1. Data Controller (Art. 4(7) GDPR)

The data controller responsible for processing on this platform is yourstaff.eu, Musterstraße 1, 10115 Berlin, Germany (Email: hello@yourstaff.eu). When used by an employer organization, the respective employer acts as the controller for workforce scheduling of its staff (Art. 6(1)(b) GDPR / § 26 BDSG).

2. Categories of Personal Data & Legal Basis (Art. 6 GDPR)

• Account & Master Data (Art. 6(1)(b) GDPR): Name, email address, optional phone number, role within the company, and encrypted password (bcrypt hash).
• Shift, Availability & Vacation Data (Art. 6(1)(b) GDPR): Weekly working availabilities, assigned shifts, confirmations/declines, and time-off requests.
• Talent Marketplace & Qualifications (Explicit Consent under Art. 6(1)(a) GDPR): Profession, city, years of experience, qualification degree, and spoken languages are only made visible to hiring employers on the Talent Marketplace if the employee explicitly opts in via checkbox. Consent can be revoked at any time in the profile.
• Coworker Data Minimization (Art. 5(1)(c) GDPR): Employees only see colleague names on schedules—never private email addresses or phone numbers of coworkers.

3. EU Hosting, Sub-Processors & Cookies (§ 25(2) TTDSG)

• Hosting & Database: The platform and MySQL database are hosted on EU servers operated by Hostinger International Ltd. under a GDPR Art. 28 Data Processing Agreement (DPA).
• Transactional Emails: System emails (6-digit security codes, shift notifications, invitations) are dispatched via Resend under EU Standard Contractual Clauses (SCCs) / EU-US Data Privacy Framework.
• Zero Tracking Cookies or Third-Party Scripts: We only use strictly necessary authentication session cookies (NextAuth JWT) pursuant to § 25(2) TDDDG/TTDSG. No Google Analytics, advertising trackers, or external Google Fonts are loaded.

4. Your GDPR Rights (Access, Portability & Account Erasure)

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure / "right to be forgotten" (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR) at any time.