Privacy Policy

This Privacy Policy explains how Mitves (Astalyne Studios, owner Oguzhan Günel, Günzburger Str. 37, 89340 Leipheim, Germany) processes personal data in connection with the Mitves website, the web dashboard, the mobile application and the API (together, the “Service”).

Mitves acts in two different roles. For visitors of our website and for people who contact us or request a trial, demo or quote (“leads”), Mitves is the data controller and this policy applies directly.

For employees of customer companies that use Mitves to record attendance, the customer company (the employer) is the data controller and Mitves is the data processor acting on the customer’s documented instructions under a data processing agreement. Employees should direct questions about why their data is processed to their employer; this policy describes how Mitves handles that data on the employer’s behalf.

Mitves does not sell personal data and does not use customer data for advertising.

• Identity data: name, surname, employee number, position, department, branch or team assignment.

• Contact data: e-mail address and mobile phone number (the phone number is used for password-reset SMS).

• Employment and planning data: role in the Service (admin, manager, employee), shifts, work plans, leave balances, leave and excuse requests, break records.

• Attendance events: event type (check-in or check-out, break start or end), stamp timestamp, the selected location and the GPS coordinates captured at the moment of stamping, distance to the authorised location, the authorised device identifier (device UUID), the identifier of the QR token that was scanned, and the review status of the event.

• Technical data: IP address, user agent, app version, operating system, authentication tokens and audit log entries.

• Payroll documents: files that the employer uploads and publishes to employees (for example payslips). Mitves stores and delivers these documents; it does not calculate payroll and does not analyse their content.

• Special categories (Article 9 GDPR): a leave of the type sick leave (its type, dates and any note) is health data, and payslips commonly show the church tax status, which indirectly reveals a religious affiliation (CJEU, C-184/20). Mitves only stores and shows them for the employer: sick-leave details only to the employee and to the administrators and managers whose leave scope covers them, a payslip only to the employee and to those with the payroll scope. The employer, as controller, decides the legal basis; for health data in the employment relationship this is typically Article 9(2)(b) GDPR together with national employment law (in Germany § 26(3) BDSG).

• Website lead data: company name, contact name, e-mail address, phone number, company size, message and request type (trial, demo, quote or contact) submitted through our website forms.

• Integration data: API tokens and webhook endpoints configured by the customer administrator.

Website visitors and leads (Mitves as controller): answering requests and providing trials, demos and quotes (steps prior to entering into a contract), operating and securing the website (legitimate interest), and keeping records required by law (legal obligation).

Customer employees (Mitves as processor): Mitves processes attendance data solely to provide the Service to the employer. The employer determines the legal basis, which is typically the performance of the employment contract, the employer’s legal obligation to record working time, and the employer’s legitimate interest in keeping attendance records accurate.

Location and device checks are used only to confirm that a stamp was made at an authorised place from an authorised device. They are not used to profile employees or to draw conclusions unrelated to attendance.

Where a legal basis requires the employee’s consent, obtaining and documenting that consent is the employer’s responsibility; Mitves provides tooling to support it.

Mitves does not collect, store or process biometric data of any kind. There is no fingerprint, face, iris or voice recognition in the Service.

Mitves does not track location continuously. GPS coordinates are read only at the moment an employee actively performs a check-in, check-out or break action, only when the employer has enabled location verification and, where the employer asks for it, only with the employee’s consent, which can be withdrawn in the app at any time.

Mitves does not read contacts, photos, messages or other content on the employee’s device. The camera is used only to scan a QR code during stamping.

Mitves does not build behavioural or productivity profiles from attendance data.

Lead data is kept for as long as needed to handle the request and for a maximum of 24 months after the last contact, unless a customer relationship is established.

Customer and employee data is kept for the duration of the subscription. After termination the customer may export its data; Mitves deletes or anonymises the customer’s data within 90 days after termination, except where a longer retention period is required by law or agreed in the data processing agreement.

Attendance history is retained for the statutory period that applies to the employer (for example working-time records under labour law), as configured by the customer. A correction never deletes the original stamp silently: who changed what, when and why is recorded together with the previous values.

The GPS coordinates of a stamp are kept as evidence only for the period the customer sets (1 to 90 days, 90 unless changed) and are then erased; the distance to the location, the GPS accuracy and the check result stay with the record.

Encrypted backups are rotated according to the backup schedule and are destroyed at the end of their rotation period.

Technical logs are kept for security and troubleshooting purposes for at most 14 days and then deleted.

Mitves hosts the Service on virtual private servers located in the European Union (Netherlands). The production database, file storage and encrypted backups remain in the EU.

Mitves uses the following categories of sub-processors: a hosting and infrastructure provider (EU); Cloudflare for DNS and reverse-proxy edge protection (traffic transits Cloudflare’s global network); an SMS provider for one-time password-reset codes; a transactional e-mail provider for account and notification e-mails; and an e-mail hosting provider for our own mailboxes (for example [email protected]).

Map tiles (OpenStreetMap): the location form of the web dashboard, and the locations step of the sign-up once “Show map” is clicked, show map tiles from the OpenStreetMap tile servers of the OpenStreetMap Foundation (United Kingdom). The browser loads the tiles directly from there, so with every tile it sends its IP address, the usual request headers (such as User-Agent, language and the referring Mitves page) and the map area being viewed. The purpose is to show the map so that a location’s centre and radius can be set. Address search is sent by the Mitves server, not the browser, to the Nominatim geocoding service (by default also run by the OpenStreetMap Foundation): it receives the search text, typically an address, but not the user’s IP address; results are cached for one day. Employees’ positions are never sent to the map provider. The OpenStreetMap Foundation’s privacy policy: https://osmfoundation.org/wiki/Privacy_Policy The legal basis is our legitimate interest in showing the map the administrator asked for (Article 6(1)(f) GDPR); the transfer to the United Kingdom rests on the European Commission’s adequacy decision for the United Kingdom.

Bot check at sign-up (Cloudflare Turnstile): the first step of the free-trial sign-up is protected by Cloudflare Turnstile, a service of Cloudflare, Inc. (United States), so that automated sign-ups cannot trigger SMS codes or create accounts. The visitor’s browser loads the check from Cloudflare and sends signals such as its IP address, a TLS fingerprint, the User-Agent header and the site key with its origin; the Mitves server then confirms the result with Cloudflare and passes on the visitor’s IP address. Mitves does not store the check token. Cloudflare’s Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/ The legal basis is our legitimate interest in protecting the sign-up against abuse (Article 6(1)(f) GDPR). Cloudflare processes this data on our behalf; under its Turnstile privacy addendum it may also use it as an independent controller to improve its bot detection. The transfer to the United States rests on the EU–US Data Privacy Framework, under which Cloudflare is certified, with the EU standard contractual clauses as a fallback.

Crash reports and push notifications in the mobile app (Google Firebase): the app uses two Firebase services of Google. Firebase Crashlytics receives a report when the app crashes or meets an unexpected error: the error type, the stack trace (code locations in the app), the device model, the operating system and app version, the time and a random installation identifier created by Crashlytics; the phone also sends its IP address with the connection. A report contains no name, user ID, phone number, error message, position or attendance data, and development builds send none. Firebase Cloud Messaging delivers push notifications: the app registers a push token for the phone with Mitves, and the Mitves server sends only a fixed title and text for each kind of notification (for example “A stamp needs review”) with the notification’s number and kind through Firebase to that token, never a person’s name, a place, a time or other details, which the app loads from Mitves once it is opened; on iPhones Firebase passes the notification on to Apple’s push service (APNs). The purposes are finding and fixing errors in the app and delivering notifications. Google may process this data in the United States. Firebase privacy information: https://firebase.google.com/support/privacy Google (Google Ireland Limited and Google LLC) acts as a processor under the Firebase data processing and security terms. The legal basis is the legitimate interest in a working app and in delivering notifications (Article 6(1)(f) GDPR). The transfer to the United States rests on the EU–US Data Privacy Framework, under which Google LLC is certified, with the standard contractual clauses in Google’s terms as a fallback. On iPhones, Apple Inc. (United States) receives the push token and the fixed text in order to deliver the notification.

Licence payments and VAT ID check (Mitves as controller): customer administrators pay by card or PayPal on the payment pages of Stripe (Stripe Payments Europe, Limited, Ireland) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), which process the payment data as independent controllers; card data never reaches Mitves, which only receives the payment status and reference. For an invoice without German VAT to an EU business, Mitves checks the customer’s VAT ID with the European Commission’s VIES service, sending that VAT ID and Mitves’ own, and keeps the confirmation with the order. The legal basis is the performance of the contract and Mitves’ tax obligations (Article 6(1)(b) and (c) GDPR); orders and invoices are kept for the statutory retention period (§ 147 AO, § 14b UStG). Privacy information: https://stripe.com/privacy and https://www.paypal.com/privacy

Company verification before the first licence (Mitves as controller): before a customer buys its first licence, its administrators upload a trade register extract, a business registration or a comparable official document. Mitves compares it with the billing details to make sure the Service is sold to businesses only and that invoices name the right buyer. These documents can contain the names, dates of birth and addresses of owners or managing directors. Only the Mitves staff who check verifications can open them; they are stored in the EU for as long as the customer account exists and are then deleted with its data. The legal basis is the performance of the contract and Mitves’ legitimate interest in selling to businesses only and preventing fraud (Article 6(1)(b) and (f) GDPR).

Leave calendar link (calendar provider chosen by the user): unless the employer has switched it off, a user can create a private link to their leave calendar and subscribe to it in a calendar app of their choice, for example Microsoft Outlook, Google Calendar or Apple Calendar. The calendar provider then fetches the link from the Mitves server about once an hour and keeps what it receives: the user’s own approved leave and, for administrators and managers, the approved leave of the people whose leave they manage, with name, dates and leave type; sick leave is named as such only where the user may also see it in Mitves. Mitves sends nothing else and does not choose the provider: the provider is not a Mitves sub-processor, and its own privacy policy applies to what it stores, including any transfer outside the EU. Mitves keeps only a hash of the link, when it was created and when a calendar last fetched it. Anyone who has the link can read these entries, so it should not be passed on; the user can replace or remove it at any time, and it is removed when the account is deactivated or erased. The employer, as controller, decides whether staff may use calendar links and on which legal basis; for health data the rules on special categories above apply.

A current list of sub-processors with their locations is published at https://mitves.com/en/legal/subprocessors and is updated before a new sub-processor is engaged. Customers are informed of changes and may object on reasonable data-protection grounds.

All sub-processors are bound by written agreements that impose data-protection obligations no less protective than those in our data processing agreement.

• Encryption in transit: all connections to the website, dashboard, API and mobile app use TLS.

• Encrypted backups: database and file backups are encrypted at rest and stored separately from production systems.

• Access scopes: every user has a role (admin, manager, employee), and managers only see the branches and teams assigned to them. API tokens are scoped and can be revoked at any time.

• Audit trail: creating, correcting or deleting an attendance record stores who did it, what changed, when and why.

• Immutable raw history: original stamp data is never overwritten; corrections are stored as separate, attributed entries.

• Device authorisation: employees can only stamp from devices that an administrator has authorised, and devices can be revoked.

• Operational controls: least-privilege server access, separated staging and production environments, dependency updates and monitoring.

No system is completely secure. If we become aware of a personal data breach affecting customer data, we notify the affected customer without undue delay so that it can meet its own notification obligations.

Depending on the law that applies to you (GDPR, KVKK or other), you may have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability and to lodge a complaint with a supervisory authority.

If you are an employee of a Mitves customer, please send your request to your employer, who is the data controller. Mitves assists employers in responding to such requests through the export, correction and deletion functions of the Service.

If you are a website visitor or lead, you can contact Mitves directly at [email protected]. We may ask you to verify your identity before acting on a request and will respond within the period required by applicable law.

Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Customer data is stored and processed in the EU. Where a customer is established outside the EU (for example in Türkiye), the customer’s own law may treat hosting in the EU as an international transfer. In that case the customer, as controller, is responsible for ensuring an appropriate legal mechanism (for Türkiye the standard contract under Article 9 of the KVKK, notified to the Personal Data Protection Authority within five business days of signing, not the data subject’s consent), and Mitves signs it with the customer and supports this through the data processing agreement.

Cloudflare and Google (Firebase) may process limited technical data in the United States. These transfers rest on the EU–US Data Privacy Framework, under which both are certified, with the EU standard contractual clauses as a fallback. The text messages and e-mails of the Service are sent through Amazon Web Services in the EU region Frankfurt.

Mitves does not transfer personal data to a third country for its own purposes.

We may update this policy when the Service, our sub-processors or the law change. The date of the latest version is shown at the top of the page. Material changes are communicated to customers by e-mail or in the dashboard.

Controller contact: Astalyne Studios, owner Oguzhan Günel, Günzburger Str. 37, 89340 Leipheim, Germany, e-mail [email protected].

If a data protection officer or representative is appointed, their contact details will be published here.