GDPR & BDSG Compliance

Our commitment

Kern is built from the ground up to comply with the EU General Data Protection Regulation (DSGVO / GDPR) and the German Federal Data Protection Act (BDSG). Compliance is a design principle baked into our data model, API, and UI.

Data Processing Agreement (DPA)

All customers who use Kern to process personal data of employees are covered by our Data Processing Agreement (Art. 28 DSGVO). The DPA is available on request at legal@kern.app and is signed automatically as part of your subscription.

Article 15 - Right of Access

Employees may request a copy of all personal data held about them. Kern's GDPR module lets HR managers generate and deliver this export in under 10 minutes, within the 30-day statutory deadline.

Article 16 - Right to Rectification

Inaccurate personal data can be corrected directly in the employee profile. Every change is logged in the immutable audit trail with timestamp and actor ID.

Article 17 - Right to Erasure

Kern supports anonymisation of employee records on deletion. Personal fields (name, email, IBAN, tax ID, phone) are wiped. Aggregate data required for legal retention is preserved. Deletion requests are tracked in the GDPR request queue.

Article 20 - Data Portability

Employees can request their data in a structured, machine-readable format (JSON). Kern generates a signed download link valid for 24 hours, delivered to the requester's confirmed email address.

Section 26 BDSG - Employee Data

Processing of employee personal data is permitted only where necessary for the employment relationship (Sec. 26 BDSG). Kern enforces this through role-based access control: salary data, tax IDs, IBAN and social security numbers are visible only to TENANT_ADMIN and HR_MANAGER roles.

Sensitive data fields & encryption

• IBAN and BIC - encrypted at rest, masked in UI for non-admin roles.
• Steuer-ID (Tax ID) - encrypted at rest, GDPR-classified as sensitive.
• SV-Nummer (Social Security Number) - encrypted at rest.
• Health insurance details - stored only with legal basis under Sec. 26 BDSG.

Audit log (HGB / BDSG)

Every access to sensitive data generates an immutable audit log entry: action type, actor user ID, resource ID, timestamp and IP address. The log cannot be modified or deleted, even by SUPER_ADMIN.

Data residency

All data is stored in Supabase hosted in the EU (Frankfurt, Germany). No personal data is transferred outside the EEA without Standard Contractual Clauses.

Retention periods

• Active employee data: retained for duration of employment plus 3 years (standard limitation period).
• Payslip and payroll data: retained for 10 years (commercial law requirement).
• Job application data (rejected): deleted after 6 months.
• Audit logs: retained for 7 years (tax law requirement).

DPO contact

For any GDPR or BDSG enquiry, contact our Data Protection Officer at dpo@kern.app. We respond to all DPO requests within 72 hours.