The most frequently asked questions about data protection in the skilled trades at a glance:
How do I have to inform employees about data processing?
trade businesses must transparently explain for what purpose and for how long personal data is processed. In addition, you must inform the data subjects about their right of revocation.
When do I have to appoint a company data protection officer?
Small trade businesses do not need an in-house data protection officer. You only need to appoint one if 20 or more employees are constantly involved in managing customer or employee data.
To whom does the GDPR apply in the craft sector?
Since 2018, every craft business has had to implement the General Data Protection Regulation, DSGVO for short - regardless of size or number of employees.
As an entrepreneur, you probably never really have time for data protection guidelines in the skilled trades: In addition to Job Management, project documentation, employee planning, and accounting, customer and employee data are also to be Organised in a DSGVO-compliant manner. This means one thing for you: a lot of bureaucracy that keeps you and your team from doing contract work. But since 2018, all trade businesses have had to comply with the strict requirements of the DSGVO. If this does not happen, it can sometimes be expensive.
Consumers in Europe enjoy many rights when it comes to handling their data. Conversely, companies must comply with numerous obligations for the collection and storage of personal data. These obligations are uniformly regulated within the European Union by the guidelines of the General Data Protection Regulation, or DSGVO for short. They apply to all companies that collect, use and process personal data. Regardless of how large the respective company is.
In the skilled trades, too, a lot of customer and employee data is generated every day. Thus, trade businesses, like any other company, must comply with the GDPR.
Note: The GDPR applies to both "internal" personal data of your employees and "external" personal data, such as data of business partners and customers.
Personal data in the craft sector
The EU regulation in turn defines exactly what personal data is. This is any individual piece of information that allows conclusions to be drawn about a person. In addition to direct data, this also includes information from the digital world. This includes, for example:
- Name and address
- Contact details such as e-mail or phone number
- Bank data
- Photos
- Online username and IP address (An IP address provides information about a device when surfing the Internet and thus also indirectly provides information about the person using this device).
This data is protected by the GDPR and may only be collected and processed with a declaration of consent.
In general, trade businesses are allowed to process and store all data that is absolutely necessary for the execution of the Job. You may even collect this data without an additional declaration of consent. For an on-site repair, you can therefore store the address, telephone number or even the e-mail address.
However, if you use this data for marketing campaigns, for example, you will need a declaration of consent from your customers. You may only store and process this personal data for as long as is necessary for the respective purpose. After that, you must delete it immediately.
But be careful: Some data must be stored for ten years for tax-relevant reasons. You can find out exactly which data you need to store in Section 147 of the German Fiscal Code (AO).
The same applies to employee data, by the way: Of course, you are allowed to store information about the health insurance fund and the tax number. In fact, you must do so in Job to fulfill legal obligations. Job titles and special qualifications may also be stored. However, private interests such as hobbies or club memberships are taboo. For this, you need a declaration of consent from your employees.
Data subject to consent
In the privacy policy for Tradesmen and craftswomen, you must explain in an understandable way what data you store and how you use it. The guidelines on the subject of Job processing are also particularly important for trade businesses. This regulates the transfer of data to external service providers, such as subcontractors or personnel service providers. If you pass on data to third parties, you must obtain written consent from your customers.
Theoretically, you can also obtain consent verbally, but in practice this can quickly lead to problems: The GDPR in the craft sector obliges you to be able to prove the declaration of consent upon request by authorities. It is therefore better to insist on a written confirmation.
Note: Customers and employees can revoke consent at any time. Therefore: If you wish, you must delete the data.
In Job for you to fully comply with the legal requirements of the GDPR in the craft sector, you will find a helpful sample template here as Word and PDF. You only have to replace the yellow marked fields in the document with your own company data.
With the second "EU Data Protection Adaptation and Implementation Act", small trade businesses in particular can breathe a sigh of relief: you only need a person to take care of data protection if 20 employees or more in your company constantly work with personal data. As a rule, this means the management as well as employees from personnel and customer administration. This does not include Tradesmen and women who have on-site customer contact.
Note: The assigned person must not be from your own management or your IT department. This would mean that this person would have to constantly monitor themselves. Alternatively, you can also use an external service provider.
The own homepage as a figurehead belongs today for small craft enterprises as well. Here, too, you must observe some guidelines within the framework of the GDPR. On the one hand, these should contain an imprint and direct contact to the company. On the other hand, Art. 13 and 14 DSGVO regulate that you must inform your clientele by means of a data protection declaration on the homepage about which data is stored when visiting the homepage. The following points should be included in the privacy policy:
- Explanation of what data is collected and how it is processed.
- Data storage for newsletters and how to unsubscribe from them.
- Consent to the setting of cookies. Cookies create information on the user's device so that this device can be identified again on subsequent visits.
- Explanation of how consents can be reversed.
At this point, at the latest, it becomes clear: data protection costs an enormous amount of time, which is why it is an unwelcome topic for many busy trade businesses. However, since you should definitely observe the legal regulations, you can provide relief elsewhere. For example, with the digital document management of the Meisterwerk app. The practical craftsman software supports you and your team in all organizational tasks related to project management.
Among other things, you can save invoices and documents digitally and have your customers sign them directly on site on a smartphone or tablet. Important documents will no longer get lost and can be found quickly and easily in the app thanks to the simple search function. In addition, you can use the Meisterwerk App:
- Easily assign appointments to your employees
- Record work hours digitally
- Provide preliminary plans with all important information
- Update Jobs and provide them with status
- Document projects digitally
And all that with just one click! This saves you up to one hour of working time per employee per week! Best of all: The Meisterwerk app places particular emphasis on intuitive handling. This means that you and your team do not need any additional training to operate it.
The information in this article does not constitute legal advice. Despite careful research, we do not guarantee the completeness, accuracy and timeliness of legal information in particular. If you require legal assistance, please contact a lawyer.
