Privacy Policy

Last updated: September 2026

1. Privacy at a Glance

DoneNow is a tool for managing tasks for several companies and their workers. In the current first release stage, DoneNow is used exclusively by signed-in users in an admin/manager role; companies, workers, categories and tasks are held on the server. We are the controller within the meaning of the GDPR for all data arising from this — with the particularity described in Section 6 regarding worker data.

We do not use advertising networks for profiling, analytics or tracking services, or social-media plugins. No automated decision-making takes place. Data is not sold to third parties.

2. Data Controller

Legal Bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the usage contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in a secure, uninterrupted operation) and, where consent has been given, Art. 6(1)(a) GDPR. For data a user enters about their workers, see Section 6.

SSL/TLS Encryption

This site and all interfaces of the service are delivered exclusively encrypted (recognisable by https:// in the address bar).

3. Hosting

DoneNow is operated on a server in a data centre within the European Union. All application data — accounts, companies, workers, categories and tasks — is held on this server.

4. Website Access Data

When you visit a page, your browser transmits technically necessary information which the server records in log files: the page requested, date and time of the request, amount of data transferred and HTTP status code, browser type and version, operating system, referring page (referrer) where transmitted, and the IP address.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and defence against attacks. Logs are deleted after 30 days at the latest, unless they are needed to investigate a concrete case of abuse.

Contact

If you write to us by email, we process your details to handle the enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR.

5. Account and Sign-In

For an account we process: email address and, if provided, name; the password — exclusively as a non-reversible hash, never in plain text; a session identifier that lets the app recognise you on each request; timestamps of creation and last change; time-limited identifiers for the confirmation email and password reset.

The legal basis is Art. 6(1)(b) GDPR. The account applies to DoneNow only. Other applications of the Provider maintain separate accounts with their own data sets, even with the same email address; there is no synchronisation between them.

6. Companies, Workers, Categories and Tasks

When you create a company, we process the name and contact details you enter. When you create a category or a task, we process the name, its assignment to a company/category, the assigned owner, status, and timestamps of creation and change.

Workers — the user's own responsibility. When you add a worker, you enter personal data of a third person (at least name and email address, possibly role and company membership). You, as the user, are yourself the controller under data-protection law for this data — you decide whose data you enter and for what purpose. We process this data on your behalf, exclusively to provide the service; we do not use it for any purpose of our own. The legal basis for our processing is Art. 6(1)(b) GDPR (performance of the usage contract existing with you); the data-protection basis for your entry of the worker's data (e.g. an employment or engagement relationship) is yours to establish.

In the current first release stage, a worker has no access to DoneNow themselves; their data is only visible through the user's account. A dedicated worker area with sign-in is planned for a later release stage and will be added in due course.

7. Email

The service sends emails only on specific occasions: registration confirmation, password reset. Sending takes place via the Provider's mail server. There is no marketing or newsletter mailing.

8. Storage on the Device

The service stores technically necessary data locally on your device (localStorage): the session (account identifier, session identifier) as well as your chosen language and appearance. Companies, workers, categories and tasks are freshly loaded from the server on every request in the first release stage and are not persistently mirrored on the device.

The legal basis is Art. 6(1)(b) GDPR; storage is necessary for operation. Clearing the app's data removes these entries from the device.

9. Push Notifications in the App

If you use DoneNow as an iOS app and consent to notifications, the operating system generates a device identifier via Firebase Cloud Messaging (Google Ireland Limited), which we associate with your account. The legal basis is your consent under Art. 6(1)(a) GDPR, given by agreeing to notifications in the operating system. You can revoke it at any time in your device's system settings; the stored device identifier is then no longer used and is removed upon account deletion.

10. Retention and Deletion

• Account data — until you delete your account.
• Companies, workers, categories, tasks — until you remove them individually or by deleting your account. We do not delete them on our own initiative.
• Access logs — after 30 days at the latest.

You delete your account yourself via the danger zone in your profile. This removes all server-side records — including any worker data you entered — and deactivates the account. This process cannot be undone. Accounts with other applications of the Provider remain unaffected and must be deleted separately there.

11. Your Rights

You have the right at any time to request free information about your stored personal data, its origin and recipients, and the purpose of processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on a legitimate interest (Art. 21). Any consent given can be withdrawn at any time with effect for the future.

Please contact [email protected] for this. Where a request concerns the data of an entered worker, we will — to the extent legally required — forward it to the user who entered that data (see Section 6).

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data-protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

12. Changes to this Policy

We update this Policy whenever the service or the legal situation changes. The version published here at any given time applies. Account holders will be additionally informed of material changes in the app or by email.