Privacy policy
Last updated: 1 November 2026
What this covers
This policy applies to the website tiveo.de and to the application at app.tiveo.de. Tiveo is made for businesses, and we only enter into contracts with businesses, not with consumers. We act in two roles. For the website, for enquiries you send us, for customer accounts, contracts and billing, for registration and the protection of sign-in, for feedback sent from the application and for our own logs, we are the controller. Most of this policy is about that. When a customer’s employees sign in, we process the sign-in, its protection and the related logs on behalf of their employer. The data a company keeps in Tiveo about its employees – absences, leave balances, working time, shifts, qualifications, notices and the like – we process only on that company’s behalf. The controller for it is the employer (see “Employee data in the application”).
Confidentiality
We treat all data that you and your employees enter in Tiveo as strictly confidential. We do not sell data and show no advertising. We use your company’s data only to provide and operate Tiveo for you. It is passed on only to the service providers named in this policy, who process it on our behalf, to systems that your company itself connects through our programming interface, or where the law requires us to. Each company sees only its own data; the database separates companies in every table. All connections are encrypted, and the data is stored in Germany. Details are at tiveo.de/en/sicherheit/. We look into a company’s data only for a reason: when it asks us for help or when operating the service technically requires it. Access through the application is shown to the company there. Everyone who works with the data on our side is bound to confidentiality, also after their work ends (sections 5 and 10 of the data processing agreement).
Controller
Sven Brunn Mediasolutions Owner: Sven Brunn Stephanusstraße 29 41472 Neuss Germany Phone: +49 173 9069185 Email: info@tiveo.de For any data protection question, and to exercise your rights, an email to info@tiveo.de is enough.
Employee data in the application
If your employer uses Tiveo, your employer decides what data about you is kept in the application and what it is used for. Your employer is the controller under the GDPR; we process that data as its processor under Art. 28 GDPR and only on its instructions. We publish the text of this data processing agreement at tiveo.de/en/avv/ (the agreement itself is in German). Depending on which modules your employer switches on, this includes rosters, recorded working time and project time, and qualifications and safety instructions with their certificates, a vehicle logbook with vehicles, trips, costs and mileage allowance, as well as absences. It also includes notices on the notice board and who has read them. We process this data, too, only on its behalf. If you clock in at a terminal at your workplace, you sign in there with a PIN or a badge with a code; we store the PIN only as a hash. Tiveo records no biometric features. Time recording involves no tracking and no location history: Tiveo stores no location when you clock in. If your employer has switched it on, you choose the place of work, “On site” or “Remote”, yourself when you clock in. If your employer only allows clocking in at the workplace, your device sends its location once when you clock in or end a break, provided you allow this in the browser. Tiveo compares it with your workplace locations and does not store it, neither with the entry nor in any log. Your employer can tell you which data it keeps in Tiveo, for what purpose and on what legal basis, and that is also where you exercise your rights. If you contact us instead, we pass your request on to your employer, provided we can tell which company you belong to. How the application is run technically – servers, sign-in and its protection, email delivery, logs, browser storage – is described in the sections below. That applies to everyone who uses Tiveo.
Vehicle logbook
If your employer uses the vehicle logbook, you enter the odometer reading, destination, purpose and the business partner visited for each trip, as the tax authorities require. For private trips and the commute, Tiveo stores only the date, the kilometres and the type of trip. We process this data, too, only on your employer’s behalf, as well as the names and addresses of customers and other business partners in the logbook’s address book. Recording the route is off by default; your employer can switch it on. Tiveo then stores the way of a business trip as a sequence of location points: only between “Start trip” and “End trip”, only while the app is in the foreground on your device and only if you allow location access in the browser. Tiveo never records a route for private trips or the commute; if a trip is later changed to one of these, Tiveo deletes its route. There is no live tracking: nobody can see in Tiveo where you are right now. Only you, your employer’s owners and administrators and its company-wide HR see the route, not your manager. The API does not hand it out. Tiveo deletes it automatically after the period your employer sets, three months by default. The logbook itself remains; your employer decides how long, in line with the retention duties under tax law. The map comes from our own server karte.tiveo.de at netcup GmbH (see “Hosting and servers”), the map data from OpenStreetMap. No third-party map or address service is involved: place suggestions come only from your employer’s address book. Your device determines its location itself; depending on its settings, its operating system may use location services from its manufacturer, such as Google or Apple. You decide that in your device’s settings, not we.
Hosting and servers
The website tiveo.de and the program files your browser loads when you open app.tiveo.de are hosted by Serverprofis GmbH, Otto-Lilienthal-Ring 34–36, 85622 Feldkirchen, Germany. Our mailboxes info@tiveo.de and mail@tiveo.de, through which we receive and send email, and the audience measurement at analytics.tiveo.de are hosted there too. We run the database and the other services of the application – sign-in, file storage and the interfaces at supabase.tiveo.de – ourselves, using the open-source software Supabase, on a rented server from netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. No cloud service of the company Supabase is involved. The same server runs the Cap security check at cap.tiveo.de (see “Protection against automated access with Cap”). The map for the vehicle logbook is there too, at karte.tiveo.de. When a map section is loaded, the server processes your IP address and the requested section only to deliver it; we do not log these requests. If a company uses its own domain for the application, the program files at that address also come from this server, again without access logs. Both providers run these servers in data centres in Germany and act as our processors. The legal basis is Art. 6(1)(f) GDPR – our interest in secure, reliable operation – and, towards our customers, also Art. 6(1)(b) GDPR.
Visiting the website
When you visit tiveo.de, your browser sends technically necessary information to the web server. The server logs your IP address, the time, the page requested and your browser identifier, and, depending on the host’s settings, also the status code, the amount of data transferred and the page you came from. We need this to deliver the pages, find faults and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and working operation. The host keeps the logs on our behalf. We only look at them when there is a reason, such as a fault, and they are kept no longer than these purposes require. The website loads no fonts, scripts, maps or videos from other providers’ servers. There is no advertising and there are no embedded social networks.
Audience measurement with Matomo
To see which pages are read and how visitors find us, we use the software Matomo on tiveo.de. We run it ourselves at analytics.tiveo.de, on our web space at Serverprofis GmbH (see “Hosting and servers”), which acts as our processor. Only we analyse the data, and we do not pass it on to third parties. Our other websites are counted separately and not linked to tiveo.de. With each page view, Matomo receives the address and title of the page, the page you came from, the time, your IP address, and the browser identifier and language setting your browser sends anyway. It also counts clicks on links leading away from tiveo.de and downloads of our documents. The measurement sets no cookies, stores nothing on your device and does not read device properties such as screen size, extensions or device model. For that reason we do not ask for consent under § 25(1) of the German TDDDG. The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest is to shape the website around how it is actually used. We keep the individual page views only as long as we need them for this analysis. If your browser sends “Do Not Track” or a Global Privacy Control signal, the measurement script is not even loaded. Regardless of that, you can object with the switch at the end of this page. Your objection is then stored as the entry “tiveo-analytics” in your browser’s storage so that it still applies on your next visit; if you clear your browser data, you will need to object again. There is no audience measurement in the application at app.tiveo.de.
Contact form
If you send us an enquiry through the form, we process what you enter – name, email address, optionally company and team size, the subject and your message – in order to answer it. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract with us or entering into one, and otherwise your consent under Art. 6(1)(a) GDPR, which you give with the checkbox. You can withdraw your consent at any time with effect for the future, for example by email to info@tiveo.de; this does not affect what happened before. The form does not create a database. The web server sends the enquiry as an email to our mailbox info@tiveo.de. Besides what you entered, the email contains the language of the page, the time and your IP address, so that we can follow up on misuse. The enquiry stays in the mailbox while we deal with it and may need it for follow-up questions; after that we delete it unless a statutory retention obligation applies. To keep out automated bulk submissions, the server checks every enquiry. Before sending, the form fetches a signed token that is tied to your browser identifier and valid for at most two hours; the server records used tokens as empty marker files, which it clears out later. To allow no more than five enquiries per hour and IP address, it stores the times of your enquiries in a file named after a check value computed from your IP address (SHA-256). Only enquiries from the last hour count; the file itself is not currently deleted automatically. In addition, the form uses Cap to check that a person is sending it: as soon as you click into a field, your browser loads a small check page from cap.tiveo.de. It solves a computing task and checks that the page is running in an ordinary browser. The result, a check token valid only once, goes to the web server with the enquiry, and the server has Cap confirm it. We run Cap ourselves on our server in Germany; what is processed is described under “Protection against automated access with Cap”. The server also scores features of the enquiry, such as the browser identifier, the page it was sent from, links in the text, and whether a mail server exists for the domain of your email address, which it looks up in the public DNS. If the score passes a fixed threshold, the enquiry is discarded without being stored or delivered. The form still reports it as sent, so that spammers learn nothing about the check. Above a lower threshold, the enquiry is delivered but flagged in the subject line, and the email lists the reasons for the score. The legal basis for this check is Art. 6(1)(f) GDPR; our legitimate interest is a mailbox that is not buried in spam. The form sets no cookies and stores nothing on your device. If you do not hear back, please email or call us directly (see “Controller”).
Email and phone
If you email or call us, we process what you tell us in order to deal with your request – under Art. 6(1)(b) GDPR where it concerns a contract, otherwise under Art. 6(1)(f) GDPR. Emails are kept in our mailbox at Serverprofis GmbH. We delete them once they are dealt with, unless a statutory retention obligation applies; correspondence relating to a contract is kept for as long as German commercial and tax law requires.
Registration and sign-in
For an account in the application we need your email address and a password; you may add a display name. We store the password only as a hash, never in plain text. After you register, we send you an email to confirm your address. Instead of a password you can also sign in with a link we email to you; it is valid only for a short time and only once. As soon as you have confirmed your address, the application checks whether a company in Tiveo has already added or invited you under this address, and whether the domain of your address has been confirmed as a company domain by a company. If so, your account is linked to the existing entry or assigned to that company. With a company domain, depending on the company’s settings, its owner and administrators may instead receive a request to join showing your email address, also by email, and decide on it. Once your account is assigned to a company, the company can also see the display name you entered. The legal basis for this matching is Art. 6(1)(f) GDPR; the legitimate interest – ours as well as the companies’ – is to assign accounts to the right company without duplicates. Sign-in is handled by the authentication service of our Supabase installation on the server at netcup. It records technical details for each session, such as IP address, browser identifier and timestamps, and logs sign-ins and account changes so that misuse can be detected and investigated. The legal basis for your account and sign-in is Art. 6(1)(b) GDPR where you yourself are, or want to become, our contracting party, and otherwise Art. 6(1)(f) GDPR – our interest in providing the application to the companies you use it for. Art. 6(1)(f) GDPR applies to the logs. If you come to Tiveo through your employer, your account is also part of the data we process on your employer’s behalf. We keep the logs of the authentication service only as long as they are needed for this purpose. Your account exists until it is deleted. You delete it yourself in the application under “My account”, immediately and for good. If you still own a company, hand it over or delete it first. What your employer keeps about you, such as your absences, stays with your employer, with no account and no role. When we delete a company after its contract has ended, we also delete, in the same step, any accounts that then no longer belong to any company.
Protection against automated access with Cap
On the sign-in page of app.tiveo.de – when you sign in with a password, register or request a sign-in link – and on the contact form at tiveo.de, we check whether a person or an automated program is using the page. For this we use the open-source software Cap. We run it ourselves on our server at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in its data centre in Nuremberg; netcup acts as our processor (Art. 28 GDPR). Your browser loads a small check page from cap.tiveo.de. It solves a computing task and checks that the page is running in an ordinary browser. This processes your IP address, only to limit the number of requests and stored for a few seconds, and technical features of your browser, only for this check and not stored. The result is a check token that is valid once and expires after two hours at the latest; our server has Cap confirm it. Cap only keeps counts, such as how many checks took place in an hour, and builds no profiles. Rejected attempts are logged with a shortened IP address. Cap sets no cookies and stores nothing on your device. We do not pass this data on to third parties or transfer it to countries outside the EU. The purpose is to protect accounts, the application and our mailbox against automated attacks and spam, such as mass password guessing or fake registrations; that is our legitimate interest. The legal basis is Art. 6(1)(f) GDPR. Insofar as the check accesses information on your device, this is strictly necessary for the sign-in or enquiry you have asked for (§ 25(2) no. 2 TDDDG). If you sign in as an employee of a customer, the check is carried out on behalf of your employer, on the same server as the application (Annex 3 of the data processing agreement).
Customer account, company and contract
If you set up a company in Tiveo, or manage one as its owner or an administrator, we process what we need for the contract and for running the service: your name, your email address, your language setting and, if you upload one, your profile picture; for the company its name, country and region, logo, registered company domains, the plan booked and the number of seats. When the owner accepts the data processing agreement in the application, we keep a record of who accepted which version and when, together with the confirmation text that was typed in. Likewise, when someone confirms – on creating a company or later in response to a notice in the application – that the company is acting as a business and accepts our terms and conditions, we record the user ID of the person confirming, the time, the version of the terms and a checksum of their wording. When the company is deleted, we keep the company name, version, checksum and time from both records, together with the name and email address of the person who confirmed, until the end of the third calendar year after the contract ended, or until the conclusion of any legal proceedings then pending. This lets us prove the terms on which the contract existed (Art. 6(1)(f) and Art. 17(3)(e) GDPR, § 14(4) of the terms). We then delete them. If you add a company domain, we check that it belongs to your company: either through a DNS record, which our server looks up using its own name service – only the domain name is used – or through an email to one of the addresses customarily reserved for this, such as postmaster@. That email names your company and the domain; its confirmation link is valid for 72 hours. The legal basis is Art. 6(1)(b) GDPR where you yourself are our contracting party, and otherwise Art. 6(1)(f) GDPR – our interest in performing the contract with your company. For the record of the agreement’s acceptance, Art. 6(1)(c) in conjunction with Art. 28(3) and (9) GDPR also applies; for the email to the domain address, Art. 6(1)(f) GDPR. We keep the record of acceptance of the terms and conditions under Art. 6(1)(b) GDPR where you yourself are our contracting party, and otherwise under Art. 6(1)(f) GDPR – our interest in being able to show with whom and on which terms the contract was concluded. We keep this data for as long as the contract runs. After it ends, export and deletion follow our terms and conditions and the data processing agreement. Once a company has been deleted, we keep a deletion record with the company name, dates and quantities so that we can confirm the deletion.
Payment via Stripe
Paid plans are booked by a company’s owner through the payment service Stripe. Our contracting party for payment processing is Stripe Payments Europe, Limited, Dublin, Ireland. For payment, changing the payment method, switching plans and cancelling, the application sends you to Stripe’s own pages (checkout.stripe.com and billing.stripe.com). There you enter your details directly with Stripe: email address, name, billing address, your VAT number if you wish, and your payment method. We send Stripe only what is needed to match the payment: an internal identifier for your company, the chosen plan and billing period and, if one exists, your Stripe customer number. Stripe reports back which plan the subscription is on, until when, and whether a payment is outstanding, and for each paid invoice the amount, currency, payment date and a link to the invoice at Stripe. We also reconcile this status with Stripe every night. Stripe issues the invoices; owners and administrators can see them in the application. We do not store billing addresses or payment details such as card numbers. If you choose “By invoice”, you enter the bill-to name, address, email address for the invoice and, if you wish, your VAT number in the application. We pass these details straight on to Stripe without storing them ourselves. Stripe sends the invoice to that address and states a dedicated account for the bank transfer. The legal basis is Art. 6(1)(b) GDPR and, for keeping invoices and accounting records, Art. 6(1)(c) GDPR together with the retention duties of German commercial and tax law (§ 147 AO, § 14b UStG; generally eight years). We keep the subscription details in the application for as long as the contract runs. Stripe processes the data partly on our behalf and partly as a controller in its own right, for example to prevent fraud and to meet its own legal obligations. In doing so, data may be transferred to Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA. Details: stripe.com/privacy.
Emails from the application
The application sends email through our mailbox mail@tiveo.de at Serverprofis GmbH. From the Team plan, a company can enter its own mail server. Its notifications to employees then go through that server and from its sender address; the company decides who runs it. We store the password for it in encrypted form. If the server fails, the notifications go out through our mailbox by default. Our own emails about accounts, contracts and billing always go through our mailbox. As controller, we send: registration confirmations, sign-in links, messages to owners and administrators about the contract – for example when the plan’s seats are nearly used up, on cancellation, an outstanding payment, or the end of the subscription or the contract – notices of maintenance work, requests from our support for access, and the confirmation request for a company domain. The legal basis is Art. 6(1)(b) GDPR where you are our contracting party, otherwise Art. 6(1)(f) GDPR. On behalf of the company you use Tiveo for – usually your employer – the application also sends the notifications of leave planning – about requests, decisions, cover, reminders and leave that is about to expire – of time recording, for example about a correction of your time or a missing clock-out, and of shift planning, for example about a published roster or a swap request, of qualifications, for example about a qualification that is about to expire, and of the vehicle logbook, for example about a trip with details missing or last month’s mileage allowance – each only if your employer uses the module – the notice of a new item on the notice board, as well as invitations and, to owners and administrators, the notice of a request to join. How a request to join comes about is explained under “Registration and sign-in”. The company decides which of these notifications are sent; its administrators see the most recent ones with time, recipient and status. Our emails contain no tracking pixels, and their links lead straight to Tiveo without passing through third parties. The HTML version shows our logo; if your email program displays images, it loads this image from tiveo.de. The web server at Serverprofis GmbH then records the same access logs as for a visit to the website (IP address, time, browser identifier). The image address is the same for every recipient; we do not evaluate who opened an email. Notifications pass through a queue in our database. There is no fixed deletion period for its entries yet; they only disappear together with the company or the recipient’s membership.
Push notifications
If you wish, Tiveo shows the same notices as by email as push notifications on your phone or computer, for example about a new request, a decision, a new shift plan, a new notice, a qualification that is about to expire or a missing clock-out. This is off until you switch it on yourself on a device and your browser has asked for your permission. You only receive what is also set up for you as an email. For each device we store, linked to your account, the address that your browser’s push service assigns to it, two encryption keys and a short device label such as “Chrome · Android”, plus timestamps and the number of failed deliveries. The message is encrypted end to end (RFC 8291). It names only the occasion, for example “New request to approve”, and the place in the application that a tap leads to – no names, no dates, no content. It is delivered through the push service your browser uses: Firebase Cloud Messaging of Google LLC for Chrome, Edge and Android, the service of Mozilla Corporation for Firefox, and the service of Apple Inc. for Safari and Apple devices. That service receives the device address and the encrypted message, which it cannot read, and may process them outside the EU, in particular in the USA. What else it receives when it contacts your device is governed by its own terms. If you switch push off on a device, we delete the subscription. If the push service reports a device as invalid or delivery fails ten times in a row, we delete it as well, and all subscriptions disappear with your account. Signing out switches push off on that device. Where we are the controller, the legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG – your consent, which you give by switching push on and withdraw by switching it off. Notices from your employer’s company we process on its behalf.
Application logs
When you open app.tiveo.de, your browser loads the program files from the web server at Serverprofis GmbH, which produces the same access logs as a visit to the website. On a company’s own domain they come from our server at netcup GmbH, which does not log these requests. Some links in our emails – invitations, decisions on requests, domain confirmations – carry a one-time code in the address. That code then also appears in the log, but it is useless once it has expired or been used. All other requests from the application go to our own server at supabase.tiveo.de. The services there write technical logs that may contain IP address, time, the interface called and browser identifier. We use them to find faults, monitor security and investigate misuse. The legal basis is Art. 6(1)(f) GDPR; where the logs concern a customer’s employees, we keep them on behalf of the employer. We keep these logs only as long as they are needed for these purposes.
Feedback from the application
Signed-in users can send us bugs, wishes or questions via “Give feedback”. We store your text, the type of feedback, the address of the page without parameters, your browser identifier, the window width, your user ID, the company you are currently working in and – only if you enter one – a reply address. Alongside it we see your name as your company keeps it and the email address of your account, so that we can reply. To work on it, we record a status, an urgency and a note of our own on each item. Only we see the feedback, not your employer. We use it to fix bugs and improve Tiveo. The legal basis is Art. 6(1)(f) GDPR. Please do not include anything about other people that we do not need for your request. There is no fixed deletion period for feedback yet; it stays stored until we delete it. If a company is deleted, its feedback remains, without any link to that company.
Support and platform administration
As the operator of the servers, we have technical access to the database. In our administration interface we see, without special permission, only what we need for operation, support and billing: for each company its name, country, plan, registered domains and the time of the last activity, plus counts – for example of seats, of employees with and without an account, of accounts active in the last 7 and 30 days, and of requests, time entries and shifts in the last 30 days. The only people we see by name are owners and administrators, not the other employees. We only look into a company’s data for support if its owner or an administrator grants access in the application. Access lasts for a chosen period between 5 minutes and 8 hours and can be revoked at any time. Every access is logged, and the company can read that log itself. We do not see the reasons for absences. To set up a company or help with setting it up, we can open a set-up access without that permission if the company has no owner and no contract yet or has accepted the data processing agreement in the version of 29 September 2026 or later. We then work with administrator rights and can view the application from the perspective of individual users, read-only. The access ends after seven days at the latest, is shown within the company, can be ended at any time by the owner and administrators, and appears with its reason in the company’s access log. We act on behalf of the company (Art. 28 GDPR). We record our own actions in platform administration, such as manual plan changes, suspensions or support requests, with a reason in a platform log. The legal basis is Art. 6(1)(f) GDPR: we must be able to show who did what and when. No fixed deletion period has been set for this log yet; if a company is deleted, the entries remain without any link to that company. When a user account is deleted – by the person or by us – the entry holds the account’s email address, not the name, plus the companies and the role the account had there.
Calendar subscription
Employees can subscribe to their own absences – and, if their employer uses shift planning, their own published shifts – in a calendar program. The application creates a secret address for this, which you enter in your calendar program yourself. We store only a check value of it and the time it was last fetched. The calendar contains your display name and your absences as “Absent” or “Absent (requested)”, without type or reason, and your published shifts with start, end, the name of the shift type and the unit; notes on a shift are not included. It also contains the events of your company that apply to you (such as a staff meeting), with their name, date and, where set, time. Your calendar program fetches the address regularly. If you use an online calendar, for example from Google, Microsoft or Apple, its provider receives this information at your request and under its own terms, possibly outside the EU. You can revoke the address in the application at any time or replace it with a new one; the old one stops working immediately.
Programming interface (API)
Companies on the Business plan or above can retrieve data from Tiveo with their own systems through a programming interface at api.tiveo.de, for example for their payroll office, for reporting or for their own HR system. The interface is marked as beta and currently only allows reading. Like the rest of the application, it runs on our server in Germany (see “Hosting and servers”). Only a system that presents an API key gets access. Owners and administrators of the company create keys in the application. When they do, they decide which data the key may read, for example employees, absences, working time or shifts, and optionally an expiry date. For each key we store its name, the chosen permissions, the expiry date, who created or revoked it and when, and when it was last used. We store the key itself only as a check value (SHA-256). The type of an absence with restricted visibility, such as sickness, is only delivered to keys with a separate permission for it; otherwise the interface only says “absent”. It never delivers free-text notes on absences. We log every call made with a key, with the time, method, path called, result, number of rows delivered, duration and the IP address of the calling system. Owners and administrators can see this log in the application. It serves to run the interface securely, to detect and prevent misuse and to show the company what was retrieved. We delete the entries after 90 days, or earlier if the company deletes its data or is itself deleted. For the usage limits we count calls per company and failed attempts per IP address; we delete these counters after two days. After ten failed attempts within one minute, the interface rejects calls from that IP address for 15 minutes. We process the data retrieved through the interface and the log of calls on behalf of the company (Art. 28 GDPR, see “Employee data in the application”). The recipients are the systems the company connects with its keys. The company decides which systems these are, where they are operated and what happens to the data there. Where we count and block failed attempts without a valid key, we are the controller. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is protecting the application against misuse.
What is stored in your browser
We set no cookies, neither on the website nor in the application. The website stores at most two entries in your browser’s storage – your colour choice and, if you object, your objection to the audience measurement – and the application stores your sign-in session and a few settings such as language and colour scheme. These entries are strictly necessary for the functions you use (§ 25(2) no. 2 TDDDG). The full list with purpose and duration is at tiveo.de/en/browserdaten/. If you use the vehicle logbook, the application briefly keeps trips and, if recording is switched on, the route’s location points in your browser’s storage so that nothing is lost when reception is poor. This, too, is strictly necessary for that function. Once they are sent and the trip has ended, the application deletes them there, after 30 days at the latest. The Cap security check (see above) stores nothing in your browser. On Stripe’s payment pages, Stripe’s own information applies.
Recipients and transfers outside the EU
Depending on the process, recipients of your data are our service providers Serverprofis GmbH (website, application program files, email, audience measurement), netcup GmbH (application server, security check and map) and Stripe (payments), as well as bodies to which we are legally obliged to transfer data, such as tax authorities. Employee data from leave planning reaches neither Stripe nor the audience measurement. Serverprofis and netcup process the data in data centres in Germany. Of our service providers, only Stripe can bring data to a country outside the EU and the EEA, namely the USA. The basis is the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Stripe, LLC states that it is certified under it. Stripe also relies on the European Commission’s standard contractual clauses. With the calendar subscription, you decide yourself which service fetches the data. Through the programming interface, data only reaches systems that a company connects itself; the company decides where they are operated. If you switch on push notifications, your browser’s push service – Google, Mozilla or Apple – delivers them, possibly from countries outside the EU. Your browser decides which service that is, not we. It receives only the device address and an encrypted message without names or content (see “Push notifications”).
Backups
We back up the database continuously: every change is written down immediately, a full backup is made every night, and a copy lies on our own storage device on our premises in Germany, on an encrypted share. We mirror uploaded files such as supporting documents every night. Every week we check that the database can be restored from the copy. We keep backups for no more than 90 days and then delete them. Deleted data may therefore still be contained in a backup that already exists, until that backup is deleted; a deleted file is gone from the mirror after the next nightly run. We use backups only to restore data after an error or outage.
How long we keep data
We keep data for as long as its purpose requires or the law demands; the details are given with each process above. The application itself sets some limits: a sign-in link is valid only briefly, a domain confirmation link for 72 hours, a support access for at most 8 hours, a set-up access for at most seven days, the log of the programming interface 90 days. Where we have not yet set up a fixed deletion period, the section above says so explicitly. Data we process on behalf of an employer is deleted according to the employer’s instructions and the data processing agreement.
Your rights
You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). An email to info@tiveo.de is enough. For data your employer keeps about you in Tiveo, please contact your employer (see “Employee data in the application”).
Your right to object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing it, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object to the audience measurement without giving reasons, directly with the switch at the end of this page.
Complaints to a supervisory authority
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Postfach 20 04 44, 40102 Düsseldorf, Germany.
No automated decisions
We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR. The check on the contact form does sort enquiries out automatically, but it decides nothing that has legal or similarly significant effects on you; you can always reach us directly as well.
Do you have to provide data?
You can use the website without telling us anything about yourself. Without your name, email address and message we cannot answer an enquiry; without an email address and password we cannot set up an account; and without billing and payment details a paid plan cannot be booked. There is no legal obligation to provide us with data. What employees have to enter in Tiveo is up to their employer.
The choice is stored in this browser only - not as a cookie and not on our server. Clearing your browser data resets it.
Your browser already sends Do Not Track or Global Privacy Control. Nothing is measured either way; matomo.js is not even requested.