Privacy Policy
This page says which personal data Book-a-Team processes, why, who gets it and how long it is kept.
1. Who is responsible
Dr. Raphael Bauer
Friedrich Klausing Str. 8a | 14469 Potsdam
Email: r@raphaelbauer.com
We are the controller in the sense of the General Data Protection Regulation (GDPR) for this website, for the accounts of the people who sign in, and for the server logs.
2. Bookings belong to the company you book with
Book-a-Team is a tool for companies. A company creates a space here, enters its employees and gives candidates a link for booking an interview.
For the data of candidates and employees, that company is the controller. We process the data on its behalf (Art. 28 GDPR) under our data processing agreement. The booking form names the company and links to its privacy policy if the company has given us the address.
3. Visiting the website
The application writes one log line per request: the method, the path of the page, the status code and how long the answer took. It does not record your IP address, your browser or the part of the address after the question mark.
The web server in front of the application records your IP address, the time and the address you asked for, as web servers do. We need this to keep the site running and to notice attacks (Art. 6(1)(f) GDPR). These logs are deleted after 14 days at the latest.
When you book or cancel an interview or ask for your booking links by email, your IP address and the email address of the booking are kept in memory for up to one hour, to limit how many emails one person can cause. They are not written to disk for this.
The pages load nothing from other servers: no fonts, no scripts, no statistics, no advertising.
4. Cookies
We only set cookies that the site needs to work. They need no consent (§ 25(2) no. 2 of the German TDDDG). There are no cookies for statistics or advertising. The names start with "__Host-": your browser then takes such a cookie from this website only.
__Host-csrf_token: makes sure a form was sent from our own page and not by another website. Set when you first open a booking page, "My Bookings" or the sign-in. Gone when you close the browser.__Host-flash: carries a short message to the next page, for example "Booking cancelled." Lasts 5 seconds.__Host-oauth_state: makes sure a sign-in that comes back from the sign-in service was started in your browser. It holds random values only. Lasts 5 minutes.__Host-pending_signup: after you sign in, remembers who you are while you have no space yet, until you have created one or have been let into one: your identifier at the sign-in service, your email address and your name. Lasts 10 minutes.__Host-bat_session: keeps you signed in. It holds your space, your user number, your name and your email address. Lasts 24 hours or until you sign out.__Host-calendar_state: while you connect a calendar, remembers for which space. Lasts 10 minutes.
Legal basis: Art. 6(1)(b) and (f) GDPR.
5. Booking an interview
What is stored: your name, your email address, the time of the interview, the booking page you used, the employees who take part, the link to the video meeting, and a secret link with which you can view and cancel the booking.
Why: to arrange the interview you ask for (Art. 6(1)(b) GDPR, steps before a contract, in Germany together with § 26 BDSG). You do not have to give your data, but without name and email address no interview can be booked.
Who gets it:
- The company and its employees who take part. Each of them gets an email with your name, your email address and the time.
- You get an email that confirms the booking and contains the secret link. Anyone who has this link can cancel the booking.
- If the company has connected its calendar (at present Zoho Calendar), an entry with your name and email address is made in the calendar of the company. The calendar provider then sends an invitation to you and to the employees. People who are invited may see each other's email addresses.
- The video meeting takes place at Zoho Meeting if the company has connected Zoho, otherwise in a room at Jitsi Meet (meet.jit.si), a service of 8x8, Inc. in the USA. We only create the link, which contains a random room name. When you open it, that service processes your data under its own privacy policy.
How long: a booking is deleted 180 days after the interview. This also applies to cancelled bookings. The entry in the company's calendar is removed when you cancel. Otherwise it stays in the calendar of the company, which decides about it.
6. Getting your booking links by email
On "My Bookings" you can enter your email address. We look for upcoming bookings with this address in all spaces and send the links to that address, to nobody else. The address is not saved for this, apart from the limit described in section 3. If the email cannot be sent, the address appears in our server log. Legal basis: Art. 6(1)(b) GDPR.
7. Accounts of people who sign in
Whoever uses Book-a-Team for a company signs in through a sign-in service (Keycloak) that belongs to this installation. From it we get your identifier there, your email address, your name and whether your address has been confirmed. We store identifier, email address and name with your space, and the time at which the terms were accepted when the space was created.
The sign-in service has an address of its own and sets its own cookies there. If it offers to sign in with an account of another provider and you use that, the other provider learns that you sign in here.
If there is a space for the domain of your email address, you can ask to join it. Its members then see your name and your email address and decide whether to let you in. The members of a space see the names and email addresses of each other.
Why: to give you access to your space (Art. 6(1)(b) GDPR). The domain of your email address decides which space you can ask to join: colleagues with an address of the same domain can share a space.
How long: until your space is deleted or one of its members removes you. A request to join is deleted when it is declined, or when you create a space of your own instead. To have your account or your space deleted, write to us.
8. Employees of a company
A company enters the names and email addresses of its employees and labels for their skills. It can also set how many interviews an employee takes per week at most. Employees need no account. If the company has connected its calendar, we ask the calendar provider at which times an employee is busy, so that only free times are offered. We keep these times in memory for one minute and do not write them to disk. Employees get an email about every interview they take part in.
The controller is the company, usually the employer (in Germany § 26 BDSG, otherwise Art. 6(1)(b) or (f) GDPR). The data is kept until the company deletes the employee or its space.
9. Who else receives data
These service providers process data on our behalf (Art. 28 GDPR):
- None.
Emails are sent through a mail server and travel across the internet to the mail provider of the recipient.
Calendar and video services work for the company you book with, not for us. With Zoho, the data is in the region of the company's Zoho account, for example the EU or the USA. Jitsi Meet is run from the USA. We do not send your data to countries outside the European Union ourselves, unless a provider in the list above is located there.
10. Your rights
You can ask for information about your data (Art. 15 GDPR), have it corrected (Art. 16) or deleted (Art. 17), have its processing restricted (Art. 18), get it in a common format (Art. 20) and object to processing that rests on legitimate interests (Art. 21).
For a booking, please turn to the company you booked with. If you write to us, we pass your request on to that company.
You can complain to a data protection authority, for example the one where you live (Art. 77 GDPR).
Nothing here is decided by a machine alone in a way that has legal effect on you, and no profiles are made (Art. 22 GDPR).