Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

2. Legal bases

We only process personal data where a legal basis under Art. 6(1) GDPR applies. Depending on the purpose, this is:

• Contract (Art. 6(1)(b) GDPR): to provide the service you or your organization have signed up for, and to take pre-contractual steps at your request.
• Legal obligation (Art. 6(1)(c) GDPR): for example to meet statutory retention duties under tax and commercial law.
• Legitimate interests (Art. 6(1)(f) GDPR): to run a secure, stable website and show it in a suitable language.
• Consent (Art. 6(1)(a) GDPR): where we ask for it. You can withdraw consent at any time with effect for the future.

3. Visiting this website and using the app

To deliver pages, your browser has to send your IP address to our servers. We do not keep web server log files. To keep the website and the app stable and secure and to find errors, we use Azure Application Insights, which records for each request:

• date and time of the request
• the page or function requested, the response time and any error
• an approximate location (country and city) derived from your IP address

Your IP address itself is not stored: Application Insights discards it once the approximate location has been derived. The records are deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure, working service.

4. Language selection

When you first open this website, your browser checks its own time zone setting and shows the German version for Germany, Austria, Switzerland and Liechtenstein and the English version everywhere else. This check happens in your browser only; nothing is sent to us or stored for it. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is presenting the website in a language you understand.

If you switch the language manually, your choice is saved in your browser’s local storage so the website remembers it. This storage is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

5. Cookies and tracking

This website does not use analytics, advertising or social media cookies, and we do not use tracking tools. Fonts are served from our own servers, so opening the website does not connect you to third-party font services such as Google Fonts.

The Timy app uses only technically necessary cookies: one keeps you signed in (for up to 30 days, renewed while you use the app), others protect the Microsoft sign-in and remember the language you chose. They are not used for any other purpose (Section 25(2) no. 2 TDDDG).

6. Contacting us

If you contact us by email, we process the details you give us (such as your name, email address and message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and Art. 6(1)(f) GDPR otherwise. We delete the data once your request has been dealt with, unless statutory retention periods apply.

7. Using the Timy app

When you use the app, we process the following data:

• Account data: name, email address, role, groups, working hours and leave entitlement; if you sign in with Microsoft, also your Microsoft user and tenant ID from Microsoft Entra ID (formerly Azure Active Directory). Passwords and terminal PINs are stored only as salted hashes.
• Profile photo: only if you add one yourself. It is shown in the app and, if your organization uses one, on the clock-in terminal.
• Time records: start and end times, breaks, durations, timer status, the work location you choose (for example office or home office), project assignments, notes, and corrections with their approval.
• Absences: leave requests, sick days (dates only, never a diagnosis), approvals, remaining leave and the public holidays for your location.
• Project data: projects and the time booked against them.
• Presence: colleagues and managers in your organization can see whether you are clocked in, on a break or absent, as far as your organization allows.
• Emails: notifications such as clock-out reminders, weekly summaries and approval requests are sent to your email address.
• Microsoft 365: if your organization enables it, your working status is shown in Microsoft Teams and employee accounts are synchronized from Microsoft Entra ID.
• Dynamics 365: if your organization enables it, employee master data, projects and time bookings are synchronized with its Dynamics 365 environment.
• Mobile and terminal apps: the mobile app uses the camera or photo library only when you choose a profile photo; the terminal app uses the tablet camera only to scan its pairing code. Neither app tracks your location.
• Exports: reports and Excel files are created only when you or an authorized person request them.
• Sign-in history and audit log: time, method, IP address and browser of each sign-in, and who changed which entry and when, to keep the service secure and traceable.

When an organization uses Timy for its employees, that organization (usually your employer) is the controller for this data. We process it on the organization’s behalf as a processor under a data processing agreement in accordance with Art. 28 GDPR. Employees should send requests about their data to their employer first; we support the employer in answering them.

We keep app data for as long as the contract with your organization is in force. When it ends, we delete or return the data as set out in the data processing agreement, unless we are legally required to keep it.

8. Service providers and recipients

We only share personal data where this is needed to provide our services. We use carefully selected service providers who process data on our behalf and are bound by data processing agreements:

• Hosting: Microsoft Azure, operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. This website runs in the Azure region West Europe (Netherlands); the Timy app and its database run in North Europe (Ireland); the usage records described above are stored in West Europe (Netherlands).
• Microsoft: the same company, for sign-in via Microsoft Entra ID and the optional Teams and Dynamics 365 integrations.
• Email delivery: Twilio Inc. (SendGrid), San Francisco, USA, to send notification emails.
• Payments: Stripe Payments Europe, Ltd., Dublin, Ireland, for organizations that book paid modules. Payment details are entered directly with Stripe; we never see card numbers.

We do not sell personal data or pass it on for advertising.

9. Transfers outside the EU

Twilio (SendGrid) processes email data in the United States, and Microsoft may do so for some services. Twilio Inc. and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, we rely on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

10. Data security

All data transmitted between your browser and our servers is protected by TLS encryption. You can recognize an encrypted connection by the lock icon in your browser’s address bar. We also take appropriate technical and organizational measures to protect data against loss, misuse and unauthorized access.

11. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): to know whether and which personal data we process about you.
• Rectification (Art. 16 GDPR): of inaccurate data.
• Erasure (Art. 17 GDPR): of your data, unless we are legally required to keep it.
• Restriction of processing (Art. 18 GDPR): for example while the accuracy of your data is being checked.
• Data portability (Art. 20 GDPR): to receive your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): to processing based on Art. 6(1)(f) GDPR, at any time, on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3) GDPR): at any time, with effect for the future.

To exercise your rights, simply email thomas@timy.app.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work, or where the alleged infringement took place.

12. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes to this policy

We update this privacy policy when our services or the legal requirements change. The current version is always available on this page.