privacy policy

Controller and contact

Maximilian Nebel, sole proprietorship NEBEL PROJEKT FLOW, Switzerland. Correspondence address: Speerstrasse 34, 8805 Richterswil. Current registered address: Badenerstrasse 736, 8048 Zürich; the amendment of the company name and address is still pending. Until its completion, the sole proprietorship is still entered in the commercial register under "Nebel Nutrition Labs". Privacy enquiries: info@projektflow.ch.

The provider is responsible for website enquiries, its own contract administration, billing and support. For the customer, project and personnel data recorded in the company area, the respective company is responsible in principle; PROJEKT FLOW processes this data on the company's behalf in order to provide the software. For shared temporary staffing assignments, the temporary staffing agency and the client company must clarify their respective responsibilities and information duties.

Erstgespräch und Google-Buchungskalender

We use Google Calendar (Appointment Schedules) and Google Meet for optional appointment booking. The external calendar is embedded only after you click “Load Google booking calendar”. Google then receives technical connection data such as your IP address. The Google booking form asks for your name, email, business and trade; team size is optional. We use these details to organize and conduct the requested meeting, including confirmations, changes and reminders. This does not automatically subscribe you to advertising.

Google processes booking data under its own terms of service and privacy information. Processing abroad is possible. PROJEKT FLOW does not display private calendar events on the website or store a second copy of your details in a lead database through the embedded form. You can hide the calendar at any time or contact info@projektflow.ch. To cancel or change an appointment, use the details in your confirmation.

Trial enquiries

Details from the enquiry form are stored in the database and are accessible only to approved platform administrators. An email notification may additionally be sent to info@projektflow.ch. If the mail service fails, the enquiry remains stored for personal handling. We use the details for the requested contact and setup; trial access is created only after personal coordination.

Company registration and direct purchase

For the direct purchase we store the company name, billing address, optional UID and company IBAN, selected VAT rate, company type, contact person, email, selected package and the confirmed version of the terms and conditions. Your password is processed by the Supabase sign-in service; it is not stored in the registration data or in emails. Resend sends the confirmation link as info@projektflow.ch. The registration data are accessible only on the server side. Before activation, the email is confirmed and successful subscription payment is checked. The company IBAN is used for your own invoices and is not the payment method for the software subscription.

To reset a forgotten password, Resend sends a personal, time-limited link to the stored email address. The password is changed only through your entry. To protect against abusive sending, we store for at most one hour a hash derived from the IP address and an attempt counter. Incomplete registration details expire after 24 hours and are cleared at the next registration request. The confirmed contract version and company association remain stored as proof of the contract.

Data and origin

Data come from your entries, from setup by company admins, from allocated assignments, from forwarded emails and from technical processes during operation. These include:

• company name, address, UID, contact person, email, telephone and details from trial enquiries;
• personal user accounts, roles, employee and customer data;
• orders, appointments, assignment addresses, working hours, breaks, work reports and, where applicable, signatures;
• quotes, invoices, the company's bank details, material and supplier details;
• messages, emails, photos, voice recordings, files and attachments;
• subscription, invoice and payment status, and technical identifiers;
• IP address, browser logs, device logs, error logs and security logs.

Record only necessary details. Health data, copies of identity documents, private correspondence or other particularly sensitive information do not belong in general assignment notes or chats.

Purposes of processing

The data are used for sign-in, company and role administration, order planning, collaboration, time recording, approval, document creation, billing, handling of trial enquiries, assistance and security. We also use them insofar as this is necessary to fulfil statutory duties or to clarify claims.

Swiss data protection law applies in particular. Where the GDPR applies in an individual case, processing is based on contract or pre-contractual measures, statutory duties, legitimate interests in secure operation and, where applicable, consent. Consent that has been given can be withdrawn for the future.

Who can see company data

Access depends on the company, the personal account and the role. Company admins manage the access of their company. Employees receive the functions provided for their role. Authorised platform administrators can manage company access and access operational data insofar as this is required for administration or assistance. A company area is therefore not technically accessible exclusively to the respective customer.

Temporary staffing agencies and client companies

When an assignment is requested, the names of the companies involved, the name of the assigned person, the activity, the property or project number, the address, notes, the period and the status are made accessible to the temporary staffing agency and the named client company. The coupling code enables a request and does not replace confirmation by the client company.

After confirmation, the assigned person sees their assignment and records the date, start, end, break and description of the work. Company admins of the companies involved see these records; the client company can approve them or return them with a reason. In the shared assignment history, the company admins involved and the assigned person can exchange messages. The sender's name, company, message and time are visible. Employees receive this access only after confirmation of the assignment. Internal customer files, financial data and other personnel data are not released through this connection.

For confirmed assignments, hours and corrections for the agreed period can be submitted after the end of the assignment. Approved records are protected against overwriting. Existing data remain accessible to authorised parties. "End" does not mean deletion. Exported CSV files and PDF copies with signature fields are subsequently within the area of responsibility of the receiving parties. The companies must inform employees before data is passed on and agree permitted retention and correction. Notes are given in the Temporary staffing guide.

Emails, photos and voice recordings

When forwarding has been set up, email content, sender, recipient, subject and attachments taken over are processed in the company area. Set up targeted rules for relevant orders, instead of forwarding private or unrelated mailboxes in full. Camera and microphone access are requested by the browser for the respective function. The company is responsible for the lawfulness of recordings and for informing identifiable persons.

Service providers and payment

• Supabase: Database, sign-in, private file storage and realtime functions. The project region is Frankfurt, Germany. Further details: Commissioned processing at Supabase.
• Vercel: Operation and delivery of the website and server-side functions, and technical logs. Processing may also take place in the USA. Vercel privacy agreement.
• Resend: Sending and receiving of system and order emails and their attachments. The primary processing takes place in the USA. Resend privacy agreement.
• Google Workspace: Business communication and support via info@projektflow.ch. Depending on the service and configuration, processing also takes place outside Switzerland. Google privacy agreement.
• Stripe: If payment or subscription management is used via Stripe, the company name, contact email, billing address, package and technical company association are transmitted, among other data. You enter payment details directly at Stripe. PROJEKT FLOW receives the association data and the subscription and payment status; full card numbers or card verification codes are not stored in PROJEKT FLOW. Depending on the purpose, Stripe may act as a processor or as an independent controller and process data internationally, including in the USA. Stripe privacy policy.

Service providers may use further subprocessors. The linked provider information explains their processing and contract terms.

Processing abroad

The database region Germany does not mean that all data remain exclusively in Germany or the EU. Hosting, email, payment processing and support may in particular involve Switzerland, Germany, other European locations and the USA. The providers used publish their subprocessors and locations in their privacy documentation.

For transfers to countries without data protection recognised as adequate, appropriate safeguards, for example applicable standard data protection clauses with the required Swiss adaptations, or a statutory exception, are required. You can request details of the recipients, countries and safeguards used for your contract at info@projektflow.ch.

Cookies, device storage and location

For sign-in, language and offline work, the app uses necessary cookies, local browser storage, session storage and a local queue for time entries not yet synchronised. A service worker stores parts of the application for use when there are connection problems. On sign-out, the cached workspace copy of the last account is removed. Times not yet synchronised may remain in device storage; synchronise before changing devices and protect shared devices.

No advertising trackers are integrated. Optional location automation for project time tracking is expressly enabled by the individual and requires browser permission. The work area is stored on this device. Location points are checked only there to detect arrival and departure and are not transmitted to the office or server. The resulting working times and an automatic-start indication are stored. No movement profile is created. Automation works only while the app is visible and connected and ends when the page is left. Running times must be checked after interruptions. Companies must agree the purpose, use and correction of working times with their staff. The assignment address identifies the work location. Browser permission for camera or microphone is not consent to employee surveillance. External payment pages have their own cookie and privacy information.

Retention and deletion

We store data for as long as they are needed for the contract, assistance, security, records or statutory duties. The required period depends on the type of data and the purpose of use. For operational company and personnel documents, the responsible company sets the required retention and agrees deletions with the provider.

An expired trial, an ended assignment or paused access does not delete data automatically. Request export or deletion via the company admin and info@projektflow.ch. For shared records, the duties of the other party are also to be taken into account. Copies already exported are not removed by a deletion in PROJEKT FLOW. Backup copies may continue to exist until they are overwritten in the ordinary course.

Security and rights

The platform uses encrypted transmission, role-based and company-based access controls, and private file storage. Personal access must not be shared. Please report suspicious access and data incidents to info@projektflow.ch. Absolute protection cannot be guaranteed.

In accordance with applicable law, you can request access, rectification, handover or transfer, and deletion, and, where applicable, object to processing or request its restriction. An appropriate proof of identity may be required in order to match the request. For operational company data, contact the responsible company first; the provider assists with the handling. You can contact the Federal Data Protection and Information Commissioner (FDPIC) or another competent supervisory authority.

Changes

If functions, recipients or processing change, this statement is updated. The current version is available here.