Privacy policy

User account

For each user account we process your name, your e-mail address, your role (administrator or member) and the agency the account belongs to. We do not store your password in plain text, only as a hash value. The account is usually created by an administrator of your agency.

We process this data to give you access to the app, to set your permissions and to perform the contract for the use of treusuite. The legal basis is Art. 6(1)(b) GDPR. Where the contract is not with you personally but with your agency, the legal basis is our legitimate interest and that of your agency in providing the app to you (Art. 6(1)(f) GDPR).

We keep the account data as long as the account exists. If your agency deletes the account, we remove the data from the database. It remains in backups until they are deleted (see “Hosting and backups”).

Data that agencies enter in the app

In the app, agencies enter data about their customers, the people receiving care, the caregivers and other contacts, for example inquiries and placements. For this data, the agency in question is the controller within the meaning of the GDPR. We process it only on the agency’s behalf and on its instructions, based on a data processing agreement under Art. 28 GDPR.

If you want to know how an agency handles your data, or want to exercise your rights regarding this data, please contact that agency. If such a request reaches us, we forward it to the agency.

Login cookies

When you log in, the app sets two cookies:

access_token: proves your login on every request. It is valid for about 15 minutes and is then renewed automatically. refresh_token: renews your login without you entering your password again. It is valid for up to 30 days. At the latest 90 days after logging in, you have to log in again.

If you choose a language in the app, the app stores your choice in the cookie locale for one year.

The cookies apply only to your agency’s address and cannot be read by scripts in the browser. The login cookies are deleted when you log out. In the database we store only a hash value of the refresh_token and its expiry time for each login.

These cookies are strictly necessary for you to use the app you have explicitly requested. Under § 25(2) no. 2 of the German TDDDG, no consent is needed for this. The processing of the data has the same legal basis as your user account. The app uses no analytics, tracking or marketing tools.

Server log files of the app

When you open the app, your browser sends technically necessary data to the server, above all your IP address. The programs of the app write operating and error messages to log files on the server. These contain, for example, the time, the requested address and the result of a request, your IP address when you log in, and for certain actions such as login and logout the internal ID of your user account and your agency. We do not deliberately write content you enter in the app to the logs. In case of a technical error, however, an error message can contain individual details.

The log files are of limited size and are overwritten continuously. There is no fixed retention period in days. How long an entry is kept depends on how many messages are written.

The legal basis is our legitimate interest in a secure and working app, in finding errors and in preventing misuse under Art. 6(1)(f) GDPR.

Protection against misuse at login

To protect user accounts against password guessing, we limit the number of login attempts. For this, the server briefly counts the login attempts per IP address and the failed attempts per e-mail address. These counters are kept only in the server’s memory, are not stored permanently and expire after a few minutes, at the latest after 15 minutes.

The legal basis is our legitimate interest in the security of the app under Art. 6(1)(f) GDPR.

Hosting and backups

The app and its database run on the same server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany as this website.

We make a backup of the database every night. These backups stay on the server for 14 days and are then deleted. In addition, we regularly store a copy on a device of the controller.

Support requests

On the support page of the app you can report errors and suggest improvements. We store each request as an entry (issue) in a private repository on GitHub. The provider is GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

The following is sent to GitHub: the text of your request with the details from the form, the page of the app you were on, for error reports details about your device and browser, and also your name, your e-mail address, your role, the name of your agency, the internal IDs of your user account and agency and the time of the request. Please do not include data about customers, people receiving care or caregivers in a support request.

We process this data to handle your request and to improve the app. The legal basis is Art. 6(1)(b) GDPR where the request concerns the performance of the contract for the use of treusuite, and otherwise our legitimate interest in handling requests under Art. 6(1)(f) GDPR.

GitHub also processes the data in the USA. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework). GitHub is certified under this framework. The transfer is therefore based on Art. 45 GDPR.

We delete a request once it is no longer needed for this purpose, unless statutory retention obligations apply.