Introduction
TimeTac GmbH, Schmiedgasse 31, 8010 Graz, Austria, hereinafter referred to as “TimeTac”, is a processor within the meaning of Art. 28 GDPR. TimeTac processes personal data in the context of the use of Google Integrations, such as Google Calendar, on behalf of and only on the documented instructions of a controller. The controller in this context is the respective customer of TimeTac. Typically, this is the employer of the data subject.
TimeTac acts as a processor in relation to the use of Google Integrations (such as Google Calendar) and is therefore not subject to any information obligation regarding the processing of personal data in accordance with Art. 13 GDPR.
Processed data
When you connect a Google account, TimeTac accesses:
- your name and email address (to identify the
connected account) - the list of calendars in your Google account (calendar identifier, display name and colour)
- events from the calendars you select, limited to the date range currently displayed — for each event its title, start and end time, and whether it is an all-day event.
Access is read-only. TimeTac never creates, edits or deletes anything in your Google account.
How we use Google user Data
Google user data is used solely to display your calendar entries alongside your time entries in TimeTac, so that you can create a time entry from a calendar entry. It is used for no other purpose – in particular not for advertising, profiling, credit assessment or market research.
The processing of the mentioned personal data is based on the contractual basis pursuant to Art 6 para 1 lit b GDPR.
Who we share Google user data with
TimeTac does not sell Google user data and does not share, transfer or disclose it to any third party. It is not passed to advertisers, data brokers, analytics providers or any other outside party. It is disclosed only where required by law, and to the infrastructure providers that host TimeTac, who act as our processors under contract and may not use it for their own purposes.
The personal data collected will not be transmitted to other controllers.
How we protect your Google user data
- All traffic between TimeTac and Google is encrypted in transit using TLS
- The credentials granting access to your Google account are stored encrypted at rest using industry-standard strong encryption
- Calendar data is retained only temporarily, is isolated per user, and is accessible only to that user’s own TimeTac account
- Access to production systems holding this data is restricted to authorised personnel, granted on a need-to-know basis, and logged
How long we keep it and how to delete it
Calendar events are not stored permanently. They are retrieved from Google when you view them and are retained only for as long as needed to display them. You can disconnect a Google account in TimeTac at any time: TimeTac then revokes its access with Google and deletes the stored credentials and any calendar data retained for your account. You can also revoke access directly at https://myaccount.google.com/permissions.
Limited use
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is not read by humans except as required for security purposes, to comply with applicable law, or where you have given explicit consent.
Artificial Intelligence and Machine Learning
TimeTac does not use Google user data — raw, aggregated or derived — to create, train or improve any foundational or generalised artificial-intelligence or machine-learning model. Google user data is not transferred to any third-party artificial-intelligence service. No artificial-intelligence or machine-learning model processes Google Calendar data in TimeTac.
Contact Data and your right regarding your personal data
Your rights with regards to the personal data mentioned as well as our contact details can be found in our general privacy policy, available at: https://www.timetac.com/en/company/privacy-policy/.
