Privacy policy

1. Scope

This policy explains the processing of personal data on toolvect.app and in connection with enquiries, licence administration, invoicing and payments. The service is intended for business customers.

2. Controller

Andrej Morasch

Weingartenstr. 4

77654 Offenburg, Germany

Email: andrej.morasch@toolvect.app

3. Hosting and visitor statistics

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, under a data processing agreement. Visits involve processing your IP address, time, requested page or file, any referrer and browser, operating system and device details. This serves delivery, security and troubleshooting under Article 6(1)(f) GDPR; these purposes constitute my legitimate interests.

According to IONOS, Webhosting visitor data are anonymised upon collection and stored for eight weeks; these data are not transferred outside the EU.

Visitor statistics using IONOS WebAnalytics

IONOS WebAnalytics is used to analyse and improve the website. According to IONOS, collection uses logs or pixels without cookies; IP addresses are immediately anonymised. Insofar as personal data are processed, the basis is Article 6(1)(f) GDPR. The legitimate interest is improving the website.

4. Cookies, language selection and local content

The website itself sets no cookies. Language selection uses the page address and is not stored on your device. Images and stylesheets are served by our own web server.

5. Contact and email

When you contact me by email or telephone, I process your contact details, messages and attachments to respond to enquiries, prepare contracts and provide support. Email is processed through IONOS and locally on my computer.

The basis is Article 6(1)(b) GDPR if you are or wish to become the contracting party yourself. For company representatives and other enquiries, Article 6(1)(f) GDPR applies; the legitimate interest is appropriate business communication.

Completed enquiries without a subsequent contract are deleted when no longer needed, at the latest six months after final handling. Retention duties and legal claims described in section 9 remain unaffected.

6. Licence administration and hardware ID

To administer licences, I process company name, contact person, email address, licence key and validity period, and the hardware ID for device-bound subscriptions. The ID is generated or read on your device and sent by you by email to create the licence key. These data are stored in licence administration and the associated email correspondence.

The basis is Article 6(1)(b) GDPR for individual contracting parties, otherwise Article 6(1)(f) GDPR. The legitimate interest is assigning and administering company licences.

On renewal, the necessary assignment is retained. After an unrenewed licence expires, unnecessary assignments, hardware IDs and licence keys are deleted at the next monthly review, including unnecessary emails and backup copies. Section 9 remains applicable.

Providing contact and licence data is not a statutory requirement, but is necessary for the respective enquiry or service. Without necessary information, I cannot handle the enquiry or provide the licence.

7. Factual update information

Users and contacts with a valid licence receive factual emails about included updates. Within the same company, business recipient addresses may be visible to the participants who know each other where necessary for coordination.

The basis is Article 6(1)(b) GDPR for individual contracting parties, otherwise Article 6(1)(f) GDPR. The legitimate interest is providing information about the ongoing contractual service. Recipients are removed when their responsibility or licence ends.

8. Invoicing and payments: Accountable and Swan

For invoicing, email delivery and bookkeeping, I use Accountable SA, Square Victoria Régina 1, 1210 Saint-Josse-ten-Noode, Brussels, Belgium, as a processor. The data comprise company name, billing address, contact person, email address, VAT ID and invoice data.

Payments are made through my business account with Swan SAS, 91 rue du Faubourg Saint-Honoré, 75008 Paris, France. Payer name, IBAN, amount, booking date and payment reference are processed for payments and reconciliation with Accountable. Swan acts as an independent controller for its payment services and statutory duties.

The bases are Article 6(1)(b) GDPR for individual contracting parties, Article 6(1)(f) GDPR for transactions involving company contacts, and Article 6(1)(c) GDPR for statutory bookkeeping and retention duties. See section 9 for retention periods.

9. Retention of business records

Where legally required, invoices and accounting vouchers are retained for eight years, commercial and business correspondence for six years, and books and annual accounts for ten years, in particular under section 147 AO and, where applicable, section 257 HGB. Periods generally start at the end of the relevant calendar year. Statutory extensions remain applicable.

Data necessary for specific legal claims are retained under Article 6(1)(f) GDPR until no longer needed to establish, exercise or defend those claims. Data no longer needed are then deleted.

10. Download log

To assess demand for the software, the date, time and file name are recorded when the download link is requested. The log contains no IP address or visitor identifier and is not linked to customer data or personal server logs. It counts requests, not completed installations.

On each download request, entries older than twelve months are aggregated into monthly counts per file and their individual timestamps are removed. Monthly totals are retained for long-term comparisons.

Section 3 applies to technically necessary connection data. Insofar as personal data are processed, the basis is Article 6(1)(f) GDPR; the legitimate interest is assessing demand for the software.

11. Recipients and international processing

Recipients are the service providers named above and their necessary subprocessors, participating payment providers and authorities where disclosure is legally required.

Accountable lists, among others, Postmark in the USA for transactional emails and Orca Security in Israel for cloud security in its data processing agreement. For third-country transfers, the agreement provides for mechanisms under Chapter V GDPR, in particular adequacy decisions or EU Standard Contractual Clauses. The current subprocessor list is available at https://www.accountable.de/avv/. Information and copies of the safeguards used are available via my contact address.

Swan describes its processing as an independent controller at https://www.swan.io/privacy-policy.

12. Your rights

Subject to the applicable statutory conditions, you have the following rights:

• Access to information about the processing of your personal data (Article 15 GDPR).

• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).

• Erasure of personal data (Article 17 GDPR).

• Restriction of processing (Article 18 GDPR).

• Data portability, in particular where processing is carried out by automated means and is based on consent or a contract (Article 20 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn (Article 7(3) GDPR).

Right to object under Article 21 GDPR

Where personal data are processed on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Processing will then stop unless compelling legitimate grounds can be demonstrated which override your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.

To exercise your rights, please contact andrej.morasch@toolvect.app.

13. Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. In particular, the following authority is relevant to the controller's location:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg) Postfach 10 29 32, 70025 Stuttgart, Germany Website and complaints: www.baden-wuerttemberg.datenschutz.de/beschwerde/

14. Automated decisions

I do not make solely automated decisions with legal or similarly significant effects under Article 22 GDPR or use profiling for that purpose.