Last updated: 14 October 2026
Zeitnachweis processes personal data only as far as time recording requires. There is no advertising, no tracking, no sharing for marketing purposes.
The controller within the meaning of the GDPR for this website and the employer accounts is Desatec Systems GmbH, Adolf-Hoyer-Straße 5, 37079 Göttingen, Germany, represented by its managing director André Runzer. Phone +49 551 63 46 731, e-mail info@desatec.systems.
Data protection officer: Alexander Lemke, Adolf-Hoyer-Straße 5, 37079 Göttingen, e-mail datenschutz@desatec.systems.
For the website and the employer accounts, Desatec Systems is the controller within the meaning of the GDPR.
For employees' working time data, the respective employer is the controller; Desatec Systems acts as processor (Art. 28 GDPR). The data processing agreement is available at zeitnachweis.app/avv and is accepted by the employer when registering the account; time and version are stored with the account.
If you use the app without an employer link ("solo mode"), all data stays on your device. Nothing is transmitted to us.
When you visit this website the web server processes technically necessary data (IP address, time, requested page, browser and operating system, transferred volume) in log files. They serve connection set-up, system security and error analysis and are deleted after 14 days. Legal basis is Art. 6 (1) f GDPR (legitimate interest in secure operation). The website cannot be delivered without the IP address, so an objection is excluded in that respect.
No analytics, tracking or advertising services are used. Fonts, scripts and images are loaded exclusively from our own server; there are no connections to third parties.
Cookies: the cookie "zeitnachweis_locale" stores your language choice. In the employer area the application sets a session cookie for the login and a cookie protecting against cross-site request forgery. All three are strictly necessary (§ 25 (2) no. 2 TDDDG) and contain no tracking identifiers.
All transmission is encrypted via HTTPS (TLS).
On sign-up we store company name, e-mail address, password (hash only), time zone and optionally an address and company designation for the header of the timesheet. Legal basis is Art. 6 (1) b GDPR (contract or pre-contractual measures).
To confirm the e-mail address and to reset passwords we send e-mails with time-limited links. Login attempts, password resets and the creation, change and deletion of employees, codes and time entries are logged with time, account and IP address (Art. 6 (1) f GDPR: abuse prevention and traceability of the records).
Account data is stored until the account is deleted. Invoice-relevant data is afterwards subject to the statutory commercial and tax retention periods (§ 257 HGB, § 147 AO).
When an employee links the app to an employer with a registration code, the following is transmitted to that employer's account: display name, start, end and type (work/break) of each time entry, time zone, reasons for manual entries and corrections, device name, app version and the time of transmission. No location data, contacts, photos or usage statistics are collected.
Every change to an entry is stored as a new version with author, time and reason. Nothing is overwritten or silently deleted. Employees see employer corrections in the app and can retrieve and export their own server data at any time.
The controller for this data is the respective employer; we process it as a processor under Art. 28 GDPR on the basis of the data processing agreement (zeitnachweis.app/avv) that the employer accepts at sign-up. The legal basis on the employer side is § 26 BDSG and Art. 6 (1) c GDPR in conjunction with the statutory recording duties (§ 16 (2) ArbZG, § 17 MiLoG, § 3 ArbSchG).
The app stores all data locally in a database on the device. The employer access token is kept in the operating system's secure storage (iOS keychain or Android keystore). The app contains no advertising, analytics or crash-reporting SDKs and opens no connections to third parties.
Without an employer link ("solo mode") no data leaves the device. The link can be disconnected in the app at any time; afterwards nothing is transmitted. Times already transmitted remain with the employer within their retention duties.
Obtaining the app through the Apple App Store or Google Play is subject to Apple's or Google's privacy policies; we receive no personal data from them.
Working time data is kept for at least two years from the respective working day (§ 16 (2) ArbZG, § 17 (2) MiLoG) and deleted afterwards on the employer's instruction.
When an employer requests deletion of their account, the account is locked immediately: logins and all employee links are ended and no further processing takes place. The working time records and associated data remain stored for the statutory retention period (two years from the most recent working day, at least 30 days) and are then deleted automatically and completely, including employee data. A complete export must be generated before deletion (Art. 20 GDPR).
Registration codes expire after the configured validity, website log data after 14 days, confirmation and reset links when their period ends.
Hosting: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located in Germany; a data processing agreement under Art. 28 GDPR is in place.
E-mail delivery (verification, password reset, invitation codes): ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as processor.
No transfer to third countries takes place. Data is not sold and not shared for advertising. Other recipients exist only where we are legally obliged.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Consent you have given can be withdrawn at any time with effect for the future.
Employees address requests about their working time data to their employer as controller; we support the employer in answering them.
You may lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, poststelle@lfd.niedersachsen.de.
Please address privacy questions to datenschutz@desatec.systems or by post to the address above. We adapt this policy when the legal situation or our services change; the version published here applies.
