Privacy Policy

This privacy policy explains how Webagentur Hochmeir e.U. (“we”, “us”, the “operator”) processes personal data in connection with this website and the “Arbeitskraftwerk” application — a multi-tenant SaaS platform for the Austrian temporary agency work (personnel leasing) sector. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and all other applicable provisions. Where we process the personal data of leased workers on behalf of our customers (staffing/personnel-service providers), we act as a processor within the meaning of Art. 28 GDPR, while the customer remains the controller; for our own website and business development we are ourselves the controller.

1. Controller

The operator named above is responsible for the processing of personal data on this website and within the Arbeitskraftwerk application within the scope set out in this policy. For all matters relating to data protection and the exercise of your rights you may contact us at any time using the contact details above, in particular by e-mail to hello@webhoch.com. We have not designated a separate data protection contact point; data protection enquiries are handled directly by the owner.

2. Scope, definitions and principles

This policy applies to our website and to the Arbeitskraftwerk application operated by us, irrespective of the device or browser you use to access them. “Personal data” means any information relating to an identified or identifiable natural person; “processing” means any operation performed on personal data, such as collection, storage, use, transmission or erasure. Where we act as a processor for a customer, this policy describes the framework of that processing, while the legal basis and the determination of purposes lie with the respective customer as controller.

We observe the principles of Art. 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. We collect only the data required for the respective purpose, store it no longer than necessary, and protect it by appropriate technical and organisational measures. The protection of the highly sensitive personnel data processed in Arbeitskraftwerk is a central design principle of the product.

3. Legal bases

We process personal data only where a legal basis under Art. 6 GDPR applies. Depending on the specific processing, the following bases are relevant:

• Art. 6(1)(a) GDPR — consent: e.g. if we ever introduce optional cookies or other features requiring consent; consent may be withdrawn at any time with effect for the future.
• Art. 6(1)(b) GDPR — performance of a contract / pre-contractual measures: for providing the Arbeitskraftwerk application to our customers, managing user accounts and handling enquiries aimed at concluding a contract.
• Art. 6(1)(c) GDPR — legal obligation: e.g. for statutory retention obligations under commercial and tax law and for responding to lawful requests from authorities.
• Art. 6(1)(f) GDPR — legitimate interests: for the secure operation, stability, defence against attacks, error analysis and continuous improvement of our website and application; we balance these interests against your rights and freedoms.

Where we process personnel data of leased workers on behalf of a customer, the legal basis for that processing is determined by the customer as controller; our processing takes place on the basis of the data processing agreement pursuant to Art. 28 GDPR (see section 8).

4. Server log files

When you access our website, the server automatically processes technical data that your browser transmits, in particular: the IP address, the date and time of the request, the requested URL or file, the HTTP status code, the volume of data transferred, the referrer URL, the browser type and version and the operating system used. This data is processed to deliver the website, to ensure the stability and security of our infrastructure, to defend against attacks and to analyse and resolve technical faults.

The legal basis for this processing is our legitimate interest in a secure and functional web presence pursuant to Art. 6(1)(f) GDPR. Log data is stored only for a short period required for the purposes described above and is then deleted or anonymised; longer storage occurs only in the event of a specific security incident for as long as is necessary to investigate and resolve it.

5. Cookies and local storage

We use only strictly necessary cookies and comparable local storage technologies that are essential for the core functions of the website and the application, in particular the session cookie and the CSRF token used to protect against cross-site request forgery. These technologies do not serve any analysis, advertising or tracking purpose and do not create cross-site user profiles.

Because these cookies are technically necessary to provide the service you have requested, they do not require consent; the legal basis is Art. 6(1)(f) GDPR together with the corresponding provision of the Austrian Telecommunications Act. We do not use any tracking, web analytics, advertising cookies, third-party social-media trackers or newsletter tools. Should we ever wish to introduce optional cookies in the future, we would do so only after obtaining your prior explicit consent via a consent banner, which you could withdraw at any time.

6. Contacting us

The contact form on our website does not transmit any data to our server. When submitted, it merely opens your local e-mail program with a pre-filled message (a “mailto” link); no contact details are stored on the website or on our server as a result of using the form. The actual transmission of your message therefore takes place exclusively through your own e-mail provider.

If you subsequently contact us by e-mail, telephone or otherwise on your own initiative, we process the data you provide (e.g. name, e-mail address, company, content of your message) solely to handle your enquiry and any resulting business relationship. The legal basis is Art. 6(1)(b) GDPR (pre-contractual or contractual measures) and Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete this data once your enquiry has been conclusively dealt with, unless statutory retention obligations require longer storage.

7. Use of the Arbeitskraftwerk application

Arbeitskraftwerk is a multi-tenant SaaS solution for the Austrian temporary agency work sector. Each customer (tenant) works in a strictly separated data environment. We distinguish between data that we process as controller for the purpose of operating the application and providing accounts, and the personnel data that a customer enters and for which we act solely as a processor (see section 8).

7.1 Account and usage data

For registered users we process account data such as name, e-mail address, hashed password, assigned role and permissions, two-factor (TOTP) settings and tenant membership, as well as usage and audit data such as log-ins, changes made and access to records. This data serves to provide secure access, to manage authorisations and to ensure the traceability and security of the system. The legal basis is Art. 6(1)(b) and Art. 6(1)(f) GDPR.

7.2 Personnel data of leased workers

Within the application, our customers enter the personnel data of their leased workers and applicants — for example name, address, date of birth, social-security number, citizenship, qualifications, assignment data, employee photos and uploaded documents. We process this data exclusively on behalf of and on the documented instructions of the respective customer; the customer remains the controller. The framework for this processing is set out in section 8.

8. Processing on behalf of customers (Art. 28 GDPR)

In the operation of the Arbeitskraftwerk application, we process the personnel data of leased workers and applicants entered by our customers (staffing/personnel-service providers) as a processor within the meaning of Art. 28 GDPR. The customer determines the purposes and means of this processing and therefore remains the controller; we act exclusively on the basis of the customer’s documented instructions and do not pursue any own purposes with this data.

With every customer we conclude a data processing agreement (DPA) that meets the requirements of Art. 28(3) GDPR. In particular, it governs the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects, the customer’s right to issue instructions and our binding obligation to follow them, the confidentiality obligations of the persons authorised to process the data, the technical and organisational measures pursuant to Art. 32 GDPR (see section 12), the conditions for engaging sub-processors, our duty to assist the customer in fulfilling data-subject requests and its obligations under Art. 32–36 GDPR, and the handling of the data upon termination of the contract (return or deletion).

We process personnel data only within the scope of the customer’s instructions and the agreed purpose. If we consider an instruction to infringe data protection law, we will inform the customer accordingly. The multi-tenant architecture, the per-tenant field encryption and the access-control concept ensure that data of one customer is not accessible to another customer.

9. Recipients and sub-processors

We disclose personal data only to recipients who are necessary for the provision of our services or to whom we are legally obliged to disclose it. In particular, we use carefully selected sub-processors for hosting and infrastructure, who provide sufficient guarantees pursuant to Art. 28 GDPR and with whom corresponding agreements have been concluded. We do not sell personal data and do not pass it on for advertising purposes.

The engagement of sub-processors for the processing carried out on behalf of customers takes place within the framework agreed in the respective data processing agreement, including the contractually agreed information or objection mechanisms. A disclosure to authorities or courts occurs only where we are legally required to do so or where it is necessary to protect our rights.

10. Hosting and data location

The Arbeitskraftwerk application and its data are hosted exclusively in data centres within the European Union (Austria/Germany). The infrastructure is operated in a containerised environment (Docker) behind a Traefik reverse proxy; transport encryption is provided by automatically renewed Let’s Encrypt TLS certificates. Through this EU-based hosting we ensure that personal data is processed within the protective scope of the GDPR.

11. Transfers to third countries

In principle, no personal data is transferred to third countries outside the EU/EEA; all processing relevant to the application takes place within the European Union. Should a transfer to a third country exceptionally become necessary, it will only take place if an adequate level of protection is ensured pursuant to Art. 44 et seq. GDPR — in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses (SCC), supplemented where required by additional protective measures.

12. Data security and technical & organisational measures (Art. 32 GDPR)

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks to the rights and freedoms of data subjects, we implement appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. Given the sensitivity of the personnel data processed, these measures are a core element of the product:

• Per-tenant field-level encryption: sensitive personal data is stored field-encrypted in the database using authenticated encryption (CipherSweet/AEAD), with a separate encryption key derived for each tenant, so that the data of different customers is cryptographically separated.
• Encrypted documents and employee photos: uploaded documents and employee photos are stored encrypted at rest (AES-256) and delivered only via authenticated in-app routes.
• Pseudonymisation / blind-index search: searches over encrypted fields are performed via blind indexes, so that records can be searched without storing the search criteria in plain text.
• Audit log without plaintext personal data: changes and access are logged in an audit trail that does not store any personal data in plain text.
• Access control and roles/permissions: access to data is governed by a granular role and permission model on a need-to-know basis.
• App-based two-factor authentication (TOTP): user accounts can be additionally protected by app-based two-factor authentication.
• Encrypted sessions and enforced HTTPS/TLS: sessions are stored encrypted and all transport is secured by enforced TLS/HTTPS.

These measures serve to ensure the confidentiality, integrity, availability and resilience of the systems and services and to enable the timely restoration of availability and access in the event of an incident. We review and update the measures on an ongoing basis to reflect technical developments and the threat situation.

13. Storage period and erasure concept

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations (e.g. under commercial and tax law). The application enforces configurable retention periods and runs an automated deletion process that deletes or anonymises data once the applicable retention period has expired.

Personnel data that we process on behalf of a customer is retained in accordance with the customer’s instructions and the data processing agreement; upon termination of the contract it is returned or deleted as agreed. Account and usage data is deleted once it is no longer required for the operation of the application and no retention obligations conflict with deletion.

14. Obligation to provide data

The provision of certain data is necessary for the use of our website and application. To create and use a user account, for example, the relevant account data must be provided; without it, access cannot be granted. For the processing of personnel data on behalf of a customer, the customer determines, as controller, which data is required. Where the provision of data is required by law or by contract, this is indicated accordingly; failure to provide it may mean that the corresponding service cannot be provided.

15. Data protection officer

We have not appointed a data protection officer, as the legal requirements for a mandatory appointment under Art. 37 GDPR and the Austrian DSG are not met. For all data protection enquiries you may contact us directly using the contact details in section 1.

16. Your rights as a data subject

Subject to the statutory conditions, you have the following rights in respect of your personal data:

• Right of access (Art. 15 GDPR) — to obtain confirmation as to whether and which personal data we process about you; in the application we can provide this as a structured GDPR data export.
• Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected and incomplete data completed.
• Right to erasure (Art. 17 GDPR) — to have your data deleted, provided no retention obligations or other legal grounds preclude this.
• Right to restriction of processing (Art. 18 GDPR) — to have processing restricted in the cases provided for by law.
• Right to data portability (Art. 20 GDPR) — to receive the data you have provided in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR) — to object, on grounds relating to your particular situation, to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR) — to withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact hello@webhoch.com. If your data is processed by a staffing agency using our application, please address your request to that agency as the controller; as a processor we will support the controller in handling such requests.

17. Right to lodge a complaint

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes data protection law. The competent supervisory authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria — dsb.gv.at.

18. No automated decision-making or profiling

We do not use any automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Decisions with legal or comparable effects are not taken solely on the basis of automated processing.

19. Changes and status

We may amend this privacy policy from time to time to reflect changes to our services, our infrastructure or the applicable legal requirements. The version published on this page at the time of your access applies. We recommend that you review this policy periodically. Status: June 2026.

← Back to home