Your privacy is important to us. It is Brickmakers policy to respect your privacy with respect to all information we collect from you through our website, http://my.timeoutapp.de and other websites that we own and operate.
We only ask for personal information when we really need it to provide you with a service. We collect it fairly and lawfully, with your knowledge and consent. We will also tell you why we collect them and how they are used.
We only store the collected data for as long as is necessary to provide the service you request. We protect the information we collect to the extent commercially reasonable to prevent loss, theft, unauthorized access, disclosure, copying, use or alteration.
We do not disclose any personal information to the public or to third parties except as required by law.
Our website may refer to external websites that are not operated by us. Please note that we have no control over the content and practices of such websites and cannot assume any responsibility or liability for their privacy policies.
You are free to choose not to accept our request for your personal information, provided that we may not be able to provide some of your requested services.
Your continued use of our timeout app is considered acceptance of our privacy and personal data practices. If you have any questions about the handling of user data and personal data, please feel free to contact us.
Why do we need access to Microsoft Graph-Api?
To see which users are in the company. On the one hand all users can be listed in timeout for an administrator and on the other hand the groups from Office 365 can be used for the administration of vacation accounts.
Which Office 365 permissions do we need and why?
Sign in and read user profile - Access user's data anytime
The login for timeout is controlled via Office 365. Timeout displays the name of the user and the Office 365 profile picture. This makes it clear to the user with which account he is logged on or to the administrator or supervisor which user they are editing. This information is only displayed to registered users. The role of the user in Office 365 is also displayed. Office administrators can assign new rights to users in timeout for timeout. In this way, superiors can be defined.
Administrators can see each user's profile. Superiors can see the profile of a user for whom they manage a group in Office 365.
Read directory data
In Timeout, the groups of Office 365 of a company are loaded. This includes the superiors, as well as the group members. Timeout offers the possibility to manage the users according to these groups and to define new superiors for timeout. In Timeout, leave requests are processed by a supervisor. To find out which supervisor does this, access to the roles in a directory is required.
Read and write calendars in all mailboxes
If a vacation request is timed out, an entry is saved in the Office 365 calendar of the respective user. This request is noted as an all-day free appointment. Depending on the type of request, the appointment is displayed as free or booked.
This authorization allows you to read and write calendar entries for the logged on user, as well as calendar entries that other users in the organization have released for the logged on user. Microsoft makes no distinction between reading and writing calendar entries. The calendar is not read at any point in the timeout. Only calendar entries are added. Timeout therefore has access to the calendar of each user of the company and only uses it to add calendar entries.
What data is stored?
- The name and email address of the Office 365 account.
- Applications with their duration, start and end date, as well as the type and the user who submitted the application.
- Leave accounts with the year, the days taken, the days available and the total number of days that can be used for the year.
- The initial value for a user's vacation days
- A company's domain name, the country and state, the year of the current vacation account used, the default number of vacation days for the company, and the ability to take half a day as a vacation.
- Enterprise-specific holidays with date and name
Where is the data stored?
The data is stored in a Microsoft Azure SQL database. This is hosted in Azure West Europe.
In what form do we share or disclose data?
Data is only processed within a corporate context (tenant) and is not accessible to users of other tenants. The data will not be passed on to third parties.
Visibility of data within the company
Applications from members of the same team can be viewed for coordination within the company. Also timeout supervisors offers the possibility to view the vacation account of their employees, as well as statistics about all applications and vacation accounts created in the company.
How can I manage my data in timeout?
We only store data that is important for the function of timeout. If you want to delete your data in timeout, please contact us.
How can I contact you?
If you have any questions regarding the processing of your personal data, you can contact BRICKMAKERS' data protection officer, who is available to deal with requests for information, suggestions or complaints. Data protection officer of BRICKMAKERS GmbH
Stand: Mai 2018