Privacy Policy

Introduction

Welcome to "Zeitplan.io" (the "Service"). This privacy policy outlines how we collect, use, and protect your personal data when you use our Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

Data Controller

Devsym GmbH is the data controller for your personal data. Our contact information is:

Company Name: Devsym GmbH
Address: Kastanienweg 3a, 82319 Starnberg, Germany
Email: info@devsym.de

Information We Collect

We store the following personal information in our database or storage:

• User's Name: To display names in the user interface.
• Email Addresses: For communication purposes and to display in the user interface.
• User's Entra ID Object ID: To identify the user in Microsoft Graph.

We do not store any passwords or other credentials (e.g. Access Tokens).

Data Residency

We store and process all data in Microsoft Azure in the Germany West Central region. Microsoft Azure is a secure cloud platform with various global complicance certifications.

Learn more about Microsoft Azure compliance: Azure Compliance

Use of Collected Information

We use the collected information for the following purposes:

• Service Provision: To provide and maintain the Service.
• Communication: To communicate with users regarding updates, support, and other relevant information.

Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Contract Performance: Processing is necessary for the performance of our service contract with you.
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our services, ensuring security) while maintaining your data protection rights.
• Legal Obligations: Processing is necessary to comply with legal requirements.

Access to Microsoft Graph Scopes

To use all Zeitplan.io features, the app requests the following Microsoft Graph Scopes. All scopes are being requested as delegated permissions, meaning that the app can only access data on behalf of the signed-in user.

• User.ReadBasic.All (delegated): Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo. Learn more
• People.Read (delegated): Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization's directory, and people from recent communications (such as email and Skype). Learn more

This access is used to enhance the functionality of the Service and provide a seamless experience.

Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, use, or disclosure. All data is securely stored in Microsoft Azure in Germany.

Data Subprocessors

We use the following third-party service providers (subprocessors) to help us provide and improve our Service. These subprocessors may process your personal data on our behalf:

• Microsoft Azure: Cloud infrastructure and data storage services (Germany West Central region)
• Paddle.com Inc.: Payment processing and subscription management (data may be processed in the US under appropriate safeguards)
• Microsoft (AppSource): Payment processing and subscription management for purchases made through Microsoft AppSource
• Plausible Analytics: Cookie-free website analytics (no personal data collected, no cookies used)

We ensure that all subprocessors are bound by data protection obligations consistent with this Privacy Policy and applicable data protection laws. We will notify users at least 14 days in advance before adding any new subprocessors.

International Data Transfers

While your data is primarily stored in Germany, some of our subprocessors may process data outside the European Economic Area (EEA). We ensure appropriate safeguards are in place for any international data transfers, including:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Other appropriate safeguards as required by GDPR

Data Retention

We retain personal data for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. After we receive a deletion request, we will delete the data within 30 days.

Your Rights

You have the following rights regarding your personal data:

• Access: You have the right to request access to your personal data.
• Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Erasure: You have the right to request the deletion of your personal data under certain circumstances.
• Restriction: You have the right to request the restriction of processing of your personal data under certain circumstances.
• Objection: You have the right to object to the processing of your personal data under certain circumstances.
• Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact us at support@devsym.de. You also have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.

Cookies and Analytics

We use Plausible Analytics, a privacy-focused analytics service that does not use cookies and does not collect any personal data. Plausible Analytics helps us understand how visitors use our website without compromising your privacy.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach.

Third-Party Data Sharing

We do not sell, rent, or share your personal data with third parties for their marketing purposes. We only share data with the subprocessors listed above as necessary to provide our Service.

Business Users Only

Our Service is intended for business use only. We do not knowingly collect or process personal data from individuals under the age of 16. If you become aware that a child has provided us with personal data, please contact us immediately.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Account Deletion

You can request deletion of your account and all associated personal data by contacting us at support@devsym.de. Upon receiving your request, we will delete your data within 30 days, unless we are required to retain it for legal obligations.

Changes to This Privacy Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page. You are advised to review this policy periodically for any changes.

Contact Us

If you have any questions or concerns about this privacy policy, please contact us at support@devsym.de.