Privacy Policy

1. Controller and Data Protection Officer

1.1. Name and Contact Details of the Controller

The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection provisions is:

MSc eData Verwaltungsgesellschaft (haftungsbeschränkt) UG Feuerbachstr. 56 12163 Berlin

1.2. Contact Details of the Contact Person

The controller is not legally obliged to appoint a data protection officer. For data protection matters, the management is available as your contact:

Michael Schütz kontakt@zertio.de

2. General Information on Data Processing

2.1. Legal Basis for Processing Personal Data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis for the processing of personal data. For the processing of personal data for the purpose of performing a contract, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for pre-contractual measures. Where processing of personal data is necessary to comply with a legal obligation (e.g. statutory retention obligations) to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. Where vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. If the processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

2.2. Data Erasure and Retention Period

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws or other provisions to which our company is subject (e.g. statutory retention periods). Data will also be blocked or erased when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for conclusion or performance of a contract. In the event of legal disputes, special legal provisions may require a longer retention period, such as compliance with statutory limitation provisions. According to §§ 195 et seq. of the German Civil Code (BGB), the regular limitation period for claims is between one and three years, but may also be up to thirty years.

3. Provision of the Website and Creation of Log Files

3.1. Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information in log files from the computer system of the accessing computer. The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's Internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website
• Websites accessed by the user's system via our website
• User ID (for websites where a login has occurred)

The data contained in the log files (e.g. IP addresses, user ID) allow attribution to a user. Personal data may also be processed, for example, if the link to the website from which the user reaches our website, or the link to the website to which the user switches, contains personal data.

3.2. Purpose of Data Processing

The processing of the above-mentioned data takes place,

• to enable the use of the website from a technical standpoint
• to authenticate and authorize a user for the use of the website (e.g. when using paid online offerings)
• to generate pseudonymous usage statistics for us and our users (e.g. evaluation of usage for optimization and marketing purposes, in particular for product improvements)
• to legally document any contract conclusions and consents
• to prevent data misuse and for the investigation of criminal offences

3.3. Legal Basis for Data Processing

The legal basis for the - temporary - storage of data in log files is Art. 6(1)(b) GDPR. To this extent, we fulfil the contract for use of the website existing with the user - including free offerings. We also process the data to safeguard our legitimate interests pursuant to Art. 6(1)(f) GDPR in order to provide you with the website/product technically. Our legitimate interest consists in being able to provide you with an appealing, technically functioning, user-friendly and secure website/product. The legal basis for documenting a contract conclusion or consent is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR respectively. Our legitimate interest lies in proper documentation of the contract conclusion/consent in order to be able to prove consent or contract conclusion in the event of a dispute. Insofar as we process the data for the purpose of creating pseudonymous usage statistics, the legal basis is Art. 6(1)(f) GDPR. In this respect, our interest in understanding user behaviour and the resulting possibility of continuous optimization of our offerings outweighs the fundamental rights and freedoms of the users. In the balancing exercise, the categories of data processed (IP address, user ID) and their pseudonymous processing were taken into account in particular. Also considered was the fact that the processing is necessary to achieve the purpose — which potentially also serves the user.

3.4. Duration of Storage

The data will be deleted as soon as it is no longer required to achieve the purpose of its collection. In the case of data collection for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after no later than ninety days. No storage beyond this takes place. In this case, the users' IP addresses are deleted or anonymized so that it is no longer possible to assign them to the accessing client.

3.5. Possibility of Objection

The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of the website. Consequently, there is no possibility of objection on the part of the user. The user may object at any time to the processing of the data for the purpose of creating anonymous usage statistics.

4. Use of Cookies

This website uses cookies to ensure its technical functionality, enable an optimized user experience and ensure the operation of the website in accordance with the applicable data protection regulations. The cookies used are predominantly to be classified as essential cookies, as they are absolutely necessary for the operation of this website.

The following presents the cookies used on this website in detail, including their name, purpose, storage duration and classification:

1. sb-[project]-auth-token (Supabase)

   • Purpose: Stores the authentication token after successful login; enables access to protected areas of the platform.
   • Storage duration: Until logout or refresh token expiry
   • Type: Essential

2. last_activity

   • Purpose: Stores the timestamp of the last user activity; used for automatic logout after prolonged inactivity.
   • Storage duration: 24 hours
   • Type: Essential

3. NEXT_LOCALE

   • Purpose: Stores the language selected by the user for consistent display of the platform.
   • Storage duration: 12 months
   • Type: Functional

The processing of these cookies takes place on the basis of Art. 6(1)(f) GDPR, insofar as they are necessary to ensure the technical and security-related functions of the website. For all other types of cookies that are not essential, processing takes place exclusively on the basis of express consent pursuant to Art. 6(1)(a) GDPR.

5. Information on Specific Services and Website Features

5.1 Email Contact and Contact Forms

As part of this website, we offer a contact form as well as an application page (career/unsolicited application). We process the personal data transmitted via these functions exclusively for the purpose of handling your inquiry or carrying out the application procedure. The contact form processes the data you provide, such as name, email address, telephone number, subject and message. In the context of applications, we process the information you submit, such as name, address, contact details, CV, certificates, cover letter and other attached documents. The processing of data takes place on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) and, where applicable, Art. 6(1)(f) GDPR (legitimate interest). § 26 BDSG additionally applies to the application procedure. Your data from the contact form will be deleted after processing your inquiry, unless statutory retention obligations exist. Applicant data will be deleted no later than six months after completion of the procedure, unless you have expressly agreed to longer storage. Transmitted data will only be disclosed if this is necessary for processing or if a legal obligation exists. Your data is transmitted via an encrypted connection (SSL/TLS) to ensure the security of your personal data.

5.2 Reach Measurement with Umami

To measure the reach of this website we use Umami, a web analytics service provided by Umami Software, Inc., USA. Data is collected and stored on servers within the European Union, and a data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Umami works without cookies and assigns no cross-site identifiers. The data recorded is aggregated: the pages visited, the referring page, the region at country level, device type, browser, operating system and screen size. This data is not combined with your user account, and no personal usage profiles are created. The legal basis is Art. 6 (1) sentence 1 lit. f) GDPR; our legitimate interest lies in the statistical evaluation of usage in order to improve our service. You may object to this collection at any time; the objection is stored in your browser only and therefore applies to this device and this browser.

6. Compliance with Legal Requirements

We also process your data to comply with legal requirements. We are subject to a variety of legal obligations. Primarily these are legal requirements (e.g. from commercial and tax laws), but also regulatory or other official requirements where applicable. These include in particular the fulfilment of tax control and reporting obligations as well as archiving and documentation obligations. The legal basis for the processing is Art. 17(3)(b) GDPR and Art. 6(1)(c) GDPR.

7. Legal Enforcement and Defence

We may also process your personal data in order to assert our rights and enforce our legal claims and/or to defend ourselves against legal claims and/or insofar as this is necessary to defend against or prosecute criminal offences. The legal basis for the processing is Art. 17(3)(e) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in legal enforcement and defence.

8. Recipients of Personal Data

We share your data to the necessary extent with service providers engaged by us who support us in providing our services.

8.1. Categories of Recipients

Below we name the categories of recipients of your data. These are in particular:

• IT service providers, who e.g. store data and support us in administering and maintaining IT systems;
• Logistics service providers, e.g. to deliver packages;
• Payment service providers/banks;
• Public bodies and institutions, insofar as we are legally obliged to do so.

Furthermore, your personal data will also be passed on to our affiliated companies within our globally active group, insofar as these in particular act as processors for us and, for example, provide IT services or insofar as this is necessary for the provision of our services. The exchange takes place insofar as this data is lawful for the fulfilment of our contractual and legal obligations or on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. These may be economic, administrative or other internal business administrative purposes; this only applies insofar as your interests or fundamental rights and freedoms requiring the protection of personal data do not override them.

8.2. Third Country Transfer

As part of the use of certain listed tools, your personal data will also be transferred to a third country in compliance with the requirements of Art. 44 et seq. GDPR. Where service providers in a third country are used, they are generally obliged to comply with the EU level of data protection through the agreement of the EU Standard Contractual Clauses (where necessary in conjunction with additional safeguards) of the European Commission. The Standard Contractual Clauses are freely available on the website of the European Commission. Despite these contractual and technical measures, it may happen that the level of data protection in the third country does not correspond to that of the European Union. The legal basis for the international data transfer that then takes place is your consent pursuant to Art. 49(1)(a) GDPR, which you grant via the consent in the cookie banner (or other forms, registrations etc.). There is above all the risk, especially in the event of a data transfer to the USA, that your personal data may be processed by authorities for control and surveillance purposes, possibly without adequate legal remedies, without us as the data exporter or you as the data subject being aware of this.

9. Automated Decision-Making in Individual Cases / Profiling

We process personal data for the creation of customer profiles for the purpose of optimizing marketing activities, offers and services. Processes involving automated decision-making / profiling that have a legal effect on you or similarly significantly affect you are not used by us.

10. Obligation to Provide Data

You only need to provide the data required for the business relationship with us or which we are legally obliged to collect. Without this data we will not be able to enter into a business relationship with you or provide our services. Personal data that we inevitably need for the stated purposes are marked as such. All voluntarily provided data are processed on the basis of your consent pursuant to Art. 6(1)(f) GDPR and/or Art. 6(1)(f) GDPR. Our legitimate interest lies in the further development of our products and services.

11. Your Rights as a Data Subject

Pursuant to Art. 15 GDPR you have the right to obtain information about the data stored on your person including any recipients and the planned storage duration. Should incorrect personal data be processed, you have a right to rectification pursuant to Art. 16 GDPR. If the legal requirements are met, you may request erasure or restriction of processing as well as lodge an objection to the processing (Art. 17, 18 and 21 GDPR). In the event that the requirements of Art. 20(1) GDPR are met, the data subject has the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to yourself or to third parties. You may revoke consent declarations you have given under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

If you are of the opinion that the processing of your personal data violates data protection law, you have the right pursuant to Art. 77(1) GDPR to complain to the supervisory authority responsible for us. Please contact

Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstraße 219 10969 Berlin Telephone: +49 (0) 30 13889-0 Email: mailbox(at)datenschutz-berlin.de Website: https://www.datenschutz-berlin.de

You have the right to revoke your consent declaration under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

12. Information on Your Right to Object, Art. 21 GDPR

You have the right, at any time, to object to the processing of your data carried out on the basis of Art. 6(1)(f) GDPR (data processing on the basis of a balancing of interests) or Art. 6(1)(e) GDPR (data processing in the public interest), if there are grounds arising from your particular situation. This also applies to profiling based on these provisions within the meaning of Art. 4(4) GDPR. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If in individual cases we also process your personal data for direct marketing purposes, you have the right at any time to object to the processing of personal data concerning you for the purpose of such advertising; this also applies to any profiling insofar as it is connected with such direct marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for those purposes.