Privacy Policy – Time Tracking

for the app "Time Tracking"

This is a non-binding English translation for your convenience. The German version of this privacy policy is legally binding.

Last updated: September 9, 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Provider:

2. General Information on Data Processing

We process personal data of users of the "Time Tracking" app exclusively within the framework of applicable data protection law, in particular the GDPR and the Austrian Data Protection Act (DSG). This privacy policy informs you which data we process when using the app, for what purpose, on what legal basis, and what rights you have in this regard.

If you register a company account and use it to create employee accounts or record data about your employees, you as a company are generally the data controller yourself in relation to your employees; we merely provide the technical platform in this respect. This privacy policy therefore addresses both end users (individuals using the app) and companies that use the app for their business.

3. Registration and User Account

During registration, we collect: company name, the name of the registering person or of the employees created, email address, and a password stored by us only in encrypted (hashed) form.

Purpose: providing and managing the user account, authentication, associating recorded time tracking and mileage log data with the respective user or company.

Legal basis: Art. 6 (1) lit. b GDPR (performance of the usage contract), or, to the extent an employee is set up by their employer, Art. 6 (1) lit. f GDPR (the employer's legitimate interest in organizing its business) in conjunction with the labor-law relationship between employer and employee.

4. Time Tracking and Mileage Log Data, Location Data (GPS)

As part of the app's core functions, we process:

• start, end and duration of working time ("time tracking") and associated projects/tasks;
• start, end, route and odometer readings of trips ("mileage log"), including the purpose of the trip and, where applicable, client assignment;
• location data (GPS coordinates), provided you have granted the corresponding permission. This may be collected both during active use and – if "Always Allow" permission has been granted – in the background, for as long as a time tracking session or trip is active.

Purpose: maintaining a complete and traceable time or mileage log, location assignment of working time and trips, business reporting (e.g. reports/analytics for administrators of a company account), and, where applicable, evidence for tax authorities (electronic mileage log).

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) as well as – in the employment context between company and employees – Art. 6 (1) lit. f GDPR (legitimate interest in proper business organization and documentation), or a separate legal basis existing in the respective employment relationship (e.g. consent, works agreement), which must be ensured by the respective company as employer.

Note on background location tracking: background location tracking only takes place while a time tracking session or trip is active, and serves to record the route completely. You can restrict or revoke location sharing at any time in your device's operating system settings; however, this may mean that certain app functions (in particular automatic route recording) are unavailable or only available in a limited way.

5. Push and Local Notifications

The app may – if you allow it – inform you via push or local notifications (e.g. a reminder about a time tracking session or trip still in progress, status changes). The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in a functional app) or your consent granted via system settings. You can disable notifications at any time in your device settings.

6. Subscriptions and Payment Data

Paid features of the app are handled via in-app subscriptions, billed through Apple's (App Store) or Google's (Google Play) payment systems. Payment data (e.g. credit card data) is processed exclusively by Apple or Google; we only receive information about the purchase status (e.g. active subscription, expiry date), not the full payment data. The respective privacy policies of Apple or Google apply in addition.

7. Map Display (Google Maps SDK)

For the map view (e.g. location overview for administrators), we use the Google Maps SDK provided by Google Ireland Limited or Google LLC (USA). When using the map function, data (including IP address, displayed location data) is transmitted to Google and may also be transferred to and processed in the USA or other third countries. According to Google, it relies on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses as an additional safeguard for an adequate level of data protection. For further information, see Google's privacy policy: https://policies.google.com/privacy. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in a functional map display).

8. Recipients of the Data, Processors

Your data is only shared with the following categories of recipients, to the extent necessary for providing our services:

• hosting and infrastructure providers we use to technically provide the app and store the data [name and location of the hosting/cloud provider(s) used will be added here once finalized];
• Apple Inc. or Google LLC/Google Ireland Limited as part of providing the app via the respective store and processing subscription payments;
• Google (Google Maps SDK) as part of the map display, see section 7;
• authorities, to the extent legally required (e.g. tax authorities, law enforcement).

Data processing agreements pursuant to Art. 28 GDPR are or will be concluded, to the extent necessary, with all service providers processing personal data on our behalf.

9. Data Transfers to Third Countries

To the extent that personal data is transferred to countries outside the European Economic Area (in particular the USA) in connection with using services such as Google Maps or the Apple/Google app stores, we rely on the appropriate safeguards provided by the respective providers (e.g. EU Standard Contractual Clauses, adequacy decision/Data Privacy Framework).

10. Retention Period

We store personal data only for as long as necessary for the stated purposes, or as required by statutory retention obligations (e.g. tax-law retention periods for mileage-log-relevant records, generally seven years pursuant to Sec. 132 of the Austrian Federal Fiscal Code (BAO)). After a user account is deleted, the associated data is deleted or anonymized, unless statutory retention obligations prevent this.

11. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given, at any time, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, please contact: timetracker@kainzner.net.

If you are an employee of a company using the app under a company account, please contact your employer first to exercise your rights regarding data collected about you via the app by your employer, as your employer is generally the data controller in this respect (see section 2).

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in Austria is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Website: https://www.dsb.gv.at

13. Data Security

We take appropriate technical and organizational measures to protect your data against loss, misuse, and unauthorized access (including encrypted transmission, secure storage of credentials). However, absolute protection against all risks cannot be guaranteed.

14. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to reflect changed legal requirements or changes to the app or the services we use. The current version available in the app always applies.

15. Contact

For questions about privacy, please contact: Christoph Kainzner, timetracker@kainzner.net