1. Who is responsible
JERION Team is always used on behalf of a specific business, so the GDPR roles are split:
Controller: your employer
The controller within the meaning of Art. 4(7) GDPR is the business that employs you and whose company code you enter when you first open the app. It decides what employee data exists in the system, who may see it and how long it is kept. Address requests about your data to them first; you will find their contact details, and their data protection officer if they have one, in your employment contract or on the staff noticeboard.
Processor: the operator of JERION
The JERION Team app, the JERION platform and their servers are provided by:
Hofgut Wiesenmühl
Wiesenmühle 11
65439 Flörsheim am Main
Germany
Phone: +49 6145 5479512
Email: datenschutz@jerion.de
We process employee data solely on the documented instructions of each business, under a data processing agreement pursuant to Art. 28 GDPR. We do not use this data for our own purposes, do not pass it on and do not sell it.
Sub-processor: the software developer
The software is developed and technically maintained by Intelercs Ltd, Newcastle upon Tyne, United Kingdom. It acts as a sub-processor under Art. 28(4) GDPR, solely for maintenance and support, and solely on the instructions of Hofgut Wiesenmühl. On access from the United Kingdom, see International transfers.
2. What data the app processes
JERION Team collects nothing “just in case”. What it processes is what your employment and the rota consist of anyway:
| Category | Specifically | Source |
|---|---|---|
| Credentials | Email address, password (stored only as a hash, never in clear text), session token | From you, at sign-in |
| Basic details | First and last name, role or position, chosen language | Created by your employer |
| Contract details | Contract type, start and end date, weekly hours, hourly rate, supplements (Sunday, public holiday, night work) | From your employer; mirrors your contract and is read-only in the app |
| Rota data | Your own shifts, the team's week, open shifts and bids on them, swap requests and their status | From your employer and from your own requests |
| Time data | Clock-in and clock-out, breaks, recorded hours, day bookings | Recorded at the venue (terminal); the app only displays them |
| Absence | Leave and absence requests, availability, approval status | Requested by you, decided by your employer |
| Messages | In-app notifications (e.g. “swap approved”) and their read status | From the system |
| Technical data | Company code, IP address and timestamp of server requests, app version, operating system | Technically necessary to connect |
Not processed, among other things: location data, contacts, photos, calendar, microphone or camera data, advertising identifiers, device identifiers used for advertising, biometric data and health data. A leave or absence request in the app requires no reason and no sick note.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Performing the employment relationship: rota planning, time recording, leave, shift swaps, payroll preparation | Art. 6(1)(b) GDPR together with Art. 88 GDPR and § 26(1) BDSG (German Federal Data Protection Act) |
| Complying with legal obligations: recording working time, retaining payroll and accounting records | Art. 6(1)(c) GDPR together with § 16(2) ArbZG, § 17 MiLoG, §§ 147 AO / 257 HGB |
| Sign-in, session handling, operational security, abuse and fault prevention | Art. 6(1)(f) GDPR — legitimate interest in a working, secure system |
| Password reset and email change via one-time code | Art. 6(1)(b) and (f) GDPR |
No consent is needed to run the app, so none is requested. There is no automated decision-making and no profiling under Art. 22 GDPR: a swap, a bid on an open shift or a leave request is always decided by a person in management.
4. Device permissions
The app declares exactly one technical permission: internet access (android.permission.INTERNET), so it can talk to your employer's server. Beyond that JERION Team requests nothing — in particular no location, no camera, no microphone, no contacts, no storage or photo access.
5. Data stored on your phone
Locally, JERION Team stores only:
- A session token — so you do not type your password every time you open the app.
- The company code — the business the app connects to.
- Your language setting — German or English.
- A local diagnostic log — the last 250 technical events at most (for example “sign-in failed”, “no connection”). Passwords and tokens are stripped out before anything is written. This log stays on the device and is never transmitted automatically. It leaves your phone only if you deliberately share it with support.
Signing out deletes the session token and the company code. Uninstalling the app removes everything stored locally, including the diagnostic log.
6. No tracking, no advertising
JERION Team contains no advertising, analytics or tracking libraries. There is no advertising ID, no usage tracking, no sharing with data brokers and no sale of data of any kind. JERION Team requires no third-party push service — notifications appear inside the app while it is open.
7. Recipients and processors
Your data is seen only by:
- Your business — management and people holding the corresponding role. Colleagues see only who is on when in the team rota: no contracts, no pay rates, no requests.
- The hosting provider running the servers: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany — processor under Art. 28 GDPR, data centre located in Germany.
- Email delivery for one-time codes on password reset and email change: these messages are sent from dotrply@intelercs.com over the mail infrastructure of the same hosting provider. No separate delivery service and no newsletter platform is involved.
- Us, as the operator of the platform, as far as maintenance and support require it — on instruction and no further than necessary.
- Intelercs Ltd, Newcastle upon Tyne, United Kingdom — development and technical maintenance of the software, sub-processor under Art. 28(4) GDPR. It has access only so far as maintenance, debugging or support require it.
Downloading the app is a separate matter: Google or Apple process your store account data under their own privacy policies, which we do not control. No data from inside the app is shared with Google or Apple.
8. International transfers
Servers and database are located in Germany. Your employee data is stored and processed there — that is, inside the EU.
Hofgut Wiesenmühl, the operator of JERION, is established in Germany — that is, inside the EU.
Intelercs Ltd, which develops and technically maintains the software, is established in the United Kingdom, which has been a third country for data protection purposes since it left the EU. Where maintenance and support involve access from the United Kingdom, that access relies on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR), which certifies a level of protection equivalent to the EU's. No separate transfer agreement is therefore required; should the decision lapse or be revoked, transfers would be made on the basis of Standard Contractual Clauses.
No personal data is transferred to any other third country.
9. How long data is kept
Retention is decided by your employer within the limits set by law. As a guide:
| Data | Period | Reason |
|---|---|---|
| Credentials and sessions | Until the account is deactivated, at the latest when employment ends | No longer required |
| Rota and attendance data | At least 2 years | § 16(2) ArbZG, § 17 MiLoG |
| Payroll and accounting records | 6 or 10 years | § 147 AO, § 257 HGB |
| Local diagnostic log on the device | Last 250 entries, until uninstall | Fault finding |
| Server access logs | e.g. 14 days | Operational security |
While a statutory retention period is running, the data concerned is blocked rather than deleted: it is no longer available for day-to-day work and is held only for the purpose the law prescribes.
10. Deleting your account
You can ask for your account to be deleted. How to do it, what happens afterwards and which data has to remain for legal reasons is set out on its own page:
11. Your rights
You have the following rights against the controller — your employer:
- Access to the data held about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure, where no retention obligation applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
Contact your employer to exercise them. If you cannot reach them, datenschutz@jerion.de will help and pass your request to the controller.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — the one where your employer is based, where you live, or where the alleged infringement took place.
12. Security
- All communication runs over HTTPS/TLS only.
- The app can only connect to servers under the
wirtmate.comdomain. There is no free-text server address field — you enter a company code and nothing else. That is what stops someone with ten seconds on an unlocked phone from pointing the app at a server that harvests the next sign-in. - Passwords are stored only as hashes, never in clear text.
- Access is role-based: contract details are visible only to the person they belong to.
- Password reset and email change use time-limited one-time codes.
13. Minors
JERION Team is not directed at children. Accounts are created exclusively by the employer for employees whose employment is permitted under German youth employment law. Where employees are minors, the employer processes their data in the context of the apprenticeship or employment relationship.
14. Changes to this policy
This policy is updated when the app or the legal position changes. The version published at jerion.de/en/privacy is the one that applies; the date is shown at the top. Your employer will additionally tell you about material changes.
15. Contact
Questions about this policy or about the app:
Hofgut Wiesenmühl
Wiesenmühle 11
65439 Flörsheim am Main
Germany
Phone: +49 6145 5479512
Email: datenschutz@jerion.de
This policy describes the app as it stood on the date above. It is not legal advice; have it reviewed by a lawyer before publishing it in your own name. Where the German and English versions differ, the German version prevails.