PRIVACY INFORMATION

Last updated: 20 March 2025

1. GENERAL

This privacy policy explains which personal data we collect, why we process it, and which rights you have. It applies to: - visitors to our website and prospective customers (see section 3.1) - customers (admins) who use our software (see section 3.2) - employees / crew members whose data is processed through our software (see section 3.3) - business partners and suppliers (see section 3.4) - applicants (see section 3.5)

2. WHAT ARE PERSONAL DATA?

Personal data are information relating to natural persons whose identity is identified or identifiable, such as your name, contact details, working hours, invoicing data, or IP address.

3. HOW ARE YOUR PERSONAL DATA PROCESSED?

3.1 Processing of data of website visitors and prospective customers

We process personal data of website visitors on the following legal bases: - To safeguard our legitimate interests (Art. 6(1)(f) GDPR) - To ensure the technical operation and security of the website - To improve and optimize our online offering - To handle enquiries (Art. 6(1)(a) and (b) GDPR) when you contact us by email or phone - On the basis of consent (Art. 6(1)(a) GDPR) when you subscribe to our newsletter

Automatic collection of data ("server log files") When you visit our website, the following data are collected automatically: - IP address (anonymized) - Date and time of the request - Browser type and operating system - Domain name and access status - Referrer URL (website from which access occurred) These data are technically required to display the website correctly and to ensure its security.

Cookies and tracking technologies We use cookies to ensure the usability of our website. Required cookies: These cookies are technically necessary to provide basic website functions. They cannot be disabled. Analytics and tracking cookies (non-personal): - Google Analytics: we use Google Analytics, a web analytics service provided by Google Ireland Limited, to generate anonymized usage statistics - No personal data are stored because IP addresses are anonymized - Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in improving our website - You can disable Google Analytics via our cookie settings - Further information: Google Privacy Policy

Newsletter registration (personal data) If you subscribe to our newsletter, we process the following personal data: - your email address - optionally your name Legal basis: processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every email. After unsubscribing, your data will be deleted within 30 days. At present, we do not use an external service provider for newsletter delivery; we send newsletters manually.

External services on the website - Google Maps and Google Fonts: map services and web fonts provided by Google Ireland Limited - Privacy policy: Google Privacy Policy - Opt-out: Google Ads settings - No social media plugins are used

3.2 Processing of customer data (admins, production companies)

If you use our software as a customer, we process your data for contract performance (Art. 6(1)(b) GDPR): - creation of a user account - management of projects and crew data for personnel administration and payroll processing - billing and invoicing - sending emails for authentication purposes, such as account creation or password reset, via AWS Simple Email Service

To comply with legal obligations (Art. 6(1)(c) GDPR): - tax and retention obligations - social security law requirements

Categories of data: - email address and phone number - billing address and payment information - usage data within the software, for example which project was opened most recently (not for statistical analysis of user behavior)

Recipients of data: - Hosting provider: Hetzner Online GmbH (Germany), for operation of our servers - Email service: Amazon Web Services (AWS SES), for authentication and system emails - SMS service: Twilio Inc., for invitation SMS messages to crew members - Payment service provider: Stripe; we do not store payment data ourselves

3.3 Processing of crew member data

The software is used by crew members to enable payroll processing and to record working time.

Purposes of processing: Contract performance (Art. 6(1)(b) GDPR): - management of working hours and compensation - provision of a platform for time tracking - sending invitation SMS messages for first-time sign-in via Twilio Legal obligation (Art. 6(1)(c) GDPR): - retention obligations for tax and social security purposes

Data collected: - name, email address, and phone number for identification and communication - working hours, breaks, compensation, and per diem information for payroll processing - comments on working hours (optional, for example to explain how overtime arose) - department and position for assignment and display in the contact book - documents such as passports or driving licenses for payroll processing and verification of data accuracy

Recipients of data: - Hosting provider: Hetzner Online GmbH (Germany), for operation of our servers - Email service: Amazon Web Services (AWS SES), for authentication and system emails - SMS service: Twilio Inc., for invitation SMS messages to crew members

3.4 Processing of data of business partners and suppliers

We process personal data of suppliers and business partners: - for contract performance (Art. 6(1)(b) GDPR) - to manage supplier relationships - to handle payments and invoices - to comply with legal obligations (Art. 6(1)(c) GDPR)

Recipients of data: none

3.5 Processing of applicant data

If you apply to us, we process your data: - to initiate an employment relationship (Art. 6(1)(b) GDPR) - if you would like to remain in our candidate pool, on the basis of your consent (Art. 6(1)(a) GDPR) - to comply with employment law obligations (Art. 6(1)(c) GDPR)

Deletion: applicant data are deleted after 7 months if no employment relationship is established.

4. RETENTION PERIOD

We keep your data for as long as this is necessary to fulfill our contractual or legal obligations and to defend against any liability claims.

5. DATA SECURITY

Your personal data are protected by appropriate organizational and technical measures. These measures are aimed in particular at protecting personal data transmitted, stored, or otherwise processed against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

6. RIGHTS OF DATA SUBJECTS

You have the right of access to personal data concerning you (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), notification regarding these processing activities (Art. 19 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on our legitimate interests (Art. 21 GDPR).

If we process your data on the basis of your consent, you have the right to withdraw that consent at any time by email to support@crewser.app or by post. This does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

You also have the right to lodge a complaint with the Austrian Data Protection Authority or with another supervisory authority in the EU, especially at your place of residence or work. Please also inform us of any changes to your personal data.

If, despite our obligation to process your data lawfully, a violation of your rights should unexpectedly occur, please contact us by post or by email at support@crewser.app so that we can understand and address your concerns. If you have further questions about the processing of your data, you can also write to Cinework Software GmbH, Weyringergasse 19/2/10, 1040 Vienna.

7. UPDATING THIS PRIVACY INFORMATION

It may become necessary to amend this privacy information due to the continued development of our website and offers or due to changed legal or regulatory requirements. The current version of this privacy information can always be accessed on this website.