Privacy statement

1Responsible body

This statement describes how we (the Provider) process personal data in our role as the controller. The controller is:

Tom GewieseObernaglbach 294259 Kirchberg im WaldGermany

Email: info@zentrana.de · Phone: +49 160 92595136

Please send questions on data protection and requests concerning your rights to info@zentrana.de.

2Scope and roles in processing

We operate the Zentrana platform and the website through which we offer it. We use the terms Provider, Customer, User, Platform and Customer Data as in § 1 of the General Terms and Conditions (Terms).

As the controller we process data when you visit the website, for enquiries, towards prospects, for registration, contract and billing, in the partner programme and in support. This also includes the data of the customer account and its contact persons.

We process Customer Data, by contrast, on behalf of the Customer under the Data processing agreement (DPA). The personal data within it is called Processing Data there (§ 1 DPA). The Customer is the controller for it, and its privacy notices apply. Details are in the section “Processing on behalf of our customers”.

Some data from the Platform we process ourselves as the controller: access, sign-in and session data for security, abuse prevention and billing, the count of persons for billing, usage metrics and the blocklist for sending emails (§ 3 DPA). These processing activities are described in the sections “Registration and user account”, “Our business services” and “Support and email”.

3Legal bases

We process personal data only on a legal basis under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). For every processing activity we name the basis we rely on. The Federal Data Protection Act (BDSG) applies in addition.

• Consent: You have consented to processing for a specific purpose (Article 6(1)⁠(a) GDPR). You can withdraw your consent at any time with effect for the future; what happened until then remains lawful.
• Contract: Processing is necessary to perform a contract with you or to take steps at your request before entering into one (Article 6(1)⁠(b) GDPR).
• Legal obligation: A law obliges us to carry out the processing, for example when we are required to retain invoices (Article 6(1)⁠(c) GDPR).
• Legitimate interest: Processing is necessary for our interests or those of a third party, and your interests do not override them (Article 6(1)⁠(f) GDPR). We state the interest we pursue in each case.

Required details: We mark in the form which of the details are required. Without them we cannot handle an enquiry, set up an access or conclude a contract. There is generally no statutory obligation for you to provide us with data. For credit notes in the partner programme, the VAT Act requires your tax number or VAT identification number. All other details in forms are entirely voluntary.

4Recipients, third countries

Service providers receive data insofar as they work for us. Where they work on our behalf, we engage them as processors under Article 28 GDPR.

We disclose data to authorities, courts and advisers bound to confidentiality, such as tax advisers or lawyers, insofar as a law obliges us to do so (Article 6(1)⁠(c) GDPR) or it is necessary for us to establish, exercise or defend legal claims (Article 6(1)⁠(f) GDPR).

Where necessary, we also disclose data to insurers and to a company that is to take over contracts from us (§ 12 and § 14 Terms). The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to insure ourselves against risks and to be able to transfer our business.

We use these service providers depending on the service. What they receive data for is stated in this overview and in the sections that name them.

Hosting and data centre

OVH GmbH, Oskar-Jäger-Straße 173/K6, 50825 Köln

Sending and receiving emails

Service provider for email sending

Payments by SEPA direct debit, credit card or PayPal

Mollie B.V., Netherlands

Direct debits we collect ourselves

Banks involved

Research on prospective firms

Anthropic PBC, USA

Credit notes to partners through Lexware Office (formerly lexoffice)

Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg

Our web host runs the servers in a data centre located in Germany.

According to the hosting provider's list of further processors, remote access by companies of its group from Canada and the United Kingdom is possible. For the United Kingdom there is an adequacy decision of the European Commission, for Canada one for recipients subject to the Canadian federal Personal Information Protection and Electronic Documents Act (PIPEDA) (Article 45 GDPR).

Anthropic is based in the USA, i.e. outside the European Union and the European Economic Area. Standard contractual clauses of the European Commission apply to the transfer there (Article 46(2)⁠(c) GDPR). They form part of Anthropic's contract terms for the use of its interface. You can get a copy of the clauses from us on request.

If Lexware Office (formerly lexoffice) sends credit notes by email, a service provider based in the USA may be involved, which the provider of Lexware Office (formerly lexoffice) names as a sub-processor in its own data processing agreement.

The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Article 45 GDPR), insofar as the service provider is certified under it, otherwise standard contractual clauses of the European Commission (Article 46(2)⁠(c) GDPR). You can get a copy of the clauses on request.

For embedded videos, the third country is stated in the section “Embedded video clips”.

5Storage period

We store data for as long as the purpose requires. We state the period or the criteria for it with each processing activity.

If a law obliges us to retain data, for example § 147 AO, § 14b UStG or, where applicable, § 257 HGB, we delete the data only after that period has expired. If the purpose has lapsed but we still have to retain data, we use it only for that obligation and to establish, exercise or defend legal claims.

If we need data to assert or to defend legal claims, we retain it until the limitation period has ended (§§ 195 and 199 BGB).

The periods in the individual sections apply, unless such a statutory retention obligation or a legal claim requires longer storage.

Whatever we delete automatically after a period expires, we delete in regular batch runs. As a rule, up to 16 days lie between the end of a period and the deletion, 62 days at most.

Backups are overwritten after 30 days at the latest. Until then they may contain data that we have already deleted.

6Your rights

You have these rights against us, where the statutory requirements are met:

• Access (Article 15 GDPR): You can find out whether and which data we process about you, and receive a copy.
• Rectification (Article 16 GDPR): You can have inaccurate data rectified and incomplete data completed.
• Erasure (Article 17 GDPR): You can request erasure, for example if we no longer need the data. This does not apply while we must retain it or still need it for legal claims.
• Restriction (Article 18 GDPR): You can require that we only store the data, for example while we verify its accuracy or your objection.
• Data portability (Article 20 GDPR): You receive the data you gave us on the basis of consent or a contract in a structured, commonly used and machine-readable format; where technically feasible, we transmit it directly to another controller at your request.
• Withdrawal (Article 7(3) GDPR): You can withdraw consent at any time with effect for the future.
• Objection (Article 21 GDPR): Everything on this is in the section “Right to object”.

To exercise them, an informal message to info@zentrana.de is enough. If we have reasonable doubts about your identity, we can ask for further details. For Customer Data the Customer is responsible; more on this in the section “Processing on behalf of our customers”.

7Right to object

Objection to processing based on legitimate interest: On grounds relating to your particular situation, you can object at any time to processing that we base on Article 6(1)⁠(f) GDPR. We then no longer process the data for that purpose. This does not apply if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing serves to establish, exercise or defend legal claims.

Objection to direct marketing: If we process your data for direct marketing, for example to approach you about Zentrana or further modules, you can object at any time without giving reasons. We then no longer process it for that purpose.

An informal message to info@zentrana.de is enough.

8Complaint to the supervisory authority

If you believe that processing of your data infringes the GDPR, you can lodge a complaint with a data protection supervisory authority (Article 77 GDPR). This applies in particular in the Member State of your residence, your place of work or the alleged infringement.

Responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach

9Visiting the website

When you visit a page of the website or the Platform, our web server processes technical connection data, in particular your IP address, the time and the requested address.

• Purpose: Delivering pages, finding errors and repelling attacks.
• Legal grounds: Article 6(1)⁠(f) GDPR. Our legitimate interest is a secure and trouble-free operation of the service.
• Recipients: our web host.
• Storage period: We retain these logs only for as long as troubleshooting and defence against attacks require.

If an error occurs in the Platform, we store an error message with the affected function and the affected Customer. Beforehand we replace email addresses and recognisable input values with placeholders. We delete a message 365 days at the latest after the error has been fixed. If an error has not occurred for 365 days, it counts as fixed. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is an error-free Platform.

To limit abuse, we briefly count the calls to certain functions, such as forms, registration and password reset, under a checksum of your IP address. Counter values older than one hour are deleted on an ongoing basis. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is the prevention of abuse.

10Cookies and browser storage

Some functions store information on your device or read it there. Without your consent we do this only insofar as it is strictly necessary for us to provide a service you have expressly requested (§ 25(2) no. 2 TDDDG). Where we ask for your consent (§ 25(1) TDDDG), we say so at the relevant function.

We set these cookies here:

• Session cookie (sign-in): Keeps you signed in after you have signed in or confirmed your registration.
• Device cookie: So that we ask for the code by email only on new devices, it recognises your device after you have signed in with this code or have set it up.
• Registration cookie: Links a registration in progress to your device.
• Language cookie: Remembers the language you choose via the language link or take over from your account at sign-in (zentrana_lang).
• Filter cookies: Remember the filter of a list in the Platform (zentrana_filter_).

Session cookie (sign-in)

Until the browser is closed, 12 hours at most after your last visit; with “Keep me signed in” 30 days after your last visit.

Device cookie

90 days.

Registration cookie

Until 7 days after the confirmation link expires.

Language cookie

10 days.

Filter cookies

Until you sign out or close the browser.

For the session cookie and the device cookie, the legal basis for sign-in and security in the section “Registration and user account” applies; for the registration cookie, the legal basis of the registration in the same section. The legal basis for the language cookie is Article 6(1)⁠(f) GDPR; our legitimate interest is to display the website and the Platform in your language. We process the content of the filter cookies on behalf of the Customer to whose account the list belongs; the section “Processing on behalf of our customers” applies.

Your browser also creates entries in local storage and session storage:

• On the website: the chosen colour scheme as well as trips and inputs in the travel calculator.
• In the Platform: chosen views and filters, collapsed areas, the most recently chosen targets of the command search that it offers you there again, saved form inputs when the session expires, the selection in the order, notices that appear only once, and signals to other open tabs when signing out or switching the account.

Your browser deletes entries in session storage when you close the tab. Entries in local storage remain until you delete them in your browser or the function removes them. Your browser does not send either of them to us on its own. The Platform applies remembered filters again the next time you open the list; we then process the list query like your other inputs on behalf of the Customer.

Camera: To read QR codes, the Platform uses your device's camera when you start reading. The images are evaluated on your device. The basis is § 25(2) no. 2 TDDDG. From the camera image the Platform sends only the code it has read to us; we process it like an input on behalf of the Customer.

Location: If the Customer has set up the location check for clocking in, the Platform first shows you a notice from the Customer. Your browser then asks for permission. By granting it you allow access to your location (§ 25(1) TDDDG).

If you decline, you clock in without a location. You can withdraw the permission in your browser. We process the result on behalf of the Customer; the legal basis on which the Customer processes it is stated in its notice.

11Counting of page views

On our own server we count how often the pages of our website are viewed, without software or scripts from third parties. For this we evaluate the requested address, the page you came from and the browser identifier that your browser sends anyway.

Only daily totals are stored: per page, per website visitors came from, by its name only, and per device type. We do not store the IP address, browser identifier or time of day for this. We store or read nothing on your device for the count.

• Purpose: see which content gets read and how visitors find their way to us.
• Legal grounds: Article 6(1)⁠(f) GDPR. Our legitimate interest is to align the website with actual demand.
• Storage period: We delete the daily totals 400 days after the counted day.

If your browser sends the signal “Global Privacy Control” or “Do Not Track”, we do not count the page view. This is the simplest way to object to the count. Because the totals have no link to you, we cannot subtract an individual page view afterwards.

12Embedded video clips

Some pages show videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). We embed them in two steps: first you only see a placeholder from our server with a notice. Only when you load the video with a click does your browser connect to YouTube, via the address youtube-nocookie.com. In doing so Google receives your IP address and technical details of your browser and can store or read information on your device.

For loading the video and transferring your data to Google we are joint controllers with Google (Article 26 GDPR). Google alone is the controller for further processing. We inform you here about the loading and transfer; Google informs you in its own privacy notices about further processing. You can exercise your rights against us and also against Google.

• Legal grounds: Your consent by clicking (Article 6(1)⁠(a) GDPR, § 25(1) TDDDG). We do not store your choice; each video loads only after your click.
• Third country: Google may also transmit the data to Google LLC in the USA. The basis is the European Commission's adequacy decision on the EU-US data protection framework (EU-US Data Privacy Framework, Article 45 GDPR), under which Google LLC is certified.
• Withdrawal: Your consent applies only to the video you click and only until you leave or reload the page; after that the page shows the placeholder again. If you wish to withdraw it, reload the page and do not load any further video. What Google has stored on your device, you delete in your browser.

13Contact and web forms

You can send us an enquiry through the form under “Contact” and through forms on other pages of our website.

• Data being processed: Name, email address and message are required. Company, phone number, number of employees, modules and a referral code are voluntary. We also store the wording and time of your confirmation in the form, the browser identifier and a hash value of your IP address.
• Purpose: Handle your enquiry, prepare a contract with you and detect automated bulk submissions.
• Legal grounds: Article 6(1)⁠(b) GDPR if you yourself wish to become a contracting party, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is to answer enquiries, prepare contracts with companies and prevent abuse. We store the wording and time of your confirmation in order to be able to prove that you received this information (Article 6(1)⁠(f) GDPR).
• Storage period: We remove the browser identifier and hash value 30 days after receipt. If we do not assign the enquiry to a company, we delete it 6 months after last being worked on. Otherwise we delete it together with the sales file when there has been neither contact nor a new case such as a note or an offer for 6 months. If the company becomes a Customer, the periods in the section “Our business services” apply.

Referral code

If you give a referral code, we assign your enquiry to the partner who referred you. The partner learns your company name, the status of the referral with the times it was recorded, concluded and expires, when you paid an invoice, the net amount of that invoice as the basis of the partner's remuneration and the amount of that remuneration. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to assign and settle referrals correctly.

If no contract results from the referral, we delete the assignment 30 days after the referral period expires or, if we reject the referral later, 30 days after the rejection. If a contract results and remuneration or a benefit rests on the referral, we retain the assignment for 6 years after the end of the calendar year in which we recorded it; otherwise we delete it 1 year after your contract ends.

Further web forms

On individual pages we embed further forms, for example for a demo or a press enquiry. The form shows which details are required. We also store origin details: the page of the form, the name of the website you came from and campaign details from the link. On receipt we store neither your IP address nor your browser identifier. To prevent abuse, the short count from the section “Visiting the website” applies.

For the process we assign a random identifier per transaction, with no details about you. With it we count per form and day how often it was started, abandoned and submitted. If the form provides for it, we send you an acknowledgement of receipt by email.

The legal bases of the contact form apply here. For a press enquiry it is Article 6(1)⁠(f) GDPR; our legitimate interest is to answer enquiries from the media. We use the origin details under Article 6(1)⁠(f) GDPR to see which pages and campaigns actually lead to enquiries.

We delete submissions 6 months after they were sent. We transfer enquiries to our sales beforehand; the periods of the contact form apply there. Of a press enquiry we keep only an internal task with the number of the submission.

Templates by email

If you request a template, we send you a link by email that is valid for 24 hours and can be opened three times. We transfer your request to our sales like an enquiry through the contact form. The legal basis is Article 6(1)⁠(b) GDPR for sending and Article 6(1)⁠(f) GDPR for the transfer to sales. Our legitimate interest is to follow up your enquiry in our sales and to introduce Zentrana to you.

We send you advertising by email only with your consent. You can object to the transfer to sales at any time you like.

14Contact persons at prospective firms

Zentrana is aimed at companies and public bodies. To approach suitable companies, we store business details of their contact persons that we do not receive from you directly. We inform you about this here under Article 14 GDPR.

• Data being processed: Name, role, business contact details, notes on availability, details about the company, the source of the details and notes on our contact.
• Origin: Details that your company has made public itself, for example on its website, and lists of companies that we import as a file. For contacts created earlier, some details come from an imprint. We do not use these contacts for advertising. We retain them only to be able to prove where they come from and that we informed you, and delete them after the period stated below.
• Purpose: Introduce Zentrana to you and initiate a business relationship.
• Legal grounds: Article 6(1)⁠(f) GDPR. Our legitimate interest is direct marketing to companies and public bodies for which Zentrana may be suitable and, for contacts created earlier from an imprint, proof of their origin and of our information.
• Recipients: our web host, for research additionally Anthropic and, when we write to you, our service provider for email sending.
• Storage period: If there has been neither contact nor a new case such as a note or an offer for 12 months, we delete the details. If the company itself has contacted us, the period of 6 months from the section “Contact and web forms” applies. If we hold a signed Data processing agreement (DPA) from the company, we delete them only once it no longer applies. If a business relationship arises, the periods in the section “Our business services” apply.

Research: If we carry out research on a company, we retrieve public pages of its website, such as team, contact or imprint, with a program. A language model from Anthropic PBC, USA (Anthropic) evaluates the text and extracts contact persons with their role, a description of the company, the fit with our modules, possible objections and starting points for a first conversation.

Anthropic receives only these public texts and details about the company that we have already checked, no Customer Data. Anthropic processes them on our behalf; for the third country see the section “Recipients, third countries”.

We adopt a result only after it has been reviewed by an employee. We delete the retrieved text after the evaluation. Results that we do not adopt we delete after 30 days; adopted details we store like the other details on contact persons.

Objection: You can object to this processing at any time without giving reasons. We then delete your details and add your email address to a blocklist so that we do not approach you again. We keep the blocklist as long as your objection applies. If we lift the entry because you want to be approached again, we delete it 3 years after the end of the calendar year in which we lift it. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to respect your objection permanently.

15Registration and user account

Registration: A Customer registers on the website. We process company, first and last name, business email address, the password as a hash value, chosen modules and term, a referral code, and the wording, version and time of your confirmation of the Terms and of having read this statement. To confirm, we send a link by email that is valid for 48 hours. On confirmation we store time, IP address and browser identifier as proof and then set up your access.

• Purpose: Set up your access, prove the registration was made and prevent abuse.
• Legal grounds: Article 6(1)⁠(b) GDPR insofar as you yourself become a party to the contract, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is to prepare the contract with your company and to be able to prove the registration.
• Storage period: If you do not confirm the registration, we delete your details 30 days after the link expires. We delete the other details from the registration together with the Customer Data under § 10 Terms, and the proof of your confirmation 3 years after the end of the calendar year in which your access ends.

Customer account access: The access accounts of contract administrators and of the Users who may manage access and rights for the Customer belong, with name, email address, roles, status and the time of the last sign-in, to the data of the customer account and its contact persons (§ 1 DPA). We are ourselves the controller for this. What these Users process in the Platform remains Processing Data. For each of these access accounts we see whether the invitation has been accepted. The Platform shows us the time of the last sign-in only for these access accounts.

• Purpose: Manage the Customer's account and access accounts, protect them, help with sign-in problems, identify access accounts that nobody uses any more and choose the access for the support view. Beyond that, the time enters only, like the sign-ins of all Users, into the usage metrics (section “Our business services”), and into no other assessment of the Customer.
• Legal grounds: Article 6(1)⁠(b) GDPR insofar as you are a party to the contract yourself, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is then to run the customer account securely and to support the Customer with questions about its access.
• Storage period: We store the time of the last sign-in with the access and delete it with the access, at the latest with the Customer Data under § 10 Terms.

Signing in and security: The Customer sets up access for Users, or we do so at the Customer's request. For sign-in and security we process, for each access, the email address, the password as a hash value, where applicable a second factor, trusted devices and, for each session, IP address, browser identifier and expiry time.

• Purpose: secure the Platform and the access accounts, prevent abuse and determine the number of persons with access for billing. We do not use this data for any further purposes of our own (§ 3 DPA); summarised per Customer, sign-ins and sessions enter only the usage metrics (section “Our business services”). In support we process them on behalf of the Customer.
• Legal grounds: For this data we are ourselves responsible for all access, including access in the customer account. The legal basis is Article 6(1)⁠(f) GDPR. Our legitimate interest is to run the Platform securely and to bill correctly. If you are our contracting party yourself, we additionally rely on Article 6(1)⁠(b) GDPR.
• Storage period: We delete session data 30 days after the session expires. A trusted device is valid for 90 days, after which we delete the entry. If an access belongs to no customer account and no partner account, we delete it 12 months after the last sign-in.

We process the other details on access accounts in the customer account, such as roles and rights, and the change log on behalf of the Customer to whom the account belongs.

We count failed sign-ins under a checksum of email address and IP address, even if there is no access for that address. We are ourselves responsible for this too; the legal basis is Article 6(1)⁠(f) GDPR, our legitimate interest is the defence against attacks. We delete the count one day after the last failed attempt. If we then throttle sign-in to an access in the customer account, we note this with IP address and browser identifier in the change log of that customer account, which we keep on behalf of the Customer.

16Our business services

We process data of our Customers and their contact persons to prepare offers, conclude and perform contracts, bill our services and look after Customers. Data protection and processing on behalf in the contract are governed by § 12 Terms.

• Data being processed: Company details, name, role and business contact details of the contact persons, order, booked modules, term and prices, invoice and payment data, records of acceptance of the Terms and DPA, and our correspondence.
• Origin: from you yourself or from the company for which you are acting.
• Purpose: Preparing, concluding and performing the contract, billing, payment reminders, customer care and meeting legal obligations.
• Legal grounds: Article 6(1)⁠(b) GDPR insofar as you are a party to the contract yourself, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is then to initiate, perform and bill the contract with your company. Article 6(1)⁠(c) GDPR applies to retention obligations.

If you accept the Terms and DPA or object to a new version, we store your name and email address, company and customer number, your declaration, time and version and a hash value of the document, and for a declaration in the Platform also a hash value of your IP address. We form the hash value of the IP address with a secret key. Without that key the address cannot be determined from it. If you send us the DPA on paper or as a scan, we keep the document with the names and signatures as proof.

Payment: If you choose a payment method via Mollie, that is SEPA direct debit, credit card or PayPal, we handle the payment via Mollie B.V., Netherlands (Mollie). For this we transmit to Mollie company name, email address, amount and order number, and for the direct debit mandate also account holder, IBAN, mandate reference and date of signature.

You enter card data directly with Mollie; we do not receive it. For credit card and PayPal you complete the payment on a Mollie page. If you pay with PayPal, PayPal also receives your payment data and processes it under its own responsibility. If you choose purchase on invoice, Mollie receives no payment data from us. The legal basis is Article 6(1)⁠(b) GDPR insofar as you are a party to the contract yourself, otherwise Article 6(1)⁠(f) GDPR; our legitimate interest is to collect the remuneration securely.

If you choose credit card in the payment step of the order, or it is preselected, your browser loads a script from Mollie, and also if, after a payment that was not completed, credit card is chosen or preselected for the retry. In doing so Mollie receives your IP address and technical details of your browser. For other payment methods our page does not load a script from Mollie. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to offer you the selected card payment securely.

Direct debit: For the direct debit we store the mandate with account holder, IBAN, BIC, mandate reference, place and date of signature as well as a hash value of your IP address and your browser identifier. If we collect direct debits ourselves, our bank receives account holder, IBAN, mandate reference and amount. We create invoices ourselves and send them by email.

Billing per person count: On the first of the month we count, for each Customer, the persons with access and, depending on the module, the persons to whom the Customer has issued keys or for whom it has switched on clocking in, even if they have no access. For this we use details from the customer account, such as status, entry and exit of the person, and record with the count which persons we counted.

We are ourselves responsible for this. The legal basis is Article 6(1)⁠(b) GDPR insofar as you are a party to the contract yourself, otherwise Article 6(1)⁠(f) GDPR; our legitimate interest is correct and verifiable billing. We retain the count as a record of the billing (Article 6(1)⁠(c) GDPR).

Use of the Platform: We form usage metrics on the extent and nature of use (§ 5 Terms, § 3 DPA). For this we count, per Customer and service, persons with access, sign-ins, transactions and times of use and summarise them. We do not evaluate content for this, in particular not the type of an absence or other data of special categories (Article 9 GDPR).

We form metrics only for Customers with at least five persons with access, counted as a stock under the same rules as for billing and not by use, and only in such a way that they reveal neither a User nor any other data subject. For this we count access accounts, sign-ins and transactions and store only the results per Customer; we do not rate individual persons for this. What we derive from them, for example that a Customer has not used the Platform for a long time, we relate only to the Customer.

For Customers below this threshold we form no metrics per Customer and derive nothing from sign-in and usage data; they count as not rated with us. In totals across all Customers, only the number of persons with access and details of the contract enter from them. Only figures per Customer and day or month are stored; we do not store times of sign-in of individual persons for these metrics.

With the metrics we support the Customer and offer it suitable further modules. We are ourselves responsible for this. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to support our Customers and to offer them our own services. You can object to this at any time, more on this in the section “Right to object”. We delete daily figures and the number of sign-ins per day after 400 days, monthly figures with the Customer's data.

Testimonial: If we name your company as a Customer (§ 12 Terms), we use its name, its logo and a link to its website. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to advertise with our Customers. You can object to the mention at any time. If the contract ends or you object, we remove the mention within a reasonable period; we do not recall materials already distributed.

Invoices, receipts, counts used for billing

8 years from the end of the calendar year in which they arose, but at the earliest after the contract ends.

Payments and orders

8 years from the end of the calendar year in which they arose, but at the earliest after the contract ends.

Contract, modules, prices and direct debit mandate

6 years from the end of the calendar year in which the contract ends.

Sales file

6 years from the end of the calendar year in which the contract ends.

Records of acceptance of the Terms and DPA

6 years from the end of the calendar year in which the contract ends.

Payment reminders and emails on billing

6 years from the end of the calendar year in which they arose, for Customers but at the earliest after the contract ends.

Deletion records and documented instructions

6 years from the end of the calendar year in which they arose, but at the earliest after the contract ends.

Offers that do not lead to a contract

With the sales file.

Orders that are not carried through to completion

30 days after they expire; we remove the IBAN on expiry.

If a tax assessment period is still open or an audit or a legal dispute is ongoing, we retain the affected documents until it has ended (§ 147(3) sentence 5 AO).

Deletion records and documented instructions serve as proof that we have complied with the DPA (Article 28(3)⁠(h) GDPR). The legal basis is Article 6(1)⁠(c) GDPR insofar as they are commercial letters (§ 257(1) nos. 2 and 3 HGB, § 147(1) nos. 2 and 3 AO), otherwise Article 6(1)⁠(f) GDPR; our legitimate interest is this proof.

17Support and email

If you send us an email or a support request in the Platform, we process your details, the content and attachments to handle your request.

• Legal grounds: Article 6(1)⁠(b) GDPR if it concerns a contract with you, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is to answer enquiries and look after our Customers.
• Recipients: our service provider for email sending.
• Storage period: We delete enquiries from Customers 6 years after the end of the calendar year in which they arose, but at the earliest after the contract ends. We delete enquiries from prospects with their sales file. Closed support requests that we do not assign to a company we delete 6 months after last being worked on. We delete automatic replies and obvious spam after 30 days.

Emails without assignment: We delete incoming emails that are assigned neither to a support request nor to a company or customer account 6 years after the end of the calendar year in which they were received. Without an assignment we cannot rule out that they are received commercial letters (§ 257(1) no. 2 HGB, § 147(1) no. 2 AO).

The legal basis is Article 6(1)⁠(c) GDPR insofar as they are commercial letters, otherwise Article 6(1)⁠(f) GDPR; our legitimate interest is not deleting an email subject to retention too early. We delete emails we sent without assignment that are not business letters 3 years after the end of the calendar year in which they arose.

If we receive a message about the delivery of an email, for example that it was rejected or reported as spam, we store this message for 12 months. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is reliable sending.

Blocklist for mail sending: If an address is permanently rejected or reported as spam, we add it to a blocklist. We use it to check all emails sent via the Platform, including emails on behalf of our Customers; we are ourselves responsible for this.

We keep the entry until the address is deliverable again or you want to receive emails again, and delete it 3 years after the end of the calendar year in which we lift it. The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is to protect the deliverability of our emails and to respect complaints.

Emails that we send out: Of the emails that we and the Platform send out, we keep a copy, for varying lengths of time depending on the type. We do not store codes and links for sign-in in doing so.

• Emails for a customer account: Notifications, receipts for keys, documents that Customers send by email via the Platform, and notices of a support access we delete with the Customer, that is, together with its other data under § 10 Terms. The Platform sends these emails on behalf of the Customer (§ 14 DPA).
• Emails for signing in: Invitations, links to confirm or change an email address, codes for the second factor and links to reset the password we send as the controller, not on behalf of the Customer. The legal basis for sign-in and security in the section “Registration and user account” applies. If we send them to an access account in the customer account, such as an invitation, a link that the Customer requests for you or a code for the second factor, we delete them with the Customer. We delete the others, such as links that you request yourself on the sign-in page or in your account, and codes for an access account without a customer account, 3 years after the end of the calendar year in which we sent them.
• Business letters: We keep emails on orders and contracts as well as on billing as commercial letters, for as long as reminders and billing emails in the overview in the section “Our business services”.
• Emails to partners: The periods for our emails to partners and their attachments begin at the end of the calendar year in which we sent them or, if sending fails, created them. We delete emails with a credit note, a correction document or a clawback together with the document itself, after 8 years at the earliest. The section “Partner programme” applies to emails about an application and to longer retention. We retain the others, such as the monthly status, as commercial letters for 6 years.
• Emails on form requests: We keep the request to confirm consent, acknowledgements of receipt and links to templates in order to be able to prove that you requested them and, where applicable, confirmed consent (Article 7(1) GDPR). The legal basis is Article 6(1)⁠(f) GDPR; our legitimate interest is exactly this proof of ours. If they are assigned to a company in our sales, we delete them with its sales file or, if it becomes a Customer, with the Customer. We delete the others 3 years after the end of the calendar year in which we sent them.

If we arrange an appointment, we send you an invitation with a calendar file and, where applicable, a link to a video call. The provider of the video service named in the invitation is then also a recipient.

18Partner programme

Companies can apply as partners and conclude a partner agreement with us. We process company, name of the contact person, email address, partner type and, voluntarily, website and tax status. For the agreement and billing, address, tax number or VAT identification number, bank details, the accepted agreement and the remuneration are added. If you accept the agreement, we store time, IP address and browser identifier as proof.

We store the wording and time of your confirmation in order to be able to prove that you received this information (Article 6(1)⁠(f) GDPR).

We automatically check referrals for signs of abuse, for example an identical IBAN, address or domain. A flag holds back the remuneration provisionally. Whether it lapses is decided by an employee. You can request that an employee review the flag, and present your point of view.

• Purpose: Review the application, conclude and perform the agreement, settle remuneration by credit note and prevent abuse.
• Legal grounds: Article 6(1)⁠(b) GDPR insofar as you are a partner yourself, otherwise Article 6(1)⁠(f) GDPR. Our legitimate interest is then to run the partnership with your company. Article 6(1)⁠(c) GDPR applies to retention obligations. For the check for abuse Article 6(1)⁠(f) GDPR applies; our legitimate interest is to remunerate only legitimate referrals.
• Recipients: If we create credit notes to partners with Lexware Office (formerly lexoffice), the provider of Lexware Office (formerly lexoffice) processes the credit note data on our behalf; for the third country see the section “Recipients, third countries”.
• Storage period: We delete unconfirmed applications after 7 days and anonymise rejected ones after 6 months, in each case together with our emails about the application. Otherwise we keep the email confirming the application as proof that you confirmed it, and delete it 3 years after the end of the calendar year in which we sent it (Article 6(1)⁠(f) GDPR). We anonymise the partner's details 8 years after the end of the calendar year in which the partnership ends.
• Agreement, credit notes and records: We delete the agreement 6 years after the end of the calendar year in which the partnership ends, but not before the credit notes based on it are deleted. We delete credit notes, correction documents, clawbacks and records of remuneration 8 years after the end of the calendar year in which the last event concerning them took place, such as creation, delivery or payment. As long as a remuneration or a credit note is open, we retain them with the associated records. If a review flag is attached to a remuneration, we retain the remuneration with the paid invoices it is based on for as long as we retain the flag.
• Review flags on referrals: If no contract results from a referral, we delete its review flags with the assignment, 30 days after the referral period expires or a later rejection. If a contract results, we retain them for as long as we are required to retain the credit notes and records of remuneration from this referral, at most 8 years after the end of the calendar year in which the last event concerning it took place, such as the decision on the flag, a remuneration or its payout.

If a tax assessment period is still open or an audit or a legal dispute is ongoing, we retain the affected documents until it has ended (§ 147(3) sentence 5 AO). If an external tax audit or an objection is ongoing, we retain the agreements, credit notes, records and emails of all partners until it has concluded, but not the emails confirming an application; our legitimate interest is not deleting any document that may still be requested for it (Article 6(1)⁠(f) GDPR).

If we are looking into a suspected abuse by a partner, we retain their agreement, their credit notes and records and our log of the emails to them until the review is complete.

19Applications

If we publish a job advertisement, you can apply by email or via the page named in the advertisement. If you apply via a portal named in the advertisement, its operator receives your details.

We process your documents to decide on the employment relationship. The legal basis is Article 6(1)⁠(b) GDPR. If no hiring results, we keep the documents for another 6 months after the rejection in order to defend ourselves against claims under the General Equal Treatment Act (Article 6(1)⁠(f) GDPR), and then delete them.

20Processing on behalf of our customers

Customers process data of their employees, drivers, vehicles, customers and other persons in the Platform. For this Customer Data (§ 1 Terms) the Customer is the controller. We process the personal data within it (Processing Data, § 1 DPA) as a processor under Article 28 GDPR, only on its instruction unless a law obliges us to process, and under the Data processing agreement (DPA) (§ 12 Terms).

The Customer decides which Customer Data is processed, for what purpose, on what legal basis and for how long. If you wish to exercise your rights regarding this data, please contact the Customer. If your request reaches us, we forward it to the Customer where we can identify it.

We access Processing Data only as far as necessary for operation or an order of the Customer, for example for support, fixing a fault or setup. For our own purposes we use from the Platform only what the sections “Registration and user account”, “Our business services” and “Support and email” describe: access, sign-in and session data, the count of persons for billing, the usage metrics and the blocklist for mail sending (§ 3 DPA).

We record every support access via the Platform and retain the record for 3 years after the end of the calendar year in which the access ended. We retain notifications of data breaches for 3 years after the end of the calendar year in which the incident was closed. The legal basis for these records is Article 6(1)⁠(f) GDPR; our legitimate interest is the proof that we have fulfilled our obligations under the Data processing agreement (DPA).

After the contract ends we make the Customer Data available for retrieval for 30 calendar days and then delete it; details are governed by § 10 Terms. The Data processing agreement (DPA) names the sub-processors for Processing Data.

21Automated decision-making and AI

We do not take decisions about you based solely on automated processing where they have legal effect on you or similarly significantly affect you (Article 22 GDPR).

We use a language model for our own purposes only in research on prospects, where we carry it out. It evaluates public details; an employee decides on approaching someone. Review flags in the partner programme only provisionally hold back a remuneration; whether it lapses is decided by an employee.

If even the provisional withholding of a remuneration counts as an automated decision, it is necessary for the partner agreement (Article 22(2)⁠(a) GDPR). It rests on matching details such as IBAN, address or domain. You can then request that an employee review the flag, present your point of view and contest the decision.

22Changes

We adapt this statement when the processing changes or the legal situation requires it. You will always find the current version on this page.

This version dated: 04.11.2026

The entries on earlier versions name the sections according to the structure at that time.