1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is Californium GridFlow GmbH, Loschwitzer Straße 1, 01309 Dresden, represented by the Managing Director André Latarius. For all data protection matters, you can reach us at info@ea-powertools.com.
2. General information on data processing
We process personal data of our users only to the extent necessary to provide a functional website as well as our software and services, or where another legal basis under Article 6(1) GDPR exists. Personal data are erased or restricted as soon as the purpose of storage ceases to apply and no statutory retention obligations prevent erasure.
Our services are directed exclusively at businesses. The processing described below therefore generally concerns personal data of contact persons, employees and users of our business customers as well as visitors to our website.
3. Hosting and server log files
(1) Our website and our software are operated by an external cloud infrastructure provider in data centres within the European Union (EU region). We have concluded a data processing agreement with the provider pursuant to Article 28 GDPR. The service providers currently used are listed in our sub-processors list at www.ea-powertools.com/subprozessoren. Where access from a third country cannot be entirely ruled out, appropriate safeguards within the meaning of Articles 44 et seq. GDPR are in place (EU Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework).
(2) Each time our website and our software are accessed, the system automatically collects data and information from the computer system of the accessing device: IP address, date and time of access, page or function accessed, amount of data transferred, browser type and version, operating system and referrer URL. Processing is carried out to deliver content, to ensure the security and stability of our systems and for error analysis. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the purposes stated above. Log files are deleted or anonymised after no more than 30 days.
4. Registration and customer account
(1) Use of our software requires the creation of a customer account. In doing so, we process the data requested during the registration process, in particular name, business email address, company and role as well as the password you choose (stored exclusively as a cryptographic hash).
(2) Processing is carried out for the establishment, performance and settlement of the user agreement. The legal basis is Article 6(1)(b) GDPR. Where user accounts are created for employees of our business customers, processing is based on our legitimate interest in performing the contract with the business customer (Article 6(1)(f) GDPR) or on behalf of the customer as processor.
(3) Customer account data are stored for the duration of the contractual relationship and deleted after the end of the contract in accordance with the agreed periods, unless statutory retention obligations prevent deletion (in particular Sections 147 AO, 257 HGB: six or eight and ten years for business records).
5. Project data in the software
Where you as a customer store project data in our software that contain personal data (e.g. names of contact persons), we process these data exclusively on your behalf as a processor pursuant to Article 28 GDPR. The basis is the data processing agreement concluded with you, available at www.ea-powertools.com/avv. You as the customer remain the controller for these data.
6. Contract performance, invoicing and payment service providers
(1) To process paid subscriptions, we process contract, invoice and payment data (company name, billing address, VAT ID, contact person, selected plan, payment information). The legal basis is Article 6(1)(b) GDPR as well as Article 6(1)(c) GDPR with regard to commercial and tax law retention obligations.
(2) For payment processing, we use external payment service providers, in particular Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. The data required for payment processing (e.g. means of payment, amount, invoice data) are transmitted to the payment service provider. The payment service provider is in part independently responsible under data protection law for processing payment data; its privacy notices apply in addition. Transfers to third countries (in particular to Stripe Inc., USA) are based on appropriate safeguards pursuant to Articles 44 et seq. GDPR. The legal basis for the transfer is Article 6(1)(b) GDPR.
7. Contact and support
When you contact us by email, via a contact form or via our support/ticket system, we process the data you provide (name, email address, enquiry, and where applicable company) in order to handle your request. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contractual relationship; otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries). The data are deleted once the enquiry has been conclusively handled and no statutory retention obligations prevent deletion.
8. Cookies and consent management
(1) Our website and software use cookies and similar technologies. Technically necessary cookies (e.g. for login, session management and security functions) are used on the basis of Section 25(2) No. 2 TDDDG as well as Article 6(1)(b) and (f) GDPR.
(2) Non-essential cookies and technologies (in particular for analytics purposes, see section 9) are used only with your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). We obtain your consent via a consent banner on your first visit to the website. You may withdraw your consent at any time with effect for the future via the cookie settings.
9. Product and web analytics with PostHog
(1) Where you have given consent, we use PostHog, a product and web analytics service of PostHog Inc., on our website and in our software. Processing takes place on PostHog Cloud EU (data centres in the European Union, currently Frankfurt am Main). PostHog uses cookies and similar technologies only after consent; until then, or if you decline, a cookieless mode may be used that does not store PostHog data in cookies or local storage on your device.
(2) We configure PostHog without collecting IP addresses and without session recordings. We analyse aggregated usage events (e.g. page views, feature usage, conversion steps) in order to improve our products. We do not transmit COMTRADE file contents, project content or payment data to PostHog. Where you are logged in and have consented, we may link events to your internal user ID.
(3) The legal basis for processing is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings of our website. Analytics data are deleted or anonymised in accordance with our retention settings in PostHog (as a rule no later than 14 months). Further information is available in PostHog’s privacy policy at posthog.com/privacy.
10. Recipients of data
Within our company, only those departments that need your data to fulfil the purposes stated above are granted access. External recipients include in particular: our cloud/hosting provider (section 3), payment service providers (section 6), PostHog (section 9) and, where required, tax advisors, lawyers and public authorities in the context of statutory obligations. We have concluded agreements with processors pursuant to Article 28 GDPR.
11. Your rights as a data subject
Subject to the statutory requirements, you have the following rights: the right of access (Article 15 GDPR), to rectification (Article 16 GDPR), to erasure (Article 17 GDPR), to restriction of processing (Article 18 GDPR), to data portability (Article 20 GDPR) and the right to withdraw consents given with effect for the future (Article 7(3) GDPR).
Right to object (Article 21 GDPR): Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object to processing at any time on grounds relating to your particular situation.
To exercise your rights, an email to info@ea-powertools.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The supervisory authority responsible for us is the Saxon Commissioner for Data Protection and Transparency (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden.
12. Automated decision-making
Automated decision-making including profiling pursuant to Article 22 GDPR does not take place.
13. Changes to this Privacy Policy
We will adapt this Privacy Policy as soon as changes to our data processing or to the legal situation so require. The current version is available at www.ea-powertools.com/datenschutz.