Privacy Policy

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

The Capwork platform operates as a B2B service. Depending on the context, different parties assume different data protection roles under the GDPR:

• Data Subject (Betroffene Person): The end customer or individual whose personal data is processed (e.g., a person booking an appointment or sending an inquiry).
• Data Controller (Verantwortlicher): The registered business that uses the Capwork platform. The controller determines the purposes and means of data processing and is responsible for GDPR compliance toward their end customers.
• Data Processor (Auftragsverarbeiter): Capwork e.U. operates the Capwork platform as a data processor on behalf of the registered business, processing personal data solely according to the controller’s instructions and the data processing agreement.

Capwork e.U. is the data controller only for data processed for its own purposes (e.g., platform account management, billing, platform security, and contacting businesses by letter under section 11a). For all end-customer data entered by registered businesses (e.g., booking details, customer communications, uploaded documents), the registered business is the data controller and Capwork e.U. acts exclusively as data processor pursuant to Art. 28 GDPR.

We collect and process the following categories of personal data:

• Account data: email address, password (hashed), company name, location
• Contact and booking details: name, phone number, email address and an optional note to the business (when booking appointments)
• Payment data: cardholder name, last four digits of card number (for identity verification only)
• Usage data: booking history, calendar interactions, module configurations, log data
• Technical data: IP address, browser type, device information, access timestamps
• End-customer data: any personal data that registered businesses enter into the platform on behalf of their customers (e.g., booking details, contact information, order data, communications)
• Published company data: the details a registered company makes publicly accessible after activating its customer portal (company name, description and industry, address, telephone number, website, opening hours, services and prices), the details of its identity shown with bookings and offers (name or business name, address, contact details and, where applicable, VAT identification number) and the details on its legal notice page in the customer portal (in addition, for example, commercial register details, supervisory authority, chamber and professional rules, business purpose and the link to its privacy policy)
• Notices under the Digital Services Act: name and email address of the notifying person (voluntary for notices concerning child sexual abuse material), the reported address and, where applicable, the content identified, the category and explanation of the notice, language, processing status and decision; in addition, to limit misuse of the notice form, the IP address and the email address in hashed form as the key of a counter
• Field work documentation, where a registered business uses it: working, break and driving times, job status, materials used, notes and photos of its employees, as well as photos, site notes, signatures and work reports relating to its end customers (details in section 11b)

We process personal data on the following legal bases under Art. 6 GDPR:

• Art. 6(1)(a) GDPR — Consent: Where you have given explicit consent for specific processing activities.
• Art. 6(1)(b) GDPR — Contract: Processing necessary for the performance of our service agreement with you, or to take steps at your request before entering into it (e.g. creating your account and confirming your email address during registration).
• Art. 6(1)(c) GDPR — Legal obligation: Processing required to comply with Austrian tax and commercial law retention requirements.
• Art. 6(1)(f) GDPR — Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where our interests are not overridden by your rights.

For end-customer data processed on behalf of registered businesses, the legal basis is determined by the respective business (data controller) and documented in their own privacy policy.

The public customer portal is deactivated by default. The company data shown there is published solely at the instigation of the registered company, which must expressly activate the portal for that purpose (§ 4 of the terms); the legal basis is Art. 6(1)(b) GDPR. The company itself determines which details are shown and may restrict publication at any time or end it entirely by deactivating the portal.

We process notices of illegal content under the Digital Services Act, the decisions on them and the information provided to the parties involved in order to comply with our legal obligations under Arts. 16 to 18 DSA (Art. 6(1)(c) GDPR). Limiting the number of notices per IP address and email address is based on our legitimate interest in a functioning notice procedure that is protected against misuse (Art. 6(1)(f) GDPR). We do not disclose the identity of the notifying person to the company concerned.

Your personal data is processed for the following purposes:

• Providing and operating the Capwork platform and its modules (appointments, orders, team management, fleet, inventory, finances)
• User account creation, authentication, and access management
• Processing bookings, orders, and customer communications on behalf of registered businesses
• Documenting field work at end customers’ sites, its acceptance and the working time spent on it, on behalf of registered businesses that use field work documentation (see section 11b)
• AI-powered features: company data generation, business insights, document scanning, and feedback analysis
• Fraud prevention, identity verification, and platform security
• Operating the public customer portal of a registered company, where that company has activated the portal
• Handling notices of illegal content in customer portals, deciding on measures and informing the parties involved under the Digital Services Act
• Measuring whether registrations came from our ads on Google — only with your consent (see section 10)
• Customer care and support: answering your enquiries and feedback and helping you set up and use the platform — also on our own initiative, through messages to the account holder in the platform’s feedback area (Art. 6(1)(b) GDPR). We do not send advertising this way.

Since Capwork e.U. acts as a data processor (Auftragsverarbeiter) for registered businesses, a Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV) pursuant to Art. 28 GDPR is concluded with every registered business during the onboarding process.

The AVV governs:

• The subject matter, duration, nature, and purpose of the data processing
• The types of personal data processed and the categories of data subjects
• The obligations and rights of the controller (registered business)
• Technical and Organizational Measures (TOMs) to ensure data security (see Section 12)
• The use and authorization of sub-processors (see Section 8)
• Obligations regarding data deletion or return upon termination of the contract

The registered business (data controller) may request a copy of the AVV at any time by contacting office@capwork.io.

Personal data is retained only for as long as necessary to fulfill the purposes described above or as required by law. Austrian commercial and tax law (BAO, UGB) may require retention of certain data for up to 7 years.

Upon account termination, your personal data will be deleted within 30 days, except where longer retention is required by law. End-customer data processed on behalf of registered businesses will be deleted or returned in accordance with the AVV. If you do not confirm your email address during registration and no business is created, we delete the account 30 days after registration or, if later, after your last sign-in.

Bird, the provider that delivers transactional emails and SMS to end customers of registered businesses (e.g. appointment confirmations, reminders and login codes for the customer portal), retains message content and traffic data for delivery and abuse prevention: SMS for up to 6 months, email for 72 hours. Bird’s own sub-processors include providers outside the EEA, covered by EU Standard Contractual Clauses.

We delete notices under the Digital Services Act and the records of customer portal restrictions seven years after the decision or after the restriction has been lifted or has expired; until then, we retain them to document our decisions and to defend against claims (Art. 6(1)(f) GDPR). Notices not yet decided are stored until the decision. The counters we use to limit the number of requests are deleted automatically once their time window has expired.

Your data may be shared with the following categories of recipients, who act as sub-processors (Unterauftragsverarbeiter) under Art. 28 GDPR:

• Google Cloud Platform (Firebase, Firestore, Cloud Functions) — infrastructure and data storage (EU region: europe-west1)
• Google Vertex AI (Google models such as Gemini as well as partner models from the Vertex Model Garden, e.g. Anthropic Claude; inference is carried out entirely by Google Cloud in the EU) — AI-powered features such as company data generation, insights, document scanning, invoice processing, and order-request analysis (sub-processor)
• Twilio — SMS and WhatsApp notification delivery (sub-processor)
• Google Maps Platform (Places, Maps JavaScript API, Time Zone, Distance Matrix) — address search, map and distance display; also loads on the public registration page, transmitting your IP address to Google, and when a job is opened in the field view (“My work”), which shows the map of the work site straight away
• Stripe Payments Europe, Ltd. — payment processing and billing (sub-processor)
• Bird (Bird B.V., Netherlands) – delivery of transactional emails and SMS on behalf of registered businesses: appointment confirmations, reminders, earlier-slot offers, login codes for customer accounts in the customer portal and field work notices (on the way, running late, work report and confirmation link); and sending and receiving on those businesses' own email and SMS channels, including SMS on a dedicated number held by Capwork (sub-processor)
• Google Workspace / Gmail (Google Ireland Limited) — sending Capwork’s own emails: to registered users (e.g. welcome and onboarding messages as well as statements of reasons and notifications concerning restrictions of customer portals) and to persons who report illegal content (confirmation of receipt and decision); processed within the EU (processor)

All sub-processors are listed in the AVV and are bound by data processing agreements pursuant to Art. 28 GDPR. The registered business (data controller) is informed of any changes to sub-processors and has the right to object. We do not sell your personal data to third parties.

Some of our sub-processors operate servers outside the European Economic Area (EEA). Where data is transferred to third countries (e.g., the United States), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) and adequacy decisions by the European Commission.

Google LLC and Twilio Inc. participate in the EU-U.S. Data Privacy Framework, providing an adequate level of data protection as recognized by the European Commission. Transfer mechanisms are documented in the AVV.

Without your consent, the Capwork platform uses only strictly necessary cookies for authentication, language settings and display settings you make yourself. In your browser’s local storage we also store strictly necessary information, such as the sign-in to a customer account in a company’s customer portal (for up to 30 days or until you sign out), the color scheme and your choice in the cookie banner. While you register, the details entered so far are also kept there for up to seven days (never the password), so that an unfinished sign-up can be continued. No tracking, analytics or advertising cookies are used, with one exception: on our own information pages you can agree to the measurement of our Google advertising (last paragraph of this section). Details can be found in our Cookie Policy.

You can manage cookie settings in your browser. Disabling essential cookies may affect platform functionality.

We measure the use of our website and platform with a privacy-friendly, self-hosted statistics system that works without cookies and without storing anything on your device. Our servers keep only aggregate counts: daily totals (e.g. page views per page) and, for 100 days, the number of page views and newly counted visitors per 15-minute interval of the day; no user profiles are created and no data is shared with third parties. To count unique visitors, the IP address and browser identifier are combined into an anonymous identifier using a key that changes every day; the IP address itself is never stored, and the identifier is deleted within 48 hours and cannot be linked across days. All processing takes place exclusively on our servers in the EU (europe-west1). Legal basis: our legitimate interest in understanding and improving our services (Art. 6(1)(f) GDPR). We honor the “Do Not Track” and “Global Privacy Control” browser signals — if either is enabled, no statistics are collected. In addition, we count the use of individual features in the same way (for example, how often a particular button is used), as well as coarse visit metrics (the number of pages viewed per visit and the approximate visit duration). These values are likewise stored only as aggregated daily counts with no personal reference, and nothing continues to be stored on or read from your device for this purpose.

On our public information pages at www.capwork.io (e.g. the home page, pricing, solutions, the example business, the legal texts and the registration offered there) we use Google Ads conversion tracking by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — only if you agree in the cookie banner. The purpose is to determine whether a registration with Capwork came from a click on one of our ads on Google; we do not use personalized advertising or remarketing. After you agree, your browser loads the Google tag; Google processes your IP address, browser and device information, the page visited, the time and an ad’s click identifier, and stores cookies such as “_gcl_au” and “_gcl_aw” (up to 90 days). A completed registration is reported to Google without a name, email address or company details. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Google processes the data as an independent controller and may transfer it to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Without your consent, the Google tag is not loaded. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of our home page or in our Cookie Policy; we then delete the Google Ads cookies on capwork.io. We store your choice in your browser’s local storage and ask again after twelve months. To demonstrate your consent, we also store each choice in the cookie banner for three years on our servers in the EU — with a randomly generated consent ID, the choice and the choice it replaced, the banner version, the language and the time, but without your IP address; the legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. The banner shows you the consent ID under “Cookie settings”.

The Capwork platform uses AI services via Google Vertex AI for features including automated company data generation, business insights reports, vehicle document and receipt scanning, feedback analysis, the analysis of order requests and messages, suggestions and reply drafts, automatic translation of content, and the generation of image suggestions for services and products. This involves both Google's own models (e.g. Gemini) and partner models provided through the Vertex Model Garden (e.g. Anthropic Claude); in both cases inference is carried out entirely by Google Cloud in the EU. Google Vertex AI acts as a sub-processor under the terms of the AVV.

Where a business uses field work documentation, its employees can dictate notes: Google Vertex AI (Gemini) transcribes the recording in the EU and turns it into a draft of the report text. Capwork stores neither the recording nor the transcript (see section 11b).

Data sent to AI services is processed exclusively under Google Cloud’s Enterprise data processing terms and with region pinning to the EU. Personal data submitted to AI services is not used to train, improve, or develop AI models. This is contractually guaranteed through Google Cloud’s data processing addendum.

AI-generated content — such as analyses, suggestions, reply drafts, data extracted from documents, automatic translations and AI-generated images — is labeled as AI-generated in the platform’s user interface and in the customer portal in accordance with the EU AI Act (Art. 50). Messages to customers that a person reviews on the basis of an AI draft and sends themselves are not separately labeled for the recipient, as they are sent under human control and editorial responsibility; AI-generated messages are not sent automatically. No automated decisions with legal or similarly significant effects are made without human oversight.

You may request human review of any AI-generated decision that significantly affects you by contacting us at office@capwork.io.

Capwork e.U. implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. These measures include:

• Encryption of data at rest and in transit (TLS 1.2+, AES-256)
• Access controls and role-based authorization (RBAC) with Firebase Authentication
• Infrastructure hosted on Google Cloud Platform within the EU (europe-west1 region)
• Regular security assessments, input validation (Zod schemas), and rate limiting
• Logging and audit trails for data access and modifications
• Prompt injection prevention and AI safety measures for all AI-processed data

A detailed description of TOMs is annexed to the Data Processing Agreement (AVV) and is available upon request.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request information about what personal data we hold about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You may request that processing be restricted under certain conditions.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests at any time.

To exercise your rights, contact us at office@capwork.io. We will respond within one month as required by Art. 12 GDPR. End customers of registered businesses should first contact the respective business (data controller) to exercise their rights.

To protect your data from unauthorized access, we verify the identity of anyone submitting a rights request. Requests made from within a signed-in account are treated as verified. Requests submitted by email are confirmed via a link sent to the email address registered on the account. Where reasonable doubt remains (Art. 12(6) GDPR), we may request additional proof of identity — such as a copy of a government-issued photo ID — which we delete once verification is complete. Complete deletion of a company account may only be requested by the account owner or an authorized administrator; individual users may only exercise rights concerning their own personal data.

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with the Austrian Data Protection Authority:

We reserve the right to update this Privacy Policy to reflect changes in our data processing practices or legal requirements. Material changes will be communicated to registered users via email. The current version is always available on this page.

Capwork e.U.

Inhaber: Nikolas Kain

Am Europlatz 2, 1120 Wien

FN 677603a, Handelsgericht Wien

Email: office@capwork.io