Privacy policy

1. Controller and data protection officer

The controller for this website and for the management of customer accounts is Bergx2 GmbH, Hochriesstr. 46, 85560 Ebersberg, Germany, email: info@bergx2.de, phone: +49 89 70074700. vivotempo is a project of the Bergx2 GmbH group.

Data protection officer: Zsu Sernc-Urban, reachable at the same address or by email to info@bergx2.de with the subject “Data protection”.

2. Employee data: processing on behalf of the employer

Companies use vivotempo to manage their employees' leave, working time, sick leave and other personnel data. The respective company is the controller for this data. We process it only on its behalf and according to its instructions (processing on behalf according to Art. 28 GDPR).

If you work for one of our customers and have questions about your data or want to exercise your rights, please contact your employer. If such requests reach us, we forward them to your employer.

Depending on the features in use, we process:

• Master data such as name, email address, personnel number, department, start and leaving date
• Leave and other absences
• Working time and breaks
• Sick leave with its period and, where applicable, certificates; this is health data according to Art. 9 GDPR that only persons authorised by the employer can see
• Features for signing in at the terminal: PIN, NFC card, QR code, Bluetooth device or a facial feature. For face recognition, a feature vector is calculated from a camera image and stored. The employer decides whether this feature is used; it usually requires the consent of the employees.

3. Hosting and server logs

vivotempo is operated by Vercel Inc. (USA). Supabase Inc. provides the database, sign-in and file storage with servers in the European Union (Paris). Both act as our processors. Where data is transferred to the USA, we rely on the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission.

When you access the website and the app, the servers process technically necessary data: IP address, date and time, page accessed, amount of data transferred, browser and operating system. This is necessary for delivery, stability and security (Art. 6(1)(f) GDPR). The providers keep these logs only briefly and delete them automatically.

All connections are encrypted with TLS.

4. Cookies and local storage

We do not use cookies for advertising or analytics. We only store technically necessary information: your sign-in in the local storage of your browser, the selected language (cookie “locale”), a flag without any sign-in data showing that you are signed in (cookie “vt_portal”, so that vivotempo.com opens the portal directly) and display settings such as dark mode. This storage is strictly necessary for the features you request (§ 25(2) no. 2 TDDDG) and does not require consent.

You can delete this data at any time in your browser settings; you will then have to sign in again.

5. Customer account and contract

For registration and the customer account, we process the company name, name and email address of the contact person, billing address, VAT identification number and the booked plan (Art. 6(1)(b) GDPR). We check VAT identification numbers using the VIES service of the European Commission.

We keep invoices and accounting records for as long as commercial and tax law require, up to ten years (§ 257 HGB, § 147 AO).

6. Payments

For paid subscriptions we use the payment service Mollie B.V. (Amsterdam, Netherlands). You enter payment data such as bank details or card data directly with Mollie; we only receive the information needed for accounting (Art. 6(1)(b) GDPR). Mollie's privacy notice is available at https://www.mollie.com/privacy.

7. Emails and two-factor sign-in

We send system messages such as confirmation codes, password links and notifications about requests via a mail service of Bergx2 GmbH and via Scaleway SAS (Paris, France).

Codes for two-factor sign-in are sent by email or, if you choose so, via Threema using the Threema Gateway of Threema GmbH (Switzerland); the European Commission has issued an adequacy decision for Switzerland. With passkeys we only store a public key; your fingerprint or face never leaves your device.

8. Contact and feedback

If you email us or send feedback in the app, we process your information and any attachments to handle your request (Art. 6(1)(b) or (f) GDPR). We delete it as soon as it is no longer needed for this purpose.

Via the contact form on our website we process your name, email address and message and, if you provide them, company, phone number and company size, as well as the chosen language, the page you write from and the country derived from the connection (Art. 6(1)(b) and (f) GDPR). To prevent misuse we store an irreversible check value instead of your IP address and delete it after 30 days. You receive an automatic confirmation of receipt. Enquiries that do not lead to a business relationship are deleted no later than 12 months after they have been dealt with.

9. Other services

We do not use web analytics, tracking or advertising services. Fonts, flags and images are delivered from our own servers.

• Public holidays: when public holidays are imported, your browser accesses the public service Nager.Date (date.nager.at); your IP address is transmitted in the process.

10. Storage period

We store personal data only for as long as it is necessary for the purposes mentioned or statutory retention periods require. Data we process on behalf of a company is deleted according to its instructions, at the latest after the end of the contract. The company can set retention periods for time entries and sick leave in vivotempo itself.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

12. Changes

We adapt this privacy policy when our services or the legal situation change. The version published here applies.