VeoWork Timesheets for Azure DevOps Services — Version 1.0, effective 9 October 2026
1. Scope of this Privacy Policy
This Privacy Policy explains how Drudewerk UG (haftungsbeschränkt) (“Drudewerk”, “we”, “us” or “our”) processes personal data when a person:
- visits veowork.io;
- uses the VeoWork Timesheets extension and hosted service for Azure DevOps Services (the “Service”);
- administers a customer subscription or communicates with us about an order;
- receives a transactional service email;
- subscribes to or receives an optional marketing email; or
- contacts us for support or another business purpose.
The Service is intended for organizations and professional use. This Policy does not replace the privacy information that a customer of VeoWork Timesheets must provide to its employees, contractors and other users when that customer determines why and how their personal data is processed.
2. Who is responsible?
For the controller activities described in Section 3.2, the responsible entity is:
| Item | Details |
|---|---|
| Legal name | Drudewerk UG (haftungsbeschränkt) |
| Business address | Cosimastr. 121, 81925 München, Germany |
| Commercial register | Handelsregister B, Amtsgericht München, HRB 316676 |
| Website | https://veowork.io |
| Privacy, legal and security contact | [email protected] |
| Customer support | [email protected] |
| Competent supervisory authority | Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) |
We have not appointed a data protection officer because we have determined that the statutory appointment requirements do not currently apply. Privacy enquiries may be sent to [email protected].
3. Drudewerk’s data-protection roles
3.1 Customer-controlled Service Data
A customer normally decides why and how personal data is entered into, obtained from Azure DevOps Services by, or otherwise processed through the Service. For that Customer Data, the customer is the controller and Drudewerk is its processor. We process Customer Data only to provide and secure the Service, on the customer’s documented instructions, and as otherwise permitted by the data processing agreement in the Master Service Agreement (the “DPA”).
If you use the Service through your employer or another organization, send requests concerning your Customer Data to that organization. We will assist the customer in responding as required by the DPA and applicable law.
The Service is not designed or authorized for intentional processing of special-category data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offenses within the meaning of Article 10 GDPR. Customers and users must not intentionally enter such data or configure the Service to access or synchronize it. Such data may nevertheless be made available inadvertently. If a customer becomes aware of this, it must promptly remove the data where possible or contact Drudewerk for assistance under the DPA. While the data remains, Drudewerk handles it in accordance with the DPA and applicable law; inadvertent receipt does not expand the Service’s agreed scope.
3.2 Drudewerk-controlled data
Drudewerk acts as controller when we determine the purposes and essential means of processing. This includes operating our website, managing business contacts and subscriptions, billing and record-keeping, providing support, sending transactional service communications, administering optional marketing subscriptions and sending consent-based marketing emails, protecting our systems, investigating misuse, and complying with law.
Some information can be processed in both roles. For example, a support request is controller data when we manage the support relationship, while Customer Data included in an attachment remains subject to the customer’s instructions.
4. Personal data processed through the Service
Drudewerk processes Customer Data on the customer’s behalf as described in Schedule B1 — Processing Details of the Master Service Agreement. Schedule B1 contains the complete contractual description of the processing, including its subject matter, purposes, duration, categories of Personal Data and categories of Data Subjects. Schedule B1 governs the scope of processing under the DPA; this Policy does not expand the customer’s instructions.
The Service obtains this data from users and customer administrators, from the customer’s connected Azure DevOps Services organization, and from system-generated activity within the Service.
Azure DevOps Services is the supported Microsoft platform. Microsoft provides it under the customer’s own relationship with Microsoft and remains a customer-selected platform provider. The Service does not support Azure DevOps Server or other on-premises Azure DevOps installations.
5. Personal data for which Drudewerk is controller
We may process:
- website technical and analytics data: IP address, date and time, requested path, referrer where supplied, browser, device, operating system, screen size, language, approximate location, Cloudflare request identifiers, rotating pseudonymous Umami session and visit identifiers, and security events. Umami receives the IP address transiently to derive limited location and session information but does not store it;
- account and order data: customer organization, account owner and administrator names, business email addresses, subscription and named-user allocation, Order Forms, invoices, tax information, payment status and related correspondence;
- support and communications data: sender and recipient details, organization, message content, attachments, diagnostic information voluntarily provided, and support history;
- transactional-email delivery data: recipient address, message metadata, delivery status and limited message content handled by our email provider; and
- marketing-subscription and consent data: the account’s current email address, authenticated Azure DevOps user and organization identifiers, consent and withdrawal timestamps, subscription status, and records of campaigns, delivery, bounces, complaints and suppression; and
- legal, supplier and business-contact data: professional contact details, role, organization, agreements, correspondence and records needed to manage the relationship or legal obligations.
We send marketing emails only to people who independently opt in. We do not automatically enroll customers, administrators or Service users, and we do not buy, rent, scrape or import third-party contact lists for advertising.
6. Purposes and legal bases
Where Drudewerk is controller and the GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries, negotiating orders, administering subscriptions and providing requested support | Article 6(1)(b) GDPR when the person is party to the contract or requests pre-contractual steps; otherwise Article 6(1)(f), our and the customer’s legitimate interest in managing the B2B relationship |
| Operating the website and Service, authenticating users, diagnosing faults and maintaining reliability | Article 6(1)(b) where necessary for a contract with the person; otherwise Article 6(1)(f), our legitimate interest in providing a functional and reliable service |
| Measuring aggregate use of the public website, identifying technical or usability issues, and improving its content, navigation and performance | Article 6(1)(a), your consent. Public-website analytics remains disabled unless you allow it |
| Remembering a public-website visitor’s analytics choice | Article 6(1)(f), our legitimate interest in respecting and applying the visitor’s choice without repeatedly asking during its validity period |
| Protecting accounts and systems, preventing misuse, keeping security logs and investigating incidents | Article 6(1)(f), our and our customers’ legitimate interests in security, integrity, fraud prevention and enforcing contractual rights; Article 6(1)© where processing is legally required |
| Sending approval, submission, security and other transactional service emails | Article 6(1)(b) or Article 6(1)(f), depending on the recipient’s relationship with Drudewerk |
| Sending optional product news, educational content, event or survey invitations, and offers concerning VeoWork Timesheets | Article 6(1)(a), consent. We send marketing only after prior express consent as required by Section 7 of the German Act Against Unfair Competition (UWG) |
| Recording consent or withdrawal, preventing unwanted resubscription and demonstrating compliance | Article 6(1)(f), our legitimate interests in preventing misuse, respecting marketing choices and establishing or defending legal claims |
| Billing, tax, accounting and business records | Article 6(1)(b), Article 6(1)©, and Article 6(1)(f), as applicable |
| Establishing, exercising or defending legal claims and responding to lawful requests | Article 6(1)© and Article 6(1)(f) |
We do not rely on the existing-customer exception in Section 7(3) UWG for marketing email. Where consent is required, a contract, account or prior enquiry does not by itself authorize marketing.
Where Drudewerk is processor, the customer determines the purposes and lawful bases. The DPA governs our processing instructions.
7. Website and Service analytics, cookies and local storage
7.1 Privacy-minimized statistics with Umami Cloud
We use Umami Cloud, provided by Umami Software, Inc., to generate privacy-minimized statistics about visits to and use of the public website and authenticated Service. These statistics include page and route views and interactions with website or Service features. We use them to understand how our content and functions are used and to improve usability, navigation, performance and reliability. Our Hobby-plan account uses Umami Cloud’s EU service region. Analytics records are retained for six months.
Analytics is configured without analytics cookies or browser storage. We do not send Distinct IDs, account or customer identifiers, contact details, form contents, URL query strings or URL fragments. We do not use analytics for advertising, cross-site tracking, marketing profiling, session replay or heatmaps.
The information processed may include the page or feature used, referrer where supplied, date and time, browser and device information, screen size, language, approximate location, and rotating pseudonymous session and visit identifiers. Umami receives the visitor’s IP address transiently to derive limited location and session information but does not store it.
For public-website analytics, Drudewerk acts as controller and relies on your consent under Article 6(1)(a) GDPR. The website does not request or initialize the Umami analytics script unless you select Allow analytics. You can refuse analytics without losing access to the website or Service. If you allow analytics, you can withdraw that choice at any time through Tracking settings in the website footer. Withdrawal applies to future collection and does not affect processing that occurred before withdrawal.
We also configure Umami to respect supported Do Not Track browser signals. Allowing analytics does not override such a signal, and enabling it does not affect access to the website or Service.
For authenticated Service route statistics, the customer determines the purposes, lawful basis and instructions, and Drudewerk processes the information on the customer’s behalf under the DPA. Umami is an authorized subprocessor under Schedule B2 — Subprocessors of the Master Service Agreement. Requests concerning those statistics should be directed to the relevant customer.
We do not set third-party marketing cookies.
7.2 Necessary website and Service local storage
The public website stores the analytics choice and the time it was made in the visitor’s browser local storage. This first-party preference does not contain an account, contact or analytics identifier and is not sent to Drudewerk. It is used only to apply the choice and avoid asking again on every page. The preference expires after 12 months, after which the website asks again. If browser storage is unavailable, the choice applies only to the current page and the website may ask again on a later visit. Removing the preference also causes the website to ask again.
The Service uses necessary browser local storage for authentication session tokens and user-interface preferences. Removing this storage signs the user out and may reset preferences. Service local storage is not used for analytics, cross-site advertising or marketing measurement.
7.3 Optional marketing emails
During a user’s initial Service onboarding for an Azure DevOps organization account, the Service offers an optional marketing subscription alongside, but clearly separate from, acceptance of the Master Service Agreement. The marketing checkbox is unticked. Selecting it is not required to accept the agreement, create an account or use the Service. Drudewerk does not subscribe people through any other method.
The checkbox identifies the current account email address obtained from the user’s authenticated Azure DevOps identity. Marketing consent applies to that organization account and follows its current email address when it changes. Customer administrators and Service users are not subscribed merely because their contact details appear in an Order Form, account or Azure DevOps Services organization. We do not repurpose Customer Data for marketing under the customer’s processor instructions. If a user chooses to subscribe, the resulting marketing-subscription data is controlled by Drudewerk even though the person is also a Service user.
If the user selects the checkbox and continues onboarding, Drudewerk records the user’s consent and activates the marketing subscription. The separate checkbox, rather than acceptance of the Master Service Agreement, is the affirmative action indicating consent. We retain evidence of that choice and the authenticated account context so that we can demonstrate the consent. Marketing may include product news, educational content, event or survey invitations, and offers concerning VeoWork Timesheets.
Marketing emails do not contain tracking pixels, and we do not use open tracking, click redirection, recipient-specific link identifiers or marketing profiling. Our email-delivery provider still processes ordinary delivery information, failures and spam complaints as described in Sections 5, 8 and 10.
Users can withdraw consent in the Marketing emails section of their personal Service settings. Consent and withdrawal apply to the current organization account; users who opted in through more than one organization account can withdraw in each account or contact us for assistance. Every marketing email provides a one-click unsubscribe link, and a recipient may also withdraw consent by emailing [email protected].
Withdrawal applies to future marketing and does not affect the lawfulness of processing before withdrawal. It does not stop security, billing, support, workflow or contractual messages that are necessary for the relevant account, Service or business relationship.
8. Recipients and service providers
We disclose personal data only where necessary to provide and secure the Service, administer the business, deliver requested marketing, follow the customer’s instructions, or comply with law. Access within Drudewerk is limited by role and need. Drudewerk personnel access production systems from within the European Economic Area only.
Drudewerk uses the service providers identified in Schedule B2 — Subprocessors of the Master Service Agreement. Schedule B2 contains the complete and current list of named authorized subprocessors and describes their purposes, processing locations and transfer mechanisms for Customer Personal Data. When those providers process Customer Personal Data, Schedule B2 governs their authorization under the DPA. When they process personal data for which Drudewerk is controller, they act under Drudewerk’s applicable data-processing arrangements. This includes using the identified database-hosting and email-delivery providers to manage marketing-subscription records and deliver requested marketing emails.
We may also disclose information to professional advisers, public authorities or courts where necessary and lawful, and in connection with a corporate reorganization, acquisition or transfer subject to appropriate confidentiality and data-protection measures.
9. International data transfers
Drudewerk does not represent that all processing is confined to the European Economic Area. Although certain services are configured to store data in an EEA region, service providers or their affiliates, personnel and subprocessors may be established in, process personal data in, or remotely access personal data from countries outside the EEA. Drudewerk personnel access production systems from within the EEA only.
The current service providers, relevant processing locations and transfer mechanisms are identified in Schedule B2 — Subprocessors of the Master Service Agreement.
Where the GDPR restricts a transfer, we use an applicable adequacy decision, the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, a valid approved certification framework where applicable, or another lawful transfer mechanism. We assess supplementary measures where required. You may contact [email protected] for information about, or a copy of, the safeguards relevant to a particular transfer.
10. Retention and deletion
We retain personal data only as long as needed for the relevant purpose, customer instructions, security, dispute resolution and mandatory legal obligations. The main operational periods are:
| Data | Normal period or rule |
|---|---|
| Cloudflare Worker application logs | Up to 7 days |
| PlanetScale PostgreSQL cluster logs | 7 days |
| PlanetScale automatic database backups | Created every 12 hours and retained for 2 days |
| Umami Cloud website and Service analytics records | 6 months |
| Public-website analytics choice stored in the visitor’s browser | 12 months from the choice, unless the visitor changes or removes it sooner |
| Active Customer Data | For the subscription term and the post-termination procedure below |
| Migration credentials and staged migration data | Credentials are normally removed when the migration completes, is cancelled or fails cleanup, and are technically capped to expire no later than 7 days after creation. Staged migration records are removed after the migration no longer requires them, subject to the termination rule |
| VeoWork Timesheets API-token metadata | Until expiry or revocation and thereafter only as needed for security records; the token secret is not stored in retrievable form |
| Active marketing subscriptions | Until consent is withdrawn |
| Marketing consent and withdrawal evidence | For 3 years after the end of the calendar year in which the subscription ends |
| Marketing-suppression records | The email address, date and reason or status are retained for as long as reasonably needed to prevent renewed marketing, subject to periodic review |
| Transactional- and marketing-email delivery data | According to the provider configuration and policy. SMTP2GO states that email headers and limited sampled content may be retained for up to 35 days for delivery and abuse prevention, and certain suppression data may be retained longer under its policy |
| Support and business correspondence | For as long as needed to handle the matter and then according to limitation, evidence and legal-retention requirements |
| Orders, invoices, tax and accounting records | For the periods required by applicable commercial and tax law |
After termination or expiry, the customer may request an export during the agreed 60-day combined export-and-deletion window. Drudewerk will complete the requested export and delete Customer Data from active systems no later than 60 days after termination, unless law requires retention or the Parties agree otherwise in writing. Data remaining in PlanetScale automatic backups then expires through the normal 2-day backup cycle. Data retained because of law is isolated from ordinary use and kept only for the required purpose.
11. Security
We use technical and organizational measures appropriate to the risk, including multi-factor authentication for privileged services, least-privilege access, encrypted and screen-locked work devices, prompt access removal, per-customer database isolation, encryption in transit, provider-managed encryption at rest, AES-GCM encryption for stored integration credentials, managed secrets, logging designed to redact secrets, backups, code review and automated testing, incident response procedures, and supplier review.
No transmission or storage system can be guaranteed completely secure. Customers remain responsible for configuring Azure DevOps permissions, selecting authorized users, protecting accounts and deciding what data users may enter. Additional details are in the technical and organizational measures exhibit to the DPA.
12. Artificial intelligence and automated decisions
Drudewerk does not submit Customer Data to generative-AI services and does not use Customer Data to train machine-learning or generative-AI models. We do not use Service Data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person.
The Service may calculate totals, apply customer-configured rules and present workflow status. Those deterministic functions do not make legally or similarly significant decisions on Drudewerk’s behalf; customers decide how to use the results.
13. Your rights
Depending on applicable law and Drudewerk’s role, you may have rights to:
- obtain information about processing and access your personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- receive data you provided in a portable format;
- object to processing based on legitimate interests; and
- withdraw consent for future processing where consent is the basis, including marketing consent at any time.
To exercise a right concerning data controlled by Drudewerk, email [email protected]. Marketing consent can also be withdrawn in personal Service settings for the relevant organization account or through the one-click unsubscribe link in each marketing email. Withdrawal does not affect the lawfulness of consent-based processing before it takes effect. We may need to verify your identity. If the data belongs to a customer’s Service account, contact that customer first; we will assist it as processor.
You may complain to the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) or another competent data-protection authority, particularly in the EU or EEA country where you live or work or where you believe an infringement occurred.
14. Required information and consequences
Fields identified as required for authentication, account administration, an order or support are necessary to provide the requested function or enter into the relevant contract. Without them, we may be unable to create or secure an account, provide the Service, process an order or respond to the request. Entry of optional timesheet comments and custom attributes is determined by the customer, subject to the MSA restrictions on prohibited data.
15. Changes to this Policy
We may update this Policy to reflect legal, operational or service changes. The date and version at the top identify the current text. If a change materially affects how we use personal data for which Drudewerk is controller, we will provide appropriate notice. Changes to processor obligations are governed by the MSA and DPA.
16. Contact
- Privacy, legal and security enquiries: [email protected]
- Customer support: [email protected]
- Website: https://veowork.io