Privacy notice for TeamFelsen

Private test operation · Updated: 3 October 2026

1. Controllers and contact details

Platform operator

Arjun Kumar

Postal address

Storkower Str. 219, 10367 Berlin, Deutschland

Privacy contact

info@teamfelsen.com

Data protection officer (if appointed)

No data protection officer has been appointed. Please send privacy enquiries to info@teamfelsen.com.

Your employer is generally responsible for personnel administration and scheduling. Your HR team can provide its full contact details and additional employee privacy information. The platform operator processes employee data on the employer’s behalf where agreed in a contract under Article 28 GDPR. Its separate responsibility for its own contractual, security and operational purposes must be established.

The employing organisation determines the purposes, access rights and retention of its employee data. Your workspace administrator acts for that organisation: maintaining and correcting records, handling data subject requests and checking statutory retention requirements before deletion. Administrators can use available deletion functions and request wider workspace deletion from the platform operator using the privacy contact above.

The platform operator carries out agreed processing on documented instructions and assists with returning or deleting data. Its own legal obligations, particularly security and processing purposes it determines itself, remain in place. Roles depend on the actual processing and must be recorded in the data processing agreement.

2. Data we process

We process account details (name, contact email, user ID, password hash and permissions), workspace membership, country or region, optional role within the organisation, scheduling time zone, the version and time of acceptance of the terms and acknowledgement of this notice, optional contact details and profile photos, and employment information such as department, job, start date and contracted weekly hours. We also process shift assignments, work start and finish times, breaks, calculated working hours, leave and sickness requests, availability, preferences, free-text notes and decisions on requests.

Data comes from you, your HR team and authorised managers. The last login time is stored after a successful standard login. Workspace summaries include user counts, monthly shift, day and week counts, and submitted working days. Hosting may generate technical connection data; its scope and retention periods must be specified below.

3. Purposes and legal bases

You can optionally choose in your profile to receive product news, trial invitations and marketing emails from TeamFelsen. This is off by default. We store the preference, its last change time and, when consent is given, the associated account email address. You can change this preference at any time in your profile; necessary account and security messages are unaffected. The platform operator’s contact list may contain external email addresses, names, organisations, sources or documented permission to contact, and objections. Adding an address does not send a message or establish marketing consent.

Employee data is used for scheduling, time recording and absence management. Where necessary, section 26(1) of the German Federal Data Protection Act (BDSG), together with Article 88 GDPR, may apply; specific legal obligations must be identified. Contract-related administrator accounts may rely on Article 6(1)(b) GDPR. Security and proportionate operational statistics may rely on Article 6(1)(f) GDPR where supported by the required balancing of interests. The interest is providing a secure, functioning service.

Sickness reports may be health data. Processing also requires an exception under Article 9(2) GDPR, such as point (b) together with section 26(3) BDSG where necessary under employment law. Please do not enter diagnoses or unnecessary health information in free-text fields. The legal basis and voluntary nature of photos or other optional information must be assessed separately; revocable consent will be obtained where required. This notice does not replace consent.

4. Access and recipients

Authorised administrators and managers in your organisation manage employee profiles, working hours and requests. When shared schedule visibility is enabled, colleagues can see published shift assignments. Application owners see registered administrator profiles and workspace usage summaries; the interface blocks direct employee views. Technical access by the operator or hosting provider is separate and must be contractually limited to what is necessary. Authorised users can export scheduling data to Excel or PDF.

Hosting, service providers and processing locations: According to the operator: application and database hosted by Microsoft Azure in Sweden Central (Sweden, EU), Azure email service in Germany and Zoho Mail in the EU.

Transfers outside the EU/EEA, recipients, legal basis and available safeguards: According to the operator, personal data is not transferred outside the EU/EEA. The application, database and email services operate within the EU.

5. Cookies and browser storage

The application uses login and security cookies and temporary status information. “Remember me” can keep you signed in after closing the browser. Navigation stores expanded sections in the browser tab’s session storage and resets them when the login page opens. Storage strictly necessary for explicitly requested functions falls under section 25(2), point 2 TDDDG; additional, non-essential storage access requires appropriate consent.

On selected public marketing pages at teamfelsen.com and www.teamfelsen.com, Microsoft Clarity loads only after you consent. Signed-in application pages, login, registration, contact forms, applications and checkout are excluded. Workspace usage summaries continue to use application data.

6. Retention and deletion

Data must be deleted once its purpose no longer applies, unless relevant retention obligations or legitimate legal claims require otherwise. Separate retention periods and deletion procedures must be defined for personnel, working time, absence, account, login, log and backup data.

Specific periods, legal bases, cookie lifetimes and backup deletion: Free pilot: three calendar months from registration, followed by viewing and export. Where the inactivity policy is accepted: email after three calendar months without use; deletion no earlier than one further calendar month after reminders. Use or Keep workspace cancels pending deletion. Existing workspaces must agree. The manual deactivation period remains unchanged. Statutory retention, backup expiry, technical logs and closed support enquiries require separately documented periods.

For workspaces that accept the inactivity policy, the last authenticated use by a member is recorded. After three calendar months without use, the workspace owner receives an email stating the deletion date. Deletion takes place no earlier than one further calendar month after successful delivery and additional reminders. Renewed use or “Keep workspace” cancels the pending deletion. Failed delivery prevents automatic deletion until a further check. Existing workspaces must first accept this policy. Authorised owners can export workspace data, including documents. The application owner can apply a documented deletion hold. Backups and external exports are not immediately deleted by this process; their retention must be documented separately. Following an owner-requested and, where required, approved closure, the workspace is archived for one calendar month; the owner can export data or restore it. Suspension by the application owner is separate from permanent deletion. Permanent deletion requires a separate review, a successfully delivered notice, a wait of at least one calendar month and no deletion hold.

Contact and feedback forms store name, email, optional organisation details, message, topic and any ratings. When signed in, the user and workspace are associated with the submission. Data is used to handle your request; Article 6(1)(b) or (f) GDPR may apply depending on its content. Only the application owner manages the inbox. Notifications and acknowledgements are sent through the configured email service. Closed enquiries are deleted after a separately defined support retention period; this period must be added before production use.

7. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You can withdraw consent at any time for future processing. Send requests to the controller above or your employer; requests are generally handled within one month, subject to legally permitted extensions.

You can complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred.

Competent authority and contact: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin; email: mailbox@datenschutz-berlin.de; https://www.datenschutz-berlin.de/ueber-uns/kontakt/

8. Required information and decisions

Without necessary identification, account and scheduling data, the relevant function cannot be provided. Your employer explains which information is required under employment law and which remains optional. The current service calculates hours and displays scheduling conflicts; authorised people decide on requests. These functions do not provide for solely automated decisions with legal or similarly significant effects.

Legal references and further information

• General Data Protection Regulation (GDPR)
• Section 26 BDSG – employee data (German)
• Section 25 TDDDG – terminal equipment storage (German)
• German Federal Commissioner for Data Protection and Freedom of Information