Security and privacy
Tiveo processes employee data, so the paperwork that goes with it is here in its current version. You don’t have to fill in a form to get it.
Documents to download
You can download them without giving an email address. If you are checking these documents, you should not have to sit through a sales call first.
Template works agreement
Twelve sections covering what works councils check. It comes as a Word file, so nobody has to retype a PDF.
DOCXPrivacy notice for the vehicle logbook
Template under Art. 13 GDPR for your employees, in German, with and without route recording.
Page · PDFData processing agreement
Under Art. 28 GDPR, pre-filled, with all four annexes.
PDFTechnical and organisational measures
Describes the measures we have actually put in place. Anything still missing is marked in its section and listed again at the end.
PDFDeletion policy
When each kind of data is deleted, and where we keep it longer on purpose because the law requires us to retain it.
Data backup
The diagram shows when and where we back up your data.
How the backup is doing right now is shown in Tiveo under “System status”. These are measurements, not promises; what counts are the data processing agreement and the technical and organisational measures.
Where your data lives
The database and files are on a rented server in the netcup GmbH data centre in Nuremberg, which we run ourselves. The application’s program files and our mailboxes, through which the application’s emails are also sent, are with Serverprofis GmbH in a data centre in Munich. The same server at netcup also runs the security check that protects sign-in and the contact form against automated access (the open-source software Cap). Which law the infrastructure is subject to: the database, files, security check, program files and email are with netcup GmbH and Serverprofis GmbH, both based in Germany, in data centres in Nuremberg and Munich. This infrastructure is subject to German and EU law. Push notifications that a person switches on for their device are delivered by their browser’s push service: Google, Mozilla or Apple, possibly outside the EU. Which one is used is up to the browser. The service receives only the device address and an end-to-end encrypted message that names the occasion but contains no names and no content (§ 3(2) of the data processing agreement). Protection against access by authorities outside the EU: we store the data you record in Tiveo only in Germany: on servers at providers based in the EU and, for the second backup copy, on our own storage device on our premises, on an encrypted share. Only we sign in to the server holding the database and files, via SSH with a key pair; the database cannot be reached from outside, and connections to Tiveo are encrypted (TLS). If an authority or court outside the EU demands access to this data, we hand it over only where an international agreement or EU or German law permits it. We examine every such demand, hand over only what is necessary and inform you beforehand, unless the purpose of a criminal investigation requires us to stay silent for the time being (Art. 32 of Regulation (EU) 2023/2854). The current sub-processors under Annex 3 of the data processing agreement are: netcup GmbH, Karlsruhe: server for database, files, application services, the sign-in security check and the map in the vehicle logbook Serverprofis GmbH, Feldkirchen: the application’s program files, mailbox and email delivery We notify you of a new or changed sub-processor at least four weeks in advance (§ 6(2) of the data processing agreement) and list it here from then on.
Who sees the reason for an absence
You decide that for each type of absence. For sick leave, by default colleagues just see "absent" and the reason is visible to the manager and HR. Tiveo never sends the reason to anyone else’s browser in the first place. Every hidden entry looks the same, so the colour gives nothing away either.
Reports with a minimum group size
A sickness rate across three people tells you who was ill. So aggregated reports only appear above a minimum group size, which you can set and which is five by default. Below that the report says "group too small".
When we need to look at your data
Support access through the application is only possible if you explicitly grant it. It is time-limited and fully logged, and you can look it up afterwards with date, duration and reason. If we set up Tiveo for you or help you with it, we open a set-up access with administrator rights. It ends after seven days at the latest, you see it in the application, you can end it at any time, and it appears in your access log (§ 10(4) of the data processing agreement). This does not affect the administrative access to the database that operating the service technically requires. We use it only when there is a specific reason, and read access is not logged (§ 10(3) of the data processing agreement).
Your own backup
Our backup serves the operation of Tiveo. You back up your data yourself as well, as our terms also provide (§ 9 (8)). On the paid plans this happens automatically (beta): at night, daily, weekly or monthly, all data and uploaded files of your company go completely to your own storage, such as a Nextcloud, a Synology or an S3 bucket. Without storage of your own, we remind you by email and you download it yourself. Every backup is encrypted with your key in the open age format. Your browser creates the key; we only know the public part and cannot open the backups, not even on your storage. They open in Tiveo or, without Tiveo, with the free tool age. Owners and administrators see in the Tiveo header when the last backup ran and whether it worked. On every plan you can also download the full export yourself at any time.
When you leave
If you only cancel the paid plan, you carry on in the free plan with all your data. While the contract runs, you download CSV files in the application that Excel opens directly: the team calendar, the year overview per person and the report with people and leave balances. The owner of the company can download all your data together as a full export at any time, under “Settings › Company”, on every plan and free of charge: as JSON and CSV files in UTF-8, with uploaded files in their original format. If you switch to another provider, we support you at no extra charge and, if you wish, hand the full export directly to your new provider (§ 13 of the terms). When the contract ends, you still have 30 days to retrieve your data and the full export. After that we delete your data, except what we are required to keep, such as invoices, and confirm the deletion in text form on request (§ 14 of the terms). Formats, data structure, the switching process and known limitations are described at tiveo.de/en/datenexport/.
If we were no longer here
With a small provider, that is a fair question. The answer is in the terms (§ 8): if we shut Tiveo down, we give three months’ notice to the end of a month for paid plans and one month’s notice to the end of a month for the free plan. If the owner dies or, for health reasons, is expected to be unable to run Tiveo for more than three months, the notice period is one month to the end of a month. Anything paid in advance for the time after that is refunded pro rata. After the contract ends, you have 30 days to retrieve your data and the full export.
Data export and switching providers: formats, process, limitations →