Privacy policy
Status: September 2026
1. Controller
Oezer Software
Owner: Murat Özer
Pfaffenbrunnenstraße 16c
63456 Hanau
Germany
Phone: +49 6181 1808522
Email: kontakt@turnoly.com
2. General information on data processing
This privacy policy explains the type, scope, and purpose of processing personal data in connection with the website and the SaaS application.
Personal data is processed exclusively for providing and operating the software as well as for communication with prospects and customers.
Turnoly is offered exclusively to entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities and partnerships with legal capacity. Contracts with consumers within the meaning of Section 13 BGB are not concluded.
3. Website and application access
When the website or application is accessed, the hosting provider automatically processes technical information. This may include in particular:
- IP address
- Date and time of access
- Browser type and version
- Operating system used
- Referrer URL
- Pages accessed
This processing is used for the technical provision, security, and stability of the website and application.
The legal basis is Article 6(1)(f) GDPR.
4. Hosting
Hosting of the website and application
The public website, the Turnoly SaaS application and the primary PostgreSQL database run on a virtual server provided by IONOS.
Provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. According to the operator configuration, the production VPS is located in Spain within the European Union. The server processes IP addresses, technical logs and the account, business, employee, scheduling, time and absence data required to use Turnoly.
Domains, DNS and business email
ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, is used for domains, DNS and regular business email mailboxes.
This may involve processing domain and DNS data as well as sender, recipient, header and content data from business email communication. ALL-INKL does not host the Turnoly application or its database and does not send automated transactional application emails.
More information: https://all-inkl.com/datenschutzinformationen/
5. Database and backend
Turnoly uses a self-operated PostgreSQL 17 database within the private IONOS and Coolify infrastructure.
The application, database, Coolify, Docker and Traefik run on the production IONOS VPS. The PostgreSQL port is not publicly accessible.
Depending on how Turnoly is used, the database may process and store in particular:
- User accounts
- Login data
- Employee data
- Working hours
- Absences
- Roles and permissions
- Planning data
Processing takes place to provide the software functions. Where Oezer Software processes employee data on behalf of a customer, the company using Turnoly determines the applicable legal basis. Oezer Software processes its own contract and account data in particular under Article 6(1)(b) and, where applicable, Article 6(1)(f) GDPR.
The separate data processing agreement governs the details of processing on behalf of customers.
No external database-as-a-service provider is used.
6. User accounts and authentication
Creating a user account is required to use the application.
This may involve processing the following data in particular:
- Name
- Email address
- Password
- Roles and permissions
Registration takes place via email and password. Confirmation emails may be sent to verify the email address.
The legal basis is Article 6(1)(b) GDPR.
7. Processing inside the application
When using the software, companies may process personal data of their employees. This may include in particular:
- Name
- Address
- Date of birth
- Phone number
- Email address
- Working hours
- Absences
- Work areas
- Roles and permissions
Processing takes place exclusively for shift planning, time tracking, and team organization.
Responsibility for the data entered into the application lies with the respective company using it.
Where Oezer Software processes employee data on the instructions of the company using Turnoly, that company is the controller and Oezer Software is the processor. The separate data processing agreement applies. Depending on the respective purpose, Oezer Software may process its own contract, account and billing data under its own data protection responsibility.
The fixed absence category “Sick” may, together with the employee reference and absence period, constitute health data within the meaning of Article 9 GDPR. Turnoly does not provide structured fields for diagnoses, medical findings, medical certificates or sickness documents. The company using Turnoly is responsible for the legal basis, data minimisation and appropriate access permissions.
8. Email delivery
Resend is used to send transactional emails.
Provider: Plus Five Five, Inc. (Resend)
2261 Market Street #5039
San Francisco, CA 94114
USA
In particular, Resend may send the following emails:
- Registration confirmations
- Password reset emails
- System notifications
This may involve processing the name, email address, company context and content required for the respective message. Resend stores and processes customer data in particular in the United States. Where required, transfers rely on the safeguards applicable under the relevant Resend contractual documents.
More information: https://resend.com/legal/privacy-policy
9. Appointment booking via Calendly
Calendly is used for booking live demos or consultation appointments.
Provider:
Calendly LLC
271 17th St NW
Atlanta, GA 30363
USA
In particular, the following data may be processed when booking an appointment:
- Name
- Email address
- Selected appointment
Video conferencing services such as Google Meet or Microsoft Teams may be used as part of appointment coordination.
More information: https://calendly.com/privacy
10. Payment processing
Stripe is used for payment processing and subscription management.
Provider:
Stripe Payments Europe Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland
The following data may be processed in particular during payment processing:
- Name
- Billing address
- Payment information
- Email address
- Transaction data
Payment data is processed directly by Stripe. We do not store complete payment data on our servers.
More information: https://stripe.com/privacy
11. Contact requests
If you contact us by email, the transmitted data will be processed to handle your request. Regular business email communication uses the mailboxes provided by ALL-INKL.
The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
12. Cookies and technical storage
The application uses technically necessary cookies and similar technologies required for operation, login, and security.
Marketing or advertising tracking is not currently used.
13. Rights of data subjects
Within the scope of the statutory provisions, you have the following rights in particular:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object to processing
To exercise your rights, simply send an email to: kontakt@turnoly.com
14. Changes to this privacy policy
We reserve the right to update this privacy policy if technical, legal, or organizational changes make this necessary.