Privacy Policy
What data the website and the app process, why and for how long, and what rights you have.
Translation for convenience. The German version is legally binding: Datenschutzerklärung.
Draft with placeholder text. Marked parts will be replaced with verified details before launch.
1. Controller
- Company
- [Company name GmbH]
- Address
- [Street No., Postcode City], Germany
- [privacy@…]
- Data protection officer
- [Name or “not appointed”]
2. At a glance
- The website sets no advertising or tracking cookies. [check once analytics is chosen]
- The app does not track location. The start and end of a shift are confirmed with a photo.
- App data is stored in the EU: [provider, location].
- For your team’s data we act as a processor; your company remains the controller.
3. Visiting the website
Server logs
When you open the website, our hosting provider processes your IP address, date and time, the page visited, browser and operating system. The legal basis is Art. 6 (1) (f) GDPR. Logs are deleted after [7] days.
Local storage
The website stores only settings such as the chosen language in your browser. [complete the list]
Contact by email
If you write to us, we process your details to answer your request (Art. 6 (1) (b) or (f) GDPR).
4. Using the app in Telegram
We Do runs as a mini app in Telegram. When you open it, Telegram sends us your Telegram ID, name, username and language. We store a profile photo only if you upload it yourself.
Depending on your role, the app creates further data:
- Shifts with start, end, breaks and photos from the site
- Material requests with photos and messages
- Tool check‑outs and returns
- Tasks, site assignments and confirmations
Telegram’s own privacy policy applies to Telegram. [add link]
5. Your team’s data
We process the data your company keeps about its people in We Do on its behalf under Art. 28 GDPR. Your company is the controller. Details are set out in the data processing agreement.
6. Service providers
We use service providers bound by data processing agreements.
| Provider | Purpose | Location |
|---|---|---|
| [Hosting] | Website and app servers | [Country] |
| [Database] | Storing app data | [Country] |
| [File storage] | Photos and PDF files | [Country] |
| [Email delivery] | Plans and invoices | [Country] |
7. Transfers outside the EU
Data leaves the EU only where an adequacy decision or standard contractual clauses apply. [state per provider]
8. Retention
- Shift photos
- deleted after [60] days
- Hours and timesheets
- [period under retention duties]
- Account after cancellation
- [period]
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An email to [privacy@…] is enough.
You can also complain to a data protection supervisory authority, for example [competent authority].
10. Changes
We update this policy when the app or the law changes. The version published here applies.