Your Rights at a Glance
Under the General Data Protection Regulation (GDPR), you have eight specific rights regarding your personal data. HourCount EU respects and facilitates all of them. Below is a plain-language explanation of each right and how to exercise it.
We respond to all requests within one month (Article 12(3) GDPR). This can be extended by two months for complex requests, in which case we will inform you of the extension and the reason within the first month.
1. Right of Access
What it means
You have the right to know what personal data we process, why we process it, and receive a complete copy of your records without fee or difficulty.
How to exercise it
- Instant Self-Service: Log in to your account, navigate to Settings, and click Export Data to instantly download all shift, break, task, and project records in a machine-readable format.
- Formal Request: For a comprehensive access request including technical logs or metadata, submit a request via our Imprint contact details with the subject "GDPR Access Request".
We will provide your data in a structured, commonly used, machine-readable format (JSON/CSV) within 1 month.
2. Right to Rectification
What it means
If any of your personal data is inaccurate or incomplete, you have the right to update or correct it immediately.
How to exercise it
- Self-Service Edit: Edit your username, email, or display options directly under Settings.
- Shift/Task Correction: Edit or adjust shift times, task descriptions, and project details at any time from your dashboard.
- Technical Data: For data you cannot modify directly in the interface, contact us through our Imprint page.
3. Right to Erasure ("Right to Be Forgotten")
What it means
You have the right to request full erasure of all your personal data. We will permanently erase your data unless processing is required for a statutory legal obligation or legal claim defence.
How to exercise it
- Log in to your account
- Go to Settings → select Delete Account
- Confirm account deletion — your account and all associated records (shifts, breaks, tasks, projects) will be purged within 30 days
Recommendation: Use the Export Data feature prior to deletion if you require copies of your hours for tax or employment records.
4. Right to Restriction of Processing
What it means
You can request that we restrict processing of your personal data (holding the data in storage without further active processing) under specific conditions:
- When you contest data accuracy (during verification)
- When processing is unlawful but you oppose erasure
- When we no longer need the data, but you require it for legal claims
How to exercise it
Submit a request via our Imprint contact details with the subject "Request for Restriction of Processing". We will restrict active processing and confirm in writing.
5. Right to Data Portability
What it means
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transfer it to another provider or employer without hindrance.
How to exercise it
- Log in to your account
- Go to Settings → Export Data
- Download your full data package (JSON or CSV format)
- Includes: all shifts, breaks, task logs, project classifications, and user configuration settings
HourCount EU is built on open data standards so you always maintain complete control over your work records.
6. Right to Object
What it means
You have the right to object at any time to data processing based on our legitimate interests (Article 6(1)(f) GDPR), including server security logging and anti-abuse monitoring.
How to exercise it
Contact us through our Imprint page with the subject "Objection to Processing". We will evaluate your request and cease processing unless compelling legitimate grounds override your objection or processing is required by law.
7. Right to Withdraw Consent
What it means
Where processing is based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
How to exercise it
- For cookies and local storage: manage via your browser settings or application preferences
- For any consent-based features: contact us through our Imprint page
8. Right to Complain to a Supervisory Authority
What it means
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
How to exercise it
Find your local Data Protection Authority (DPA) on the official EDPB Member Authorities List.
We encourage you to contact us first so we can resolve any issues directly and quickly.
What to Expect When You Submit a Request
How We Verify Your Identity
To protect your data from unauthorised access, we need to verify your identity before responding to a request. This may involve:
- Confirming your request from the email address associated with your account
- Asking you to log in to your account (for requests made through the interface)
- Requesting additional information if there is reasonable doubt about your identity
We will never ask for your full password or sensitive identity documents unless strictly necessary and proportionate.
Fees
Exercising your rights is free of charge. We may charge a reasonable fee for manifestly unfounded or excessive requests (particularly repetitive requests), in accordance with Article 12(5) GDPR. If we do, we will explain why and provide a cost estimate before proceeding.