Skip to content
irot Time Menu

Privacy policy

As at October 2026 ·applies to this website and to irot Time in the cloud (addresses such as your-company.time.irot.com).

Translation for convenience. This English version is provided so you can read it; the only binding version is the German one, Datenschutzerklärung. Where the two differ, the German text prevails.

1. Controller

Jasmann Werk 52, owner Muhammad Saeed, Elberfelder Straße 72, 42553 Velbert, Germany. E-mail: time@irot.com. No data protection officer has been appointed; § 38 of the German Federal Data Protection Act does not require one.

2. In short

This website sets no cookies — except two technically necessary ones, one during registration (section 5) and one for the live demo (section 5a) — uses no tracking, and loads no fonts, scripts or images from third-party servers. When you visit, your IP address reaches only our own server.

3. Visiting the website

To deliver the page, our server processes your IP address and technically transmitted information such as the address requested and the browser type. Access logs containing IP addresses are not stored for this website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the website.

The server stands in a data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, at the Falkenstein site in Germany. Hetzner processes the data on our behalf under an Art. 28 GDPR processing agreement.

4. Contact by e-mail

If you write to us, we process what you send in order to answer (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise (f)). Our mailbox is operated on our behalf by mailbox.org (Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin) under a processing agreement. We delete enquiries once they are dealt with, unless a retention obligation applies.

5. Free use (registration)

If you sign up for irot Time through the registration, we process your e-mail address, your password — only as a hash, never in clear text — the time you agreed to the terms and this policy, and your IP address. The IP address serves only to prevent abuse (too many attempts); it is not stored but counted in memory and forgotten after an hour at most. The confirmation code is sent through our mailbox at mailbox.org (section 4).

So that registration can run over several steps, this page sets a session cookie, only for the registration and for at most seven days. It is technically necessary (§ 25(2)(2) TDDDG). The legal basis for registration is Art. 6(1)(b) GDPR (the agreement on free use, terms § 3).

From the registration we set up your own irot Time on our server at Hetzner in Falkenstein; for the data held there the data processing agreement applies. Unfinished registrations are deleted after seven days, completed ones 30 days after setup. Which e-mail address belongs to which irot Time address remains stored for as long as that irot Time exists — so that each company gets one irot Time, and anyone registering a second time finds their existing installation again.

Checking the business. When you register, and for access to the live demo, we also ask for the name of your business and, if you give it, the VAT ID. irot Time is meant for businesses, so we check the number with the European Commission (VIES service) and compare the name. If everything matches you go straight on; otherwise a person here checks the request by hand and replies by e-mail. The legal basis is our legitimate interest in excluding consumers and misuse (Art. 6(1)(f) GDPR). Requests we do not approve and unconfirmed requests are deleted after 30 days at the latest.

5a. Viewing the live demo

Under /probieren/ you can look at irot Time with sample data of a business in your sector. Nothing you enter there is stored. So that only businesses get in, we first ask for your e-mail address, the name of your business and your VAT identification number. You confirm the address with a code we send you by e-mail.

What we process. E-mail address, business, VAT ID and the result of the check with the European Commission (VIES: valid or not, and the name registered there). Also the time and your IP address when you acknowledged this notice and – if you tick the box – gave your marketing consent. Codes, sessions and access links are stored only as a check value (hash), not in plain text.

Purposes and legal basis.

  • Giving access and excluding consumers and misuse: Art. 6(1)(b) and (f) GDPR (your request; our interest in opening the demo to businesses and not to bots).
  • Checking the VAT ID: we query the number with the European Commission (VIES); Art. 6(1)(f) GDPR.
  • Proof of your declarations (IP address and time): Art. 6(1)(f) GDPR.
  • Marketing e-mails for irot Time (news, tips, offers): only if you tick the separate box and confirm the address with the code (§ 7(2) no. 2 UWG, Art. 6(1)(a) GDPR). The box is not pre-ticked; access never depends on it. You can withdraw at any time through the link in every e-mail or by writing to time@irot.com. Withdrawing does not take away your access.

Cookie. After confirmation we set a technically necessary cookie zp_vorfuehrung (only for time.irot.com, not readable by scripts, only over encrypted connections, 30 days). It holds only a random identifier and remembers that you are unlocked in this browser (§ 25(2) no. 2 TDDDG). It is not used for analysis, and no third parties are involved.

How long we keep the data.

  • Unconfirmed request: 7 days, then deleted.
  • Request under review or rejected (for example with an unclear VAT ID): 30 days.
  • Access granted, without marketing consent: 180 days.
  • Access granted, with marketing consent: until you withdraw; after that the 180-day period applies.

Who receives the data. The code and the access e-mails are sent on our behalf by Heinlein Hosting GmbH (mailbox.org), Berlin. The VAT ID goes to the European Commission (VIES). Nobody else; no transfer outside the EU and the EEA. Requests we do not approve automatically are checked by hand by a person here.

6. Your irot Time in the cloud

Who is responsible. For the data inside an irot Time — clockings, working hours, absences, rotas, accounts and employee photographs — the company using it is the controller; if you are an employee, that is your employer. They decide what is recorded and how long it stays. We process that data only on their instructions, under the data processing agreement. Please address questions and requests to your employer; anything that reaches us is passed on to them. We are ourselves responsible for the contract with the company and for its account (sections 5 and 7).

Where the data is. Each irot Time runs on its own, with its own database, on our server at Hetzner in Falkenstein (section 3). Passwords are stored only as a verification value from which they cannot be recovered. E-mails from irot Time, for instance to reset a password, are sent through mailbox.org (section 4). Every night all data is backed up encrypted; backups are deleted after 30 days and the decryption key is not kept on the server.

In the browser. irot Time sets no cookies. The browser’s local storage holds the login state (removed on logout) and the chosen language, and on a terminal additionally the device pairing, any clockings not yet transmitted during a connection failure, and the list of identity cards. This is technically necessary (§ 25(2)(2) TDDDG). irot Time loads nothing from third-party servers and has no tracking. For weather and public holidays at the company location, our server — not your browser — queries Open-Meteo, OpenStreetMap (Nominatim) and Nager.Date, using only the company’s postcode or town. We do not transfer personal data to countries outside the European Union.

How long. An irot Time used free of charge is not deleted while it is in use; before any deletion for prolonged non-use we give at least 30 days’ notice. After a contract ends it remains available for export for 30 days and is then deleted (terms).

Start in numbers (voluntary). For the first 30 days your irot Time shows how long getting started took. Only if the administration ticks a box explicitly does it send four durations (minutes to the first employee, to the time clock, to the first clock-in and to the first month-end) together with the instance identifier to us, to improve getting started – no names, no working hours. The legal basis is your consent (Art. 6(1)(a) GDPR); you can untick the box at any time, and we then delete the values.

7. Purchase

For payment you are forwarded to Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland), where Stripe’s privacy policy applies. We receive what is needed for the invoice and the licence (company, name, e-mail address, payment confirmation) and no card details. The legal basis is Art. 6(1)(b) GDPR; invoice data is retained under § 147 of the German Fiscal Code and § 257 of the German Commercial Code.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). An e-mail is enough. You may also complain to the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, poststelle@ldi.nrw.de.