Contract — processing necessary to perform our agreement with you (account management, service delivery, billing); (b) Legitimate interests — improving the Service, fraud prevention, network security, and direct marketing to existing customers, where these interests are not overridden by your rights; (c) Legal obligation — compliance with applicable law, including tax, accounting, and regulatory requirements; (d) Consent — where you have given freely given, specific, informed, and unambiguous consent, such as for optional marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. Employee monitoring and employer obligations
The Service enables organisations to monitor employee activity on company-owned devices and networks. Where our customers deploy the Service, they act as data controller for the resulting monitoring data. Customers are solely responsible for: (a) identifying a valid lawful basis under GDPR Article 6 (and Article 9 where special category data may be involved) for monitoring their employees; (b) providing employees with clear, transparent notice of monitoring activities before monitoring commences, in accordance with GDPR Article 13/14 and applicable employment law; (c) conducting a Data Protection Impact Assessment (DPIA) under GDPR Article 35 where monitoring is likely to result in high risk to individuals; (d) complying with all applicable national employment, labour, and privacy laws in their jurisdiction. We provide a Data Processing Agreement (DPA) to all customers upon request, as required by GDPR Article 28.
6. Data sharing and third parties
We do not sell your personal data. We may share it with: (a) Sub-processors — trusted third-party service providers (cloud hosting, payment processing, analytics, email delivery) engaged under written data processing agreements that impose equivalent data protection obligations; (b) Professional advisers — lawyers, accountants, and auditors under duties of confidentiality; (c) Regulatory and law enforcement authorities — where required by applicable law, court order, or to protect our legal rights; (d) Business transfers — in connection with a merger, acquisition, or sale of assets, with prior notice to you where required by law. A current list of our sub-processors is available upon request.
7. International data transfers
Your personal data is primarily processed within the European Economic Area (EEA). Where we transfer data to countries outside the EEA that do not benefit from an adequacy decision, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, supplementary technical measures where required, and transfer impact assessments. You may request a copy of the relevant safeguards by contacting us.
8. Data retention
We retain personal data only for as long as necessary for the purposes set out in this policy or as required by law. Account data is retained for the duration of your subscription and deleted within 90 days of account closure, unless a longer retention period is required by law (e.g. for tax or accounting purposes). Monitoring data processed on behalf of your organisation is retained in accordance with your instructions and deleted or returned upon termination of the Data Processing Agreement. Usage and analytics data is retained in aggregated, anonymised form indefinitely.
9. Your rights under GDPR
If you are located in the EEA, UK, or another jurisdiction with equivalent data protection law, you have the following rights: (a) Access — obtain a copy of the personal data we hold about you; (b) Rectification — correct inaccurate or incomplete data; (c) Erasure — request deletion of your data in certain circumstances ("right to be forgotten"); (d) Restriction — request that we limit processing in certain circumstances; (e) Portability — receive your data in a structured, machine-readable format; (f) Objection — object to processing based on legitimate interests or for direct marketing; (g) Withdrawal of consent — withdraw consent at any time where processing is consent-based; (h) Complaint — lodge a complaint with your supervisory authority. In Ireland, the supervisory authority is the Data Protection Commission (dataprotection.ie). To exercise any of these rights, please contact us via our contact form. We will respond within one calendar month.
10. Cookies
We use strictly necessary cookies required for the Service to function (e.g. session management and security tokens) and, with your consent, optional analytics cookies to understand how visitors use our website. You can manage or withdraw cookie consent at any time through the cookie preference centre displayed on your first visit, or through your browser settings. Withdrawing consent for optional cookies does not affect your ability to use the Service.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data in transit (TLS) and at rest, role-based access controls, regular security assessments, and incident response procedures. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR Article 33/34.
12. Children
The Service is intended solely for use by organisations and their adult employees. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email (to the address associated with your account) or by posting a prominent notice on our website at least 14 days before the changes take effect. The "last updated" date at the top of this page indicates when the policy was last revised. Continued use of the Service after changes take effect constitutes acknowledgement of the updated policy.
14. Contact and complaints
For privacy-related enquiries, to exercise your data subject rights, or to raise a concern, please contact us via our contact form at vitalocrap.com/contact. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie, or with the supervisory authority in your country of residence.