Privacy Policy

1. Data Controller

Rhein Maas Rail GmbH
Josefstraße 157, 52080 Aachen, Germany
Email: lokshiftapp@gmail.com

2. Data We Process

• Identity data (name, email, phone, date of birth, gender)
• Employment data (role, working-time model, target hours)
• Time tracking (start/end time, breaks, per diem, location)
• Shift plans and assignments
• Chat messages and attachments (images, files, voice messages)
• Location data during an active shift (every 5 minutes)
• Device information for push notifications
• Profile picture (if uploaded)
• Qualifications and certificates (if recorded)

3. Legal Bases

Processing is based on:

• Art. 6 (1) (b) GDPR — Performance of a contract (employment contract)
• Art. 6 (1) (c) GDPR — Compliance with legal obligations (working time and tax law)
• Art. 6 (1) (f) GDPR — Legitimate interests (dispatch, security)
• Art. 6 (1) (a) GDPR — Consent (optional features such as biometric lock)

4. Storage and Data Processing

Application data is hosted on Supabase (EU servers). A data processing agreement pursuant to Art. 28 GDPR exists with the provider.

Optional crash reporting is provided in anonymised form via Sentry (if enabled).

5. Location Data

While a shift is active, the app records your location every 5 minutes. Transmission stops automatically at clock-out and can be disabled at any time in security settings. The data is shown only to your organisation's dispatch team for planning purposes.

6. Push Notifications

With your consent, we send push notifications via Apple Push Notification Service (APNs) and Firebase Cloud Messaging (FCM). You can disable them at any time in your device settings.

7. Retention

Personal data is stored for the duration of your employment. Timesheets and tax-relevant data are archived for 10 years pursuant to § 147 AO. Chat messages are retained for 12 months and then automatically deleted.

8. Your Rights

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21).

Inside the app you can go to "Settings → Data Export" at any time to download a complete copy of your data as a JSON file.

9. Data Protection Officer

A dedicated data protection officer is not legally required. For any privacy questions, please contact: lokshiftapp@gmail.com

10. Right of Complaint

You have the right to lodge a complaint with a supervisory authority — for example, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Germany).

11. Changes to This Policy

We reserve the right to adapt this privacy policy to reflect legal changes or new features.