Privacy Policy

1. Privacy at a glance

The following information provides a simple overview of what happens to your personal data when you visit this website or use the OpenEOS platform (web app at app.openeos.de, online shop at shop.openeos.de and documentation at docs.openeos.de). Personal data is any data that can be used to identify you personally.

2. Responsible party

Email: [email protected]

3. Data collection on this website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are: browser type and browser version, operating system used, referrer URL, hostname of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. See sections 4 and 6 for details on processing by our host and by Cloudflare.

Cookies and local storage

This website does not use tracking, analytics, or advertising cookies. Only technically necessary data is used: your language preference is stored via a cookie (NEXT_LOCALE), and your theme preference (light/dark) is stored in your browser's local storage (localStorage). When you use the OpenEOS platform, technically necessary cookies for signing in are added, as well as a cookie (openeos_server) that routes your requests during a session to the same server process; session details and device settings are kept in your browser's local storage. All of this serves solely to provide the website and the platform according to your settings and is not evaluated for analytics or advertising purposes. No separate consent is required for these purely technical purposes (§ 25 para. 2 TDDDG, Art. 6 para. 1 lit. f GDPR).

Contact

If you contact us by email or through a form on this website (e.g. contact, demo request or feedback), we process the information you provide (name, email address, organization if given, and your message) to handle the request and any follow-up questions. Form submissions are stored in our database and reported to us by email through our own mail server (see section 8). Messages you send through the support chat of the OpenEOS platform and the replies from support are also stored in our database; we are notified of new messages by email. Beyond that, we do not pass on this data without your consent. The legal basis is Art. 6 para. 1 lit. b or lit. f GDPR.

Registration and customer account

If you register for the OpenEOS platform or create an organization, we collect and store the account data required to perform the contract (e.g. name, email address and organization details, and the billing address when you place an order). Processing is carried out to fulfil the usage agreement pursuant to Art. 6 para. 1 lit. b GDPR. We only share this data with third parties where this is necessary to fulfil the contract (see sections 8 and 9).

4. Hosting with IONOS SE

The website, the web app, the online shop, the documentation and the programming interface (api.openeos.de) of the OpenEOS platform, including the database, run on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access them, our host automatically collects and stores server logfiles transmitted by your browser (including IP address, date and time of the request, page requested, browser type and version). We have a data processing agreement with IONOS pursuant to Art. 28 GDPR, which obliges IONOS to process the data of our website visitors solely on our instructions and for the contractually agreed purposes, and to protect it appropriately.

5. Backups at Hetzner

Once a day, backups of the database and of the files needed for a restore are transferred, encrypted with AES-256, to a Storage Box of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in a data centre in Germany. They hold the same data as the live system and exist solely to restore service after a failure or a mistake. On the Storage Box, daily backups are kept for 14 days and weekly backups for eight weeks, after which they are deleted automatically. In addition, the two most recent backups remain encrypted on our server at IONOS. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

6. Cloudflare (DNS and upstream service)

Name resolution (DNS) for openeos.de and all its subdomains is provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In addition, Cloudflare sits in front of this website (openeos.de), the web app (app.openeos.de), the online shop (shop.openeos.de) and the documentation (docs.openeos.de): Cloudflare forwards the requests to our server, serves immutable files such as scripts and stylesheets from its cache and fends off denial-of-service attacks. In doing so it processes technically necessary data, in particular your IP address and the address requested. Requests to the programming interface (api.openeos.de) and to the addresses for displays and printers (display.openeos.de, printer.openeos.de) do not pass through Cloudflare but go directly to our server; for these, Cloudflare only answers the DNS query. The legal basis is our legitimate interest in a secure and available service (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare. As Cloudflare is based in the USA, data may be transferred to a third country; this is based on the European Commission's standard contractual clauses and on Cloudflare's certification under the EU-US Data Privacy Framework.

7. Error diagnostics with Sentry

So that faults can be detected and fixed, the servers of the web app (app.openeos.de) and of the programming interface (api.openeos.de) send diagnostic data to Sentry, a service of Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA. If an error occurs while a request is being processed, an error report is created with technical details about the event: the address requested, details from the request (e.g. browser and operating system), the time and, where applicable, your IP address; if you are signed in, error reports from the programming interface also contain your user ID and email address. In addition, performance data on requests to these servers (address requested, course and duration of processing) is sent even when no error occurs. No data is sent to Sentry from your browser, and your sessions are not recorded. The data is stored in Sentry's EU data region. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR). A data processing agreement is in place with Sentry. As Sentry is based in the USA, data may be transferred to a third country; this is based on the European Commission's standard contractual clauses.

8. Sending email

Emails from the OpenEOS platform (e.g. sign-in and confirmation codes, invitations, notifications, messages about volunteer shifts and order confirmations from the online shop) are sent through our own mail server, which also handles emails you send to addresses at openeos.de. The mail server is operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Finland (EU). Sender and recipient addresses, subject and content of the message are processed. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for inquiries and notifications. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

9. Payment with Stripe

If an event is activated by card or direct debit, payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For this purpose we transmit to Stripe the name of the organization, the billing email address (or, if none is set, the email address of the user placing the order), the amount, a description of the service and internal identifiers of the organization and the event. You enter your payment details (e.g. card or account details) directly on Stripe's payment page; they are not transmitted to us. Stripe also creates the invoice, which you can retrieve in your customer account. The legal basis is Art. 6(1)(b) GDPR. Stripe may also transfer data to Stripe, Inc. in the USA and bases this on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses. For more information, see Stripe's privacy policy at https://stripe.com/privacy.

10. Data of guests and volunteers; card payments with SumUp

Organizations use the OpenEOS platform to take their guests' orders (at the till or through the online shop) and to plan their volunteer shifts. The respective organization is responsible for this data – e.g. orders; for online shop orders, your email address and, if given, your name for the order confirmation; for volunteers, name, email address and shifts – and we process it on its behalf (Art. 28 GDPR). If an organization has connected its own SumUp account, card payments at the till and in the online shop are processed through SumUp. The platform only transmits the amount, currency, a description and a transaction reference to SumUp; you enter your card details directly on the card terminal or on SumUp's payment page. The respective organization is responsible for these payments; you can obtain information about data processing from it.

11. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests you send to us as the site operator, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the address line of your browser changes from „http://“ to „https://“ and by the lock icon in your browser's address bar.

12. Storage duration

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. We delete contact inquiries once they have been fully processed, provided no statutory retention obligations apply. Data from a customer account is stored for the duration of the contractual relationship and beyond, in accordance with commercial and tax law retention periods (generally 6 or 10 years).

13. Your rights

You always have the right to: • Receive information about your data stored by us • Have this data corrected or deleted • Restrict processing • Object to processing • Receive your data in a transferable format • File a complaint with a supervisory authority

14. Changes

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.