1. Data Controller
HourCount EU is a European project providing a worker-centered time-tracking system. As the data controller under Article 4(7) of the GDPR, HourCount EU determines the purposes and means of processing your personal data.
Controller: HourCount EU (European project)
Website: https://hourcount.eu
Contact for data protection: See our Imprint page for full contact details.
We have not appointed a Data Protection Officer (DPO) as we are not required to under Article 37 of the GDPR. Questions regarding data protection can be directed to the contact listed on our Imprint page.
2. Personal Data We Collect and Process
We process only the data strictly necessary to provide the time-tracking service. We follow the data minimisation principle (Article 5(1)(c) GDPR) and the technical scope guidelines of the European Data Protection Board (EDPB Guidelines 2/2023 on Article 5(3) ePrivacy Directive).
2.1 Account Data
- Username — your chosen display name
- Email address — for account recovery, notifications, and security
- Hashed password — stored using bcrypt; we never see your plain-text password
- Account preferences — theme, break-subtraction settings, display options
2.2 Time-Tracking Data
- Shift records — clock-in/out timestamps, shift status, notes you add
- Break records — break start/end timestamps, duration, break notes
- Task data — task titles, descriptions, status, priority, time spent
- Project data — project names, colours, associated tasks and jobs
- Job records — job tracking entries linked to projects and tasks
2.3 Technical Data & Storage Technologies
- IP address & Server Logs — logged for security, rate-limiting, and abuse prevention (retained 90 days)
- Session identifiers — authentication cookies required for secure session management
- Browser storage (LocalStorage & IndexedDB) — used strictly for local UI state, live timer continuity, and unsaved draft protection
- User agent — browser type for compatibility detection
2.4 Data We Do NOT Collect
- We do not collect location data or GPS coordinates
- We do not use biometric data or facial recognition
- We do not track your activity across other websites
- We do not process special category data under Article 9 GDPR (race, health, religion, etc.)
- We do not use your data for advertising or sell it to third parties
3. Lawful Basis for Processing
Under Article 6 of the GDPR, we rely on the following lawful bases:
| Processing Activity | Lawful Basis (Art. 6 GDPR) |
|---|---|
| Account creation and authentication | 1(b) — Performance of a contract |
| Recording shifts, breaks, tasks, projects | 1(b) — Performance of a contract |
| Generating reports and exports | 1(b) — Performance of a contract |
| IP logging, rate-limiting, security monitoring | 1(f) — Legitimate interests (cybersecurity and fraud prevention) |
| Server error logs & audit records | 1(f) — Legitimate interests (system stability) & 1(c) Statutory obligation where applicable |
| Password reset emails & transactional notices | 1(b) — Performance of a contract |
We do not rely on consent as the primary lawful basis for core time-tracking processing. Time tracking is necessary to perform the contract requested by the user. Where consent is requested (e.g., for optional non-essential cookies), it can be freely withdrawn at any time.
4. Purposes of Processing & Risk Assessment
We process your personal data exclusively for the following purposes:
- Service provision — operating the time-tracking system, storing your shifts, breaks, tasks, and projects
- Account management — authentication, password recovery, preference storage
- Reporting and export — generating timesheets, summaries, and downloadable reports
- Security and integrity — rate-limiting, brute-force protection, session management, audit logging
- System reliability — error monitoring, performance optimisation, bug fixing
We do not process your data for automated decision-making or profiling (Article 22 GDPR).
Data Protection Impact Assessment (DPIA) Assessment: Under Article 35 GDPR, a DPIA is required when processing is likely to result in a high risk to individuals' rights. Because HourCount EU does not perform continuous location tracking, biometric monitoring, or covert worker surveillance, a formal DPIA is not triggered for our infrastructure. However, we continuously conduct internal privacy risk evaluations.
5. Data Retention and Storage
We retain your data only as long as necessary for the purposes listed above:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account data (username, email, preferences) | Until account deletion is requested | Contractual performance |
| Shift, break, task, project, job records | Until account deletion or 5 years of inactivity | Tax/freelance audit support & user record continuity |
| Server logs (IP, user agent, timestamps) | 90 days, then automatically deleted | Security investigation & system debugging |
| Failed login attempts (rate-limit table) | 24 hours, then automatically purged | Brute-force attack prevention |
| Password reset tokens | 1 hour after expiry or use | Security token lifecycle |
After the retention period, data is permanently deleted or anonymised. If you request account deletion, all associated data is removed within 30 days.
Employment Context & Art. 88 Member State Rules: Some EU Member States (e.g., Spain, Germany, France) mandate specific working-time recording retention rules for employers (e.g., 2 to 4 years under CJEU Case C-55/18 CCOO v Deutsche Bank). If you use HourCount as an employee or employer, your employer — as a separate controller under Article 88 GDPR — is responsible for complying with national labor retention rules. HourCount provides seamless export features to facilitate compliance.
6. Data Recipients and Sharing
We do not sell, rent, or trade your personal data. Access to your data is strictly limited:
- Internal access: Only authorised project administrators, bound by confidentiality obligations
- Hosting provider: Our server hosting provider has access to server infrastructure but does not access application data
- Email service: SMTP provider for transactional emails (password resets, notifications) — sees email addresses and message metadata only
- Legal authorities: Only when required by EU or national law, under a valid legal order
We do not use third-party analytics, advertising networks, or social media tracking pixels.
7. International Data Transfers
Your data is stored on servers located within the European Union. We do not transfer personal data to third countries (non-EU/EEA) unless:
- The transfer is to a country with an adequacy decision under Article 45 GDPR
- Appropriate safeguards under Article 46 GDPR are in place (Standard Contractual Clauses)
- A derogation under Article 49 GDPR applies
If we engage a processor outside the EU/EEA, we will ensure appropriate safeguards and inform you of the transfer and its legal basis.
8. Security Measures
We implement appropriate technical and organisational measures (Article 32 GDPR) to protect your data:
- Password hashing: bcrypt with cost factor
- Transport encryption: HTTPS/TLS for all connections
- Rate limiting: brute-force protection on login and API endpoints
- CSRF protection: token-based validation on all form submissions
- SQL injection prevention: parameterised queries (prepared statements)
- XSS protection: output escaping, Content-Security-Policy headers
- Session management: secure session handling, automatic expiry
- Access control: per-user data isolation, authentication on every request
- Server hardening: security headers (X-Frame-Options, X-Content-Type-Options, CSP)
9. Your Data Subject Rights
Under Articles 15–22 of the GDPR, you have the following rights:
| Right | Article | Description |
|---|---|---|
| Access | Art. 15 | Request a copy of your personal data |
| Rectification | Art. 16 | Correct inaccurate or incomplete data |
| Erasure | Art. 17 | Request deletion of your data ("right to be forgotten") |
| Restriction | Art. 18 | Limit processing of your data |
| Portability | Art. 20 | Receive your data in a machine-readable format |
| Objection | Art. 21 | Object to processing based on legitimate interests |
| Withdraw consent | Art. 7(3) | Withdraw consent for optional processing (e.g., non-essential cookies) |
| Complain | Art. 77 | Lodge a complaint with your supervisory authority |
Detailed information on exercising these rights is available on our Data Subject Rights page.
10. Data Breach Notification
In the event of a personal data breach (Article 33–34 GDPR), we will:
- Notify the competent supervisory authority within 72 hours of becoming aware of the breach
- Inform affected data subjects without undue delay if the breach is likely to result in a high risk to your rights and freedoms
- Document the breach, its effects, and remedial action taken
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will indicate the date of the last update at the top of this page. Material changes will be communicated to you via email or in-app notification.
We encourage you to review this page periodically.