Politique de confidentialité

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

peppergrid UG (haftungsbeschränkt) Conertplatz 15b 01159 Dresden Germany

Managing Director: Torsten Stein Email: [vigotime.com] Website: https://vigotime.com

2. Types of Data Processed

We process the following categories of personal data:

• First and last name
• Email address
• Company name and billing address
• Department affiliation and qualifications
• VAT ID (if provided)

• Schedules and shift assignments
• Time tracking records
• Vacation requests and absences
• Preferences in the wish system
• Notification preferences

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Device identification (Mobile App)

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes:

• Provision and operation of the vigotime platform (Web App, Mobile App, API)
• Creation and management of schedules
• Time tracking and vacation management
• Management of user accounts and organizations
• Processing of payments and subscriptions via Stripe

• Ensuring IT security and operations
• Analysis and improvement of our services
• Detection and prevention of misuse

• Sending marketing emails and newsletters (if consented)
• Use of non-essential cookies

• Compliance with commercial and tax retention obligations
• Working time documentation according to working time legislation

4. Payment Processing with Stripe

For payment processing and subscription management, we use the payment service provider Stripe, Inc. (510 Townsend Street, San Francisco, CA 94103, USA).

The following data is transmitted to Stripe during payment processing:

• Company name and billing address
• Email address of the billing recipient
• VAT ID (if provided)
• Selected plan and billing cycle
• Number of active employees (for calculating the subscription price)

Processing is based on Art. 6(1)(b) GDPR (contract performance). Stripe processes the data as an independent processor. Credit card and bank data are processed exclusively by Stripe and are never stored on our servers.

Stripe is certified under the EU-US Data Privacy Framework. For more information about data protection at Stripe, please visit: https://stripe.com/privacy

5. Hosting and Cloud Services (Firebase / Google Cloud)

vigotime is operated on the Google Cloud Platform and uses Firebase services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

The following Firebase services are used:

• Firebase Authentication – User login and authentication
• Cloud Firestore – Application data storage
• Cloud Functions – Server-side business logic
• Firebase Cloud Messaging – Push notifications (Mobile App)
• Firebase Hosting – Web application hosting

Data is stored in data centers within the EU (region europe-west1, Belgium). Processing is based on Art. 6(1)(b) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

More information: https://firebase.google.com/support/privacy

6. Newsletter and Whitepaper Downloads (MailerLite)

To send our newsletter and to provide whitepapers and checklists (lead magnets), we use the service MailerLite (UAB “MailerLite”, Paupio 46, 11341 Vilnius, Lithuania). A data processing agreement pursuant to Art. 28 GDPR is in place with MailerLite.

If you request a whitepaper or checklist via a form, we process your email address and – if you provide it voluntarily – your industry solely to provide the requested content. The legal basis is Art. 6(1)(b) GDPR (processing at your request). To document the provision, we additionally log the time of the request; the legal basis for this is our legitimate interest in verifiability (Art. 6(1)(f) GDPR).

The newsletter is only sent if you separately and expressly consent (Art. 6(1)(a) GDPR, Sec. 7(2) UWG). This consent is separate from the content download and is not pre-selected. We use a double opt-in procedure: you first receive a confirmation email and are only added to the distribution list after your confirmation. The time of sign-up and confirmation is logged to document consent (Art. 7(1) GDPR). You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter email.

Data collected in the course of a content download (email address, industry if provided, time of the request) is stored for as long as necessary to handle the request and to document the provision, and is deleted once the purpose no longer applies and no statutory retention obligations remain. Newsletter data is stored until you withdraw your consent or unsubscribe; after unsubscribing, the data is removed from the active distribution list, while proof of consent and withdrawal may be retained to fulfil our accountability obligation.

7. Cookies

Our website and web application use cookies. Cookies are small text files stored on your device.

These cookies are required for the operation of the website and application. They enable basic functions such as user login and navigation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest).

If you consent, we use cookies to analyze website usage in order to improve our services. The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time.

If you consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). Our measurement ID is G-ZRS3JQJ884.

Google Analytics uses cookies and similar technologies to analyze the use of our website. The following data is processed, among others: truncated (anonymized) IP address, device and browser information, pages visited, time spent, referrer URL, and approximate location data (country/region). IP anonymization is enabled, so your IP address is truncated before any further processing.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google Analytics is only loaded after you have consented via our cookie banner – without your consent, no data is transmitted to Google.

You may withdraw your consent at any time with effect for the future – via the "Cookie settings" link in the footer of our website. You can also prevent collection by Google Analytics using the browser add-on: https://tools.google.com/dlpage/gaoptout

Data transfer to Google servers in the USA cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); EU Standard Contractual Clauses apply in addition. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. Data collected is automatically deleted after 14 months. More information: https://policies.google.com/privacy

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – You may request information about your data stored with us.
• Right to rectification (Art. 16 GDPR) – You may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) – You may request the deletion of your data, provided no legal retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR) – You may request the restriction of processing of your data.
• Right to data portability (Art. 20 GDPR) – You may request to receive your data in a structured, commonly used format.
• Right to object (Art. 21 GDPR) – You may object to the processing of your data based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR) – You may withdraw any given consent at any time.

To exercise your rights, please contact: [vigotime.com]

9. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is: Saxon Data Protection and Transparency Commissioner (Sächsischer Datenschutz- und Transparenzbeauftragter) Devrientstraße 5 01067 Dresden, Germany Phone: +49 351 85471-101 https://www.datenschutz.sachsen.de

10. Third Country Transfers

Some of the service providers we use are based in the USA. Where data is transferred to the USA, such transfer is based on the following safeguards:

• EU-US Data Privacy Framework (DPF) – Stripe, Inc. and Google LLC are certified under the DPF, ensuring an adequate level of data protection pursuant to Art. 45 GDPR.
• Standard Contractual Clauses (Art. 46(2)(c) GDPR) – Where no adequacy decision exists, EU Standard Contractual Clauses are used.

11. Data Retention

We store your personal data only for as long as necessary for the respective processing purposes or as required by legal retention obligations.

• Contract data: For the duration of the contractual relationship and beyond in accordance with legal retention obligations (typically 6 or 10 years under German commercial and tax law).
• Usage data (schedules, time tracking): For the duration of the contractual relationship. After contract termination, data is deleted within 90 days unless retention obligations apply.
• Technical log data: Typically 90 days.
• Upon deletion of the user account, all personal data is deleted within 30 days, unless legal retention obligations apply.

12. Data Security

We employ technical and organizational measures to protect your data against unauthorized access, loss, or misuse:

• Encrypted data transmission (TLS/SSL)
• Access control and permission management
• Multi-tenant architecture with strict data separation between organizations
• Regular security updates and monitoring
• Authentication via Firebase Authentication (email/password, Google, PIN, QR code)

13. Changes to this Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or our services. The current version is always available on this page.

Last updated: June 2026

14. Legal Notice (Impressum)

peppergrid UG (haftungsbeschränkt) Conertplatz 15b 01159 Dresden

Commercial Register: HRB 41153 Registration court: Dresden

Torsten Stein

Phone: +49 152 52 486 727 E-mail: [peppergrid.com]

Sales tax identification number according to Sect. 27 a of the Sales Tax Law: DE344795391

We are not willing or obliged to participate in dispute resolution proceedings in front of a consumer arbitration board.