Privacy Policy

Apex Arc Labs Hermann-Liebmann-Straße 96 04315 Leipzig Germany Email: info@apexarclabs.com (hereinafter "we" or "provider")

When using CrewSuite, we collect and process the following personal data: - Contact data: Name, email address - Access data: Password (stored encrypted), PIN (hashed) - Financial data: IBAN, BIC, account holder, bank name (for tip payouts) - Work data: Working hours, location assignment, team membership - Tip data: Daily amounts, individual shares, billing periods - Technical data: IP address, browser type, device information, access times - Tax data: Tax class, allowances (if provided by the user)

We process your data exclusively for the following purposes: - Provision and operation of the CrewSuite application - Calculation and distribution of tips - Creation of statements and exports (SEPA XML, PDF) - User account management and authentication - Communication (email verification, password reset, push notifications) - Compliance with legal retention obligations

Processing is based on: - Art. 6(1)(b) GDPR: Performance of contract (provision of SaaS service) - Art. 6(1)(a) GDPR: Consent (push notifications) - Art. 6(1)(f) GDPR: Legitimate interest (security, fraud prevention) - Art. 6(1)(c) GDPR: Legal obligation (tax retention requirements)

We store your personal data only as long as necessary for the respective purposes: - Account data: Until account deletion, then anonymization - Tip entries: 10 years (legal retention period for financial data) - Tax data: 10 years (legal retention period) - Technical log data: 90 days - Sessions: 30 days after last activity

Under the GDPR, you have the following rights: - Right of access (Art. 15 GDPR): You can request an export of your data at any time (Settings > Export data). - Right to rectification (Art. 16 GDPR): You can modify your data in the settings. - Right to erasure (Art. 17 GDPR): You can delete your account in the settings. Your personal data will be anonymized; financially relevant entries are retained in accordance with retention obligations. - Right to restriction of processing (Art. 18 GDPR) - Right to data portability (Art. 20 GDPR): Data export is available in JSON format. - Right to object (Art. 21 GDPR) To exercise your rights, contact: info@apexarclabs.com

CrewSuite uses only technically necessary cookies: - Session cookie: Authentication and session management (30 days) - Locale cookie: Language setting (1 year) - Membership cookie: Active company assignment (30 days) No tracking, analytics, or marketing cookies are used. Separate consent is not required for technically necessary cookies.

We use the following third-party services: - Stripe Inc. (USA): Payment processing for subscriptions. Stripe's privacy policy applies (https://stripe.com/privacy). Data transfer to the USA is based on EU Standard Contractual Clauses. - IONOS SE (Germany): Hosting of the application and database. Server location: Germany. - Postfix/SMTP (own server): Email delivery via noreply@apexarclabs.com.

For privacy-related questions, contact: Apex Arc Labs Email: info@apexarclabs.com You have the right to file a complaint with a data protection supervisory authority.