Privacy policy

1. Controller and data protection officer

Controller within the meaning of Art. 4 (7) GDPR for the processing described in Part A:

OptWare GmbH
Prüfeninger Straße 20
93049 Regensburg, Germany
Phone: +49 941 85099600
E-mail: info@optware.de

Data protection officer:

Mr Robert Heindl
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg, Germany

Please address requests for the data protection officer to info@optware.de; we forward them without delay.

2. Two separate roles — please read this first

This offer has two parts, and different parties are responsible for them under data protection law:

• Part A — portal, registration, sign-in. The public pages under swp.optware.de, the registration of an environment and the central sign-in service. OptWare GmbH is the controller here.
• Part B — content inside your environment. Everything a company enters in its own environment after approval, in particular employee data for workforce and shift planning. The registering company is the controller here; OptWare GmbH is the processor under Art. 28 GDPR on the basis of the data processing agreement entered into at registration.

Employees of a customer company therefore address requests about their planning data to their employer. We forward such requests to that company as instructed.

A.1 Hosting and location

The whole platform — portal, sign-in service, database and the customer environments — runs on a dedicated server of

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

The server is located in the Nuremberg (nbg1) data centre in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. Hosting involves no transfer to a third country. The legal basis is our legitimate interest in operating the platform securely and efficiently, Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) GDPR where hosting serves the performance of the contract.

The containers are managed through a Portainer instance we operate ourselves, which also runs on Hetzner infrastructure in Germany; no third party gains access through it.

Fonts, images and stylesheets are served exclusively from our own servers; no content delivery network and no font service is contacted. Only two scripts are loaded from third parties: the Consentmanager dialogue, which every page needs in order to be able to ask you at all (see A.3), and — only after your consent — the Google Ads tag (see A.5).

A.2 Server log files

When you open our pages, the reverse proxy processes technically necessary connection data:

• date and time of the request
• requested address and HTTP status code
• amount of data transferred
• referrer, if it is sent
• browser type and operating system (user agent)
• IP address of the requesting system

The purpose is technically correct delivery, troubleshooting and the detection and defence of attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the security and stability of the platform. Log data is deleted after 14 days. It is never combined with other data sets.

A.3 Cookies and comparable techniques

We distinguish three groups: technically necessary cookies, which we set without consent, one measurement cookie, and the cookies of the Google Ads tag; the latter two we set only after you have consented. You decide about that consent the first time you open our site, in the dialogue of our consent service; you can change or withdraw it at any time through cookie settings in the footer. The decision covers the whole site including the demo, which was under /demo/ until 22 September 2026 and has been the start page itself since.

Consent management (Consentmanager) — the dialogue in which you decide is provided by Consentmanager (consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden). The service is loaded before your decision because it is what makes the decision possible, and it holds every other script back until then. It stores your decision and a random identifier on your device and transfers them to its servers, processing your IP address in doing so. The legal basis for the storage is section 25 (2) no. 2 TDDDG, for the processing Art. 6 (1) (c) GDPR together with our obligation to demonstrate consent under Art. 7 (1) GDPR.

Technically necessary cookies — the legal basis for the access to your device is section 25 (2) no. 2 TDDDG, for the subsequent processing Art. 6 (1) (f) GDPR and, as part of the sign-in, Art. 6 (1) (b) GDPR:

Measurement cookies, only with consent — the legal basis is section 25 (1) TDDDG and Art. 6 (1) (a) GDPR:

Advertising cookies, only with consent — the legal basis is section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. They are set by the Google Ads tag, which we load only after you have consented (see A.5):

Without your consent we set neither swp_sid nor swp_gclid and do not load the Google Ads tag; no connection to Google is made. You can use our pages and the registration in full; we then count the registration steps as totals only, without a link to an individual visit. Your consent can be withdrawn at any time with effect for the future; the lawfulness of the processing carried out until then is unaffected.

A.4 Audience measurement with Umami

We use Umami to analyse how our pages are used. We run Umami ourselves on the same server in Germany; no data is transferred to third parties. Umami sets no cookies and builds no cross-device profiles. It records the page opened, the referrer, screen size, browser and operating system type, the approximate origin at country level and a daily value derived from technical characteristics that is not used to recognise a person. The IP address is not stored.

Because Umami neither stores information on your device nor accesses it, no consent is required (section 25 TDDDG does not apply). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in designing our offer to suit demand and in evaluating it statistically.

In addition we count the stages of the registration flow on the server (page view, registration started, registration submitted, e-mail confirmed, environment provisioned, first invitation sent, user limit reached). For these events we store neither IP address nor user agent. If you consented to the measurement, the random value from swp_sid is stored as well so that the events of one visit belong together; without consent that value is absent and the events are plain counters. The events are deleted after 12 months; the daily statistics derived from them contain no personal reference and are kept.

A.5 Campaign parameters and Google Ads

If you open our site through an advertisement or a link carrying campaign parameters (utm_source, utm_medium, utm_campaign), we store those parameters in order to measure which campaign leads to registrations. The evaluation happens at campaign level only and on our own server. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in measuring the performance of our own advertising.

We also run adverts through Google Ads. If you consented in the consent dialogue, we load the tag for the id AW-17995203671 from googletagmanager.com and report back to Google that a visit led to a registration. This processes your IP address, the cookies set by Google (see A.3), the page opened and the advertising identifier gclid. On that basis Google can also recognise you for advertising on other sites.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data is also transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses under Art. 46 (2) (c) GDPR are in place in addition. For the collection and the transfer of the data we and Google are joint controllers under Art. 26 GDPR; for the subsequent processing Google is the sole controller.

If you register an environment, we also store the gclid ourselves, on that environment's record. The reason is the sequence: between the click on the advert and the completion of the registration your e-mail address is verified through our sign-in service, and after that the identifier is no longer in the address bar. Without it a registration cannot be matched to an advertising click. We use it for one thing only - reporting to Google Ads that a click led to a registration - and it is deleted together with the rest of the person's data as soon as the environment is deleted.

The legal basis for the access to your device is section 25 (1) TDDDG, for the processing Art. 6 (1) (a) GDPR. Without your consent the tag is not loaded and no identifier is stored. Your consent can be withdrawn at any time with effect for the future; the lawfulness of the processing carried out until then is unaffected.

A.6 Registering an environment

For the registration we process:

• company name, requested address (slug) of the environment
• first and last name and e-mail address of the registering person
• the chosen sign-in mode of the environment (open registration, domain restriction, invite only)
• time of the request, confirmation of the terms of use and of the data processing agreement
• campaign parameters of the visit (see A.5), country of the IP address and e-mail domain for the abuse check

The purpose is to review and provide the requested environment and to prevent abusive registrations. The legal basis is Art. 6 (1) (b) GDPR (performance of the usage relationship and pre-contractual measures) and Art. 6 (1) (f) GDPR for the abuse check.

Two steps are mandatory before an environment is provided: confirmation of the e-mail address and a manual approval by our staff. For the approval, the responsible staff see the information listed above. There is no automated decision-making within the meaning of Art. 22 GDPR.

For the registration request we also store the time of approval and, if the trial platform is full, the time the request joined the waiting list; your position follows from it. These timestamps are not additional information about you but processing metadata about your request, and they are deleted with the request record. We notify the registering person by e-mail when a request joins the waiting list and when provisioning begins.

If a request is rejected, we store the information and the reason for rejection for 30 days in order to recognise repeated requests, and delete it afterwards. Requests that are not decided expire after 14 days.

A.7 User accounts and sign-in (Keycloak)

Sign-in and user management run through Keycloak, our own identity service at auth.swp.optware.de. We process:

• e-mail address, first name, last name
• the password only as a hash produced by the current standard method of the sign-in service (currently Argon2id, not reversible)
• membership of an organisation (environment) and roles
• session information (tokens, expiry times), time of the last sign-in
• sign-in and administration events (successful and failed sign-ins, password changes, invitations) — stored for 90 days
• where the customer has connected their own identity provider (SSO): the information it sends, usually e-mail address and name

If you choose “Remember me” when signing in, your session on this device lasts up to 30 days; if you do not use it for 14 days, it ends earlier. Without that choice nothing changes. The choice is advisable only on a device that you alone use.

Directly identifying fields in the user directory are stored encrypted in the database; they exist in plain text only at runtime.

The legal basis is Art. 6 (1) (b) GDPR for sign-in and account management and Art. 6 (1) (f) GDPR for the security logging. For accounts of employees of a customer company we act as that customer's processor in this respect (Part B).

A.8 Sending e-mail

System messages (confirmation of the e-mail address, invitations, setting a password, status messages about the environment, advance notice of pausing and deletion) are sent through the SMTP relay of Azure Communication Services. The sender is DoNotReply@optware.de, replies go to info@optware.de. The service provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement is in place (Microsoft Data Protection Addendum). Recipient address, subject, content and delivery metadata are processed. Microsoft may process support and telemetry data in third countries; the standard contractual clauses and the additional safeguards of the Microsoft agreement apply. The legal basis is Art. 6 (1) (b) GDPR.

A.9 Protection against abuse

To defend against automated registrations, brute-force attacks and overload we use:

• rate limits on the registration and sign-in addresses
• brute-force detection in the sign-in service with a temporary lock of the affected account
• limits on registrations per IP address and per e-mail domain
• confirmation of the e-mail address and a manual approval before anything is provisioned
• blocking IP addresses after repeated failed sign-in attempts on the server itself (fail2ban) for administrative SSH access
• blocking IP addresses at HTTP level, to defend the sign-in and registration pages against automated attacks. What is evaluated is the reverse proxy's access log described in A.2; no new categories of data are collected for it. If an IP address exceeds a threshold of failed or rate-limited requests, it is refused at network level for a limited time. The block list is kept in its own database on the server (/var/lib/fail2ban/fail2ban.sqlite3) and holds the blocked IP address with a timestamp; the entry is removed once the block expires.

No captcha service is used, and neither is any service that compares IP addresses against an external reputation database (such as CrowdSec); no IP address is therefore passed to a third party. In this context IP address, time, requested address and the result of the check are processed; the processing happens exclusively on our own server. The legal basis is Art. 6 (1) (f) GDPR.

A.10 Contacting us

If you contact us by e-mail or telephone, we process your information in order to handle the request on the basis of Art. 6 (1) (b) or (f) GDPR. The data is deleted once the request has been dealt with and no statutory retention obligation applies.

A.11 Backup and restore

Backups of the server are created at Hetzner in Germany. The database of the sign-in service is additionally backed up daily; those backups are kept for 14 days. Key material and credentials are held exclusively in our password store (Vaultwarden).

Note on the free tier: we create no backup of the content of the individual customer environments (Part B) in the free tier. This is set out expressly in the terms of use and in the data processing agreement.

A.12 Recipients

Personal data is disclosed to third parties only

• to the processors named in this policy, with whom agreements under Art. 28 GDPR are in place,
• where you have consented (Art. 6 (1) (a) GDPR),
• where a statutory obligation exists (Art. 6 (1) (c) GDPR), or
• where it is necessary to assert or defend legal claims (Art. 6 (1) (f) GDPR).

Processors and service providers:

A.13 Storage periods

We delete personal data as soon as the purpose ceases to apply and no statutory retention obligation (in particular under German commercial and tax law) stands in the way. Specifically:

The platform's own administration log records the lifecycle of an environment (request, approval, change of settings, invitations, stop, export, deletion). A daily deletion run removes these entries after 90 days; they no longer outlive the deletion of the environment. The e-mail addresses of invited people are not stored in it, only their internal identifier.

Environments nobody signs in to are paused after 30 days and deleted with all their content 30 days later; before each step we send notice 7 days in advance to the registering person.

A.14 Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and the right to withdraw a consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

Right to object: where we process data on the basis of Art. 6 (1) (f) GDPR, you may object to the processing under Art. 21 GDPR on grounds relating to your particular situation.

A message to info@optware.de is enough to exercise these rights. The easiest way to withdraw your consent to the measurement is cookie settings in the footer.

Right to lodge a complaint: you may lodge a complaint with a supervisory authority; the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

A.15 Obligation to provide data

Providing the data collected at registration is voluntary but necessary in order to provide an environment. Without it we cannot establish the usage relationship.

A.16 Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. People decide whether an environment is approved.

After approval the registering company receives its own environment with its own database at <firma>.swp.optware.de. Everything entered there — in particular employee, shift, assignment, qualification and absence data — is processed by us exclusively on that company's instructions.

• Controller: the respective company.
• Processor: OptWare GmbH, on the basis of the data processing agreement entered into at registration.
• Sub-processors: the companies named in annex 3 of that agreement. The push services of the devices (B.1) are not sub-processors, see section 5.5 of the data processing agreement.
• Separation: its own database and its own database user per environment, its own network per environment and its own sign-in client per environment; the environment is reachable only through its own address.
• Access by us: only by named administrators, only through a secured connection, only for operation, troubleshooting and security.
• Deletion: when the environment is deleted, the database and the database user are deleted; the application stores no data of the environment anywhere else. What it keeps in the browser of the device is described in B.1 and B.2.

Data subjects (employees, for example) address requests about this data to their employer as the controller.

B.1 Installable app and push notifications

The environment can be installed as an app on the home screen or the desktop. For this the browser registers a background script (service worker) for the environment's address. It stores nothing on the device but a static page that says, when there is no connection, that the app needs one, together with its stylesheet, script and icon. It stores no content of the environment and no responses of the application.

In the browser the application also keeps the sign-in tokens for the duration of the session (session storage) and, in local storage, the appearance you chose, which entries under “New for you” you dismissed, and whether you dismissed the hint about installing the app. The legal basis for storing this on the device is section 25 (2) no. 2 TDDDG.

Push notifications exist only in the installed app and only if you switch them on there, in the settings for your device, and confirm your browser's prompt; by doing so you request them expressly. You are notified when a plan with your shifts is published or when something changes for you in a republication. The notification states only the period of the plan and the number of your shifts or of your new, moved and cancelled shifts — no names of other people and no free text. You can also send yourself a test notification to your device there.

For this the application stores in the environment's database: the identifier of your user account, the delivery address assigned by your browser's push service, your browser's public key and authentication secret for the encryption, the language of the notifications, the display mode of the app, the browser identifier (user agent, truncated to 255 characters), when the installed app last confirmed the subscription and when you last asked for a test notification. A pending notification is queued until it is delivered.

It is delivered through the push service that your browser or operating system prescribes: usually Google (Chrome and other Chromium browsers, Android), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge on Windows). We do not choose this service and use no program and no account of these providers. The push service receives the notification end-to-end encrypted (RFC 8291) and cannot read it. It sees the delivery address, the size and the time of the notification, a random identifier of the plan (so that a newer notification replaces one not yet delivered), a contact address of ours and our server's IP address; it holds the notification for delivery for at most 24 hours. These services may process data outside the EU as well; their own processing is governed by the privacy notices of the respective provider.

You can switch notifications off at any time in the app's settings or in the settings of your browser or operating system. The subscription is deleted when you switch notifications off in the app or sign out on the device, when the installed app has not confirmed it for 30 days, when the push service reports it as invalid, when your login is detached from your entry in the environment or that entry is deleted, and with the environment. Queued notifications are deleted once delivered, at the latest after 7 days.

B.2 Joining a plan without signing in (join link)

Whoever plans in the environment can switch on a join link for a published plan under “Teilen” (Share, “Beitreten ohne Anmeldung” – join without signing in). Whoever opens this link sees the name of the plan and the names of the persons planned in it, each with a note whether somebody is already connected under that name, and picks their own name. This choice shows no times, no areas, no other plans and no e-mail addresses. The planner can replace the link with a new one or switch it off at any time; the previous link then stops working at once. Existing connections are not affected.

A chosen name is connected either to your user account or to your device, and nobody else can choose it afterwards:

• “Mit meinem Konto verbinden” (connect with my account) — the application links the person to your user account, as the administration of the environment otherwise does; from then on you see your assignments after signing in, on any device. Until you return from the sign-in, the browser keeps your choice — the join link and the identifier of the chosen person — in session storage and deletes it as soon as it has read it.
• “Weiter ohne Anmeldung” (continue without signing in) — the application sets the following cookie on this device:

The legal basis for storing it on the device is section 25 (2) no. 2 TDDDG: the cookie is strictly necessary for the application to provide the service you expressly request with this choice.

For this the application stores in the environment's database: the plan's join link while it is switched on, and for each connected device the identifier of the person, a check value (SHA-256) of the random value in the cookie — the random value itself is not stored —, the plan through which the person joined, the time of joining and the time of the last retrieval, updated at most once an hour. A connected device sees only what “Mein Einsatzplan” (my schedule) shows for that person: their own assignments in published plans and who is planned with them. The planner sees for each person of the plan whether they are connected with a user account or on a device and, for a device, since when. Change requests and the calendar export remain reserved for people who sign in.

A device's connection ends when you choose “Das bin nicht ich” on the device, when the planner ends it with “Verbindung lösen” (release connection), when the person is deleted, and with the environment. The join link is deleted when the planner switches it off, and with the plan.

To protect against abuse, the application counts requests to these addresses reachable without signing in per IP address, in its memory only and not in the database. When it refuses a request because of too many requests, it notes the IP address in the application's log (retained like the application's other logs, see annex 2 of the DPA). Because the join link is part of the requested address, it appears in the reverse proxy's access log like any other requested address (A.2).

Changes to this policy

We adjust this privacy policy when the offer or the legal situation changes. The version published at the time of your visit applies.

Questions about this: info@optware.de