Privacy policy

Placeholder — not legally binding. This page is a scaffold. The sections below list what has to be provided; the wording still has to be drafted and reviewed. Set LEGAL_PLACEHOLDER_NOTICE=False once the real text is in place.

Controller

Name and contact details of the controller under Art. 4 (7) GDPR, and of the data protection officer if one has been appointed.

Processing purposes and legal bases

One entry per purpose with its legal basis under Art. 6 GDPR. For this platform that covers at least: operating the user account and access control, managing work orders and appointments, recording on-site presence at reception, receiving and checking invoices, sending notifications and reminders, and server log files.

Categories of data

Account and profile data, contact details of company contacts, working times of internal staff, presence times of external contractors recorded at reception, uploaded documents and photographs, and log data.

Recipients and processors

Hosting provider, e-mail relay, error tracking and any further processors, each with a data processing agreement under Art. 28 GDPR. State whether any transfer to a third country takes place and on what safeguards.

Retention and erasure

Retention period or the criteria used to determine it. Note that invoices, contracts and business records are subject to statutory retention periods under commercial and tax law, and that these take precedence over an erasure request. Describe the account deletion process, including the grace period before final deletion or anonymisation.

Presence recording at reception

Arrival and departure of external contractors is recorded. State the purpose, the legal basis, who can see the records and how long they are kept — this is personal data about people who are not users of the platform.

Cookies and local storage

Session cookie, CSRF cookie, the language preference and the light/dark theme setting stored in the browser. State which of these are strictly necessary and which require consent, and describe any analytics.

Your rights

Access, rectification, erasure, restriction, data portability and objection under Art. 15 to 21 GDPR, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority under Art. 77 GDPR — name the competent authority.

Security

Technical and organisational measures under Art. 32 GDPR: encrypted transport, role-based access control, separation of tenants, audit logging and the backup concept.