WORK-ID
Legal

Privacy

This English version is provided for convenience. In case of doubt, the German version applies.

As of October 2026

This notice explains which personal data is processed when you visit this website and use WORK-ID, why, for how long, and what rights you have (Articles 13 and 14 GDPR).

1. Controller

Operator of WORK-ID (company in formation) · Email: austria@lentrahub.com
An email to this address is all it takes for data protection questions and to exercise your rights.

2. Two roles: website and app

  • Website, registration and user accounts: WORK-ID is the controller.
  • Data a company records in WORK-ID about its workforce and subcontractors (e.g. workers, documents, check-ins): the company concerned is the controller. WORK-ID processes this data on its behalf (Article 28 GDPR). Workers should first contact their employer with questions and requests; we support the company in this. A data processing agreement (DPA) is available on request.

3. Visiting the website

Whenever a page is requested, our hosting provider processes technically necessary data: IP address, date and time, the address requested, browser and operating system. This is needed to deliver the page and protect it against attacks (Article 6(1)(f) GDPR). These logs are kept only briefly.

We use no advertising or analytics cookies and no tracking. Fonts and images are loaded from our own server, not from third parties.

4. Creating an account and logging in

  • Data: company name, your name, email address, password; optionally the company's country, VAT number, address and website.
  • Purpose and legal basis: providing the account and the app (Article 6(1)(b) GDPR).
  • Passwords are only stored as a hash (PBKDF2), never in plain text.
  • VAT number lookup: if you enter a VAT number, it is sent to the European Commission's VAT Information Exchange System (VIES) to retrieve the company name and address.
  • Company logo: the publicly visible logo is fetched from the website you provide or from your email domain and stored for the ID cards. It can be removed at any time.
  • Abuse protection: failed logins and lookups are briefly stored with the email address or IP address and deleted after 24 hours (Article 6(1)(f) GDPR).
  • Confirmation at registration and important changes are recorded in the workspace history (with IP address) so that it is clear who did what.

5. Cookies and local storage

After login, WORK-ID sets a strictly necessary session cookie (“sid”, valid for 14 days, not readable by scripts). Settings such as the chosen language and view filters are also stored locally in the browser. Login does not work without this storage; no consent is required for it (§ 165 (3) TKG 2021).

6. Data in the app

Depending on their needs, companies record in WORK-ID: workers' details (name, nationality, company, job, employee number, profile photo), social security number, documents such as ID documents, A1 certificates, notifications and payroll records, sites, shift plans, attendance and subcontractor data. The purpose is documentation and inspection readiness on construction sites in line with the requirements that apply to each company.

  • Social security numbers are stored encrypted (AES-GCM).
  • Companies are strictly separated. Data is only shared when a company explicitly allows it (site code).
  • Inspection folder: an inspector link shows a site's people and documents for 24 hours without login. It can be revoked at any time; every access is logged.
  • Site notice: if a company creates a site notice, its QR link shows – without login – only the site, address, the contact person entered with their phone number and the companies on site; no workers and no documents. The company can revoke the link at any time.
  • Other ID card and NFC: a stored card number and the serial number of an NFC card are only used to find the person when scanning. The NFC card is read in the device's browser; no other data from the card is stored.

7. Location at check-in

Workers with their own login can check in at their site. For this, the location is requested only at the moment the person taps “Share location” or “Check in” themselves – and only after they allow it in the browser. Coordinates, accuracy, time and the recognised site are stored. There is no background tracking and there are no movement profiles. The employer is the controller for this processing.

8. AI features (optional)

The AI import reads data sheets (PDF) and the AI helper answers how-to questions. Both only start after explicit confirmation in the respective step. The uploaded data sheet or the question asked is then sent to OpenAI (USA). Requests are sent with the setting that OpenAI does not store responses for later retrieval; under OpenAI's terms, API data may be retained for up to 30 days for abuse monitoring. The AI helper does not send any records or files from your workspace. Imports that are not saved are deleted after one hour.

9. Recipients and processors

  • Cloudflare, Inc. – hosting of the website and app, database (Western Europe) and document storage with EU data residency.
  • OpenAI, L.L.C. – only for the optional AI features (see section 8).
  • European Commission (VIES) – only for VAT number lookups.
  • OpenStreetMap Foundation – map tiles in the app's map view; the IP address is sent to the map server.

Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or EU standard contractual clauses (Articles 45 and 46 GDPR). Data is not sold and not used for advertising.

10. Retention

  • Sessions: 14 days or until you log out.
  • Failed login attempts and lookups: 24 hours.
  • AI imports not saved: one hour; saved import drafts: 7 days.
  • Inspector links: valid for 24 hours.
  • Login log (time, device type, IP address) and a random device identifier stored in the browser that only tells whether a login is used on a new device (no fingerprinting): 6 months. IP addresses in the activity history are removed after 6 months.
  • Hints about possible misuse (e.g. checking in on behalf of others): 12 months. GPS points of check-ins: 13 months; the working hours themselves are kept.
  • Account and company data, people, documents, check-ins and history: as long as the workspace exists or until the company deletes them. When a workspace is deleted, all data and files are permanently removed; the company's statutory retention obligations remain unaffected.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15–21 GDPR). You can withdraw consent at any time with effect for the future. Just write to austria@lentrahub.com.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

12. Changes

We update this notice when WORK-ID or the law changes. The version published here applies.