Политика приватности

Introduction

The following gives a simple overview of what happens to your personal information when you visit our website. Personal information is any data with which you could be personally identified. Detailed information on the subject of data protection can be found in our privacy policy found below.

Who is responsible for the data collection on this website?

The data collected on this website are processed by the website operator. The operator’s contact details can be found in the website’s required legal notice.

How do we collect your data?

Some data are collected when you provide it to us. This could, for example, be data that you sent us with an email.

Other data are collected automatically by our IT systems when you visit the website. These data are primarily technical data such as the requested URL or when you accessed the page. These data are collected automatically as soon as you enter our website.

What do we use your data for?

Part of the data is collected to ensure the proper functioning of the website. Other data can is used to analyze how visitors use the site.

What rights do you have regarding your data?

You always have the right to request information about your stored data, its origin, its recipients, and the purpose of its collection at no charge.

You have the following rights under the GDPR:

Right to access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (“Right to be forgotten”) (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)

We do not use automated decision-making or profiling processes.

You can contact us at any time using the address given in the legal notice if you have further questions about the issue of privacy and data protection. You may also, of course, file a complaint with the competent regulatory authorities.

Data protection

We treat your personal data as confidential and in accordance with the statutory data protection regulations and this privacy policy.

If you use this website, various pieces of personal data will be collected. Personal information is any data with which you could be personally identified. This privacy policy explains what information we collect and what we use it for. It also explains how and for what purpose this happens.

Data transmitted via the internet (e.g. via email communication) may be subject to security breaches. Complete protection of your data from third-party access is not possible.

Responsible for this website

The party responsible for processing data on this website is:

Kevin Papst, Schweidlgasse 46/1/13, 1020 Vienna (Austria)
Email: support@kimai.org
EU-VAT Id: ATU75657727

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (names, email addresses, etc.).

Many data processing operations are only possible with your express consent. You may revoke your consent at any time with future effect. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed.

Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes the GDPR or the Austrian Data Protection Act (DSG), you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In particular, you may contact the supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority competent for us is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0, Email: dsb@dsb.gv.at, Web: https://dsb.gv.at/

Right to data portability

You have the right to have data which we process based on your consent or in fulfillment of a contract automatically delivered to yourself or to a third party in a standard, machine-readable format. If you require the direct transfer of data to another responsible party, this will only be done to the extent technically feasible.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries you send to us as the site operator.

If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

Access, rectification, restriction, erasure

Within the scope of the applicable legal provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the processing, and, where applicable, the right to have this data rectified, its processing restricted or erased. For this purpose and for any other questions regarding personal data, you can contact us at any time at the address given in the site notice.

Personal data is erased when it is no longer necessary for the purposes of processing, in particular if the service is not used during a trial period.

Data collection

Cookies

Some of our web pages use cookies. Cookies help make our website more user-friendly. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called “session cookies.” They are automatically deleted after your visit. Other cookies remain in your device’s memory until you delete them. These cookies make it possible to recognize your browser when you next visit the site.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be configured to automatically accept cookies under certain conditions or to always reject them, or to automatically delete cookies when closing your browser. Disabling cookies may limit the functionality of this website.

Cookies which are necessary to allow electronic communications or to provide certain functions you wish to use (such as the shopping cart) are stored pursuant to Art. 6 paragraph 1, letter f of DSGVO. The website operator has a legitimate interest in the storage of cookies to ensure an optimized service provided free of technical errors. If other cookies (such as those used to analyze your surfing behavior) are also stored, they will be treated separately in this privacy policy.

Server Hosting and location

The service runs on the Cloud of the Hetzner Online GmbH (Germany). Server location is Falkenstein, Germany.

Server log files

The website provider does not collects or store any personal information in “server log files”. Only in cases of errors the request time and error reason is stored. This data will be automatically deleted after 7 days. This data will not be combined with data from other sources. The basis for data processing is Art. 6 (1) (b) DSGVO, which allows the processing of data to fulfill a contract or for measures preliminary to a contract.

Registration

In order to use the Kimai time tracking software, you must register via the website. The information required for registration can be found in the registration form. The provision of the data, which is marked as mandatory, is mandatory for the registration to be completed. If you register via an authentication provider (such as Google or GitHub), the data will be automatically transferred to me by this provider, through a process called OAuth. If you register manually via email, a Recaptcha verification needs to be solved which is served by Google. The authentication provider used will be notified of each login process on the website that you perform using this provider. The data provided will be processed for the purpose of providing the service. The processing is based on the legal basis of Art. 6 para. 1 sentence. 1 b DSGVO.

Order of a Kimai-Cloud plan

If you should decide for a chargeable plan, your invoice and payment data is processed for the purpose of contract fulfilment. The provision of invoice and payment data is mandatory for the conclusion of the contract. Insofar as it is necessary for the fulfilment of the contract, data is also transmitted to third parties (e.g. to the payment service provider or the commissioned credit institution). The legal basis for data processing is Art. 6 Para. 1 S. 1 b DSGVO.

Emails about our services

We use Brevo (Sendinblue GmbH, Berlin) to send emails about our services (cloud and plugins). When you register and create a Kimai Cloud, we process your email address and name to perform the contract. Where necessary for this purpose, we transfer data to our email service provider. The legal basis is Art. 6(1)(b) GDPR.

Newsletter

If you subscribe to our newsletter, Brevo processes your email address as well as your IP address and the date and time of subscription on our behalf. During subscription, we obtain your consent to receive the newsletter and to the analysis described below, describe its content specifically and refer to this privacy policy.

Our newsletters contain technologies that allow us to analyse whether and when a newsletter was opened and which links in it were clicked. We store this data together with technical data (system data and IP address) in order to improve the quality of our newsletters and to better tailor them to your interests.

The legal basis for sending the newsletter and for this analysis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) by clicking the unsubscribe link in any newsletter or by informing us informally. The lawfulness of processing carried out before the withdrawal remains unaffected.

YouTube

The website uses plugins from YouTube, which is operated by Google. The operator of the pages is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of the pages featuring a YouTube plugin, a connection to the YouTube servers is established. Here the YouTube server is informed about which of the pages you have visited. If you’re logged in to your YouTube account, YouTube allows you to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. YouTube is used to help make the website appealing and transfer knowledge about Kimai. Further information about handling user data, can be found in the data protection declaration of YouTube under https://policies.google.com/privacy. This constitutes a justified interest pursuant to Art. 6 (1) (f) DSGVO.

Website Analytics

To gather important information about our visitors’ behavior, we use a self-hosted Umami. This analytics software provides us with insights into our visitors in general, but not into individual users, as it does not track visitors or store any personal data.

Gumroad

When you want to buy a plugin and click the “Buy” buttons in the shop, you are redirected to the software selling platform Gumroad.

For purposes of European data protection legislation, Gumroad is the controller of personal information that are collected for their own business purposes during the shopping and payment process.

LemonSqueezy

When you want to buy a plugin and click the “Buy” buttons in the shop, you are redirected to the software selling platform Lemon Squeezy.

For purposes of European data protection legislation, Lemon Squeezy is the controller of personal information that are collected for their own business purposes during the shopping and payment process.

Hetzner Cloud

The service runs on the Cloud of the Hetzner Online GmbH (Germany). Server location is Falkenstein, Germany.

Duration of storage

Unless otherwise stated in the previous information, your data will only be stored for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise from commercial or tax law regulations.

Subprocessor

We are using the following service providers (also called sub-processors) to assist with data processing:

Sub-processors for Kimai Cloud

These providers process data that customers record in their Kimai Cloud on our behalf, under a contract pursuant to Art. 28 GDPR.

Brevo: Emails, Newsletter, Link, Privacy policy
Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany

Hetzner: Server Hosting, Link, Privacy policy
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Mailbox: Support Emails, Link, Privacy policy
Heinlein Hosting GmbH, Schwedter Straße 8/9B, 10119 Berlin, Germany

Recipients for our own processing

These providers do not process any data from our customers’ Kimai Clouds. They are involved in registration, payment processing, the operation of our website or the sale of plugins for self-hosted installations. Some of them act as independent controllers.

Cloud owner

Stripe: Payment and Invoices (independent controller), Link, Privacy policy
Stripe Payments Europe Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland

Optional usage: only if the respective provider is chosen to sign in to the customer account.

GitHub: Cloud OAuth login, Link, Privacy policy
GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA

Google: Cloud OAuth login, Link, Privacy policy
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Website visitors

Google: YouTube videos (only after starting a video), reCAPTCHA during manual registration, webfonts, Link, Privacy policy
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

OnPremise customers

Both providers sell the plugins in their own name and act as independent controllers.

Gumroad: Plugin Marketplace, Link, Privacy policy
Gumroad, Inc., 548 Market St, San Francisco, CA 94104-5401, USA

Lemon Squeezy: Plugin Marketplace, Link, Privacy policy
Lemon Squeezy, 222 Main Street Suite 500, Salt Lake City, UT 84101, USA

Change history

21.09.2026: Corrected competent supervisory authority (Austrian Data Protection Authority)
07.05.2026: Removed Google Fonts
20.03.2026: Removed Simple Analytics (anonymous EU website tracking) - replaced by a self-hosted solution
21.02.2026: New provider “Mailbox” for support emails (previously: Google), correction Stripe contact (previously: USA, now: EU)
06.01.2026: Mention 8 rights under the GDPR
23.06.2025: Removed URL of German data protection authorities and replaced “German” with “of the federal state in which our company is based”
18.03.2024: Replaced “Sendinblue France” with “Brevo Germany”, added Simple Analytics
14.11.2023: Recaptcha verification via Subprocessor “Google” re-added
25.04.2021: Recaptcha verification via Subprocessor “Google” removed
01.01.2021: Change of contact details after moving from Germany to Austria
18.12.2020: Removed “Gumroad” and “Google” (Email), added “SendInBlue” (Email), added details to “Subprocessor”
14.10.2020: Recaptcha verification via Subprocessor “Google” added
04.12.2019: Added “Hetzner” (Hosting), added section “Emails” and “Subprocessor”