Privacy

1. Controller and contact

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Deutschesoft AG, Bismarckstraße 100, 41061 Mönchengladbach, Germany, represented by the Management Board, Jinson Franz Kallumadikal.

Telephone: +49 176 5540 2255 · Email: kontakt@deutschesoft.de

Data protection officer: We have not appointed a data protection officer, as the statutory requirements for this (Art. 37 GDPR, section 38 BDSG) are not met. For data protection questions, please use the contact details above.

2. Overview: which data is processed and when

Personal data is any information that can be used to identify you personally. On this website we process data in the following situations:

• whenever a page is accessed: technical connection data in server log files (section 4);
• when you submit a project enquiry: the details you enter in the form (section 6);
• when you contact us by email or telephone: your contact details and your message (section 7);
• after you make your cookie choice: only that choice itself, stored in your browser (section 8).

We process your data in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). We do not sell data and currently use no analytics, tracking or marketing services.

3. Hosting by Emergent

Provider: This website, including the database for project enquiries and the sending of notification emails, is operated on the platform of Emergent (Emergent Labs, https://emergent.sh).

Purpose and legal basis: We use the provider in our legitimate interest in a secure, fast and reliable provision of our website (Art. 6(1)(f) GDPR) and, where project enquiries are concerned, to take pre-contractual steps (Art. 6(1)(b) GDPR).

Data processing agreement: A data processing agreement pursuant to Art. 28 GDPR is or will be concluded with the hosting provider. The provider processes your data only on our instructions and only to the extent necessary to provide its services.

Server location and third-country transfers: The provider is based in the USA; processing of data in the USA or other third countries therefore cannot be ruled out. Any such transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider or its sub-processors are certified, and otherwise on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4. Server log files

Each time you access the website, your browser automatically transmits information that is stored in server log files:

• IP address
• date and time of access
• page or file requested and HTTP status code
• browser type and version, operating system
• referrer URL (the previously visited page), if transmitted

This data is used for the technically error-free delivery, stability and security of the website, for example to defend against attacks and misuse of the enquiry form. The legal basis is Art. 6(1)(f) GDPR. It is not combined with other data sources. Log files are stored only as long as necessary for these purposes and then deleted; for abuse protection we additionally keep the IP address briefly in memory (no longer than 10 minutes).

5. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. When encryption is active, the data you send to us cannot be read by third parties.

6. Project enquiry form

Data processed: Name, email address, company (optional), requested service, the selected starting package if any, your project description, your confirmations (business enquiry, acknowledgement of this notice), the page language, and the time and reference number of the enquiry.

Storage and forwarding: Your enquiry is stored in this website's database and forwarded as an email notification to kontakt@deutschesoft.de so that we can process it. It is only passed on to third parties where this is necessary for processing (section 10) or required by law.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to concluding or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling business enquiries). Confirming that you have read this notice is not consent.

Spam protection: To protect against automated submissions we use an invisible field and a limit on enquiries per IP address and per email address. No external captcha service is used.

Retention: We delete enquiries once they have been fully processed and no contract results, at the latest after 24 months. If a contract is concluded, the statutory retention periods apply (section 257 HGB, section 147 AO: up to 10 years).

A draft that has not yet been submitted is kept only in the memory of the open page and is removed when you reload or close it.

7. Contact by email and telephone

If you contact us by email or telephone, we process your contact details and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests and otherwise Art. 6(1)(f) GDPR. Retention follows section 6.

8. Cookies and consent

Strictly necessary: Only your cookie choice itself is stored – in your browser's local storage (localStorage), together with the date and version of the choice. Without it we would have to ask you again on every page. This storage is strictly necessary under section 25(2) no. 2 TDDDG and does not require consent; the legal basis for the related processing is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent). The choice is not transmitted to us.

Statistics and marketing: Services in these categories are only loaded with your explicit consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR) and are technically blocked until then. No services are currently used in these categories; if this changes, we will list them here and in the settings window and ask you again.

Validity and withdrawal: Your choice is valid for 12 months; after that, or when new categories or services are added, we will ask again. You can change your choice or withdraw your consent with effect for the future at any time via the "Cookie settings" link in the footer (Art. 7(3) GDPR). Deleting the site data in your browser also removes the choice.

9. Locally hosted fonts and content

Fonts and icons are hosted locally on our server. No connection to Google Fonts or other external providers is made when the website loads. We do not embed videos, maps, social media plugins or other third-party content.

10. Dedicated Remote Teams and transfers to India

Deutschesoft AG carries out IT consulting and software projects, including in the Dedicated Remote Teams model, with IT specialists and partners in India.

Project initiation: To assess an enquiry we share, where possible, only anonymised technical requirement profiles. We transfer personal data only when this is necessary to initiate or carry out the project (Art. 6(1)(b) GDPR).

Third country without adequacy decision: There is no European Commission adequacy decision for India. Transfers are therefore based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by technical and organisational measures such as encrypted transmission, role-based access and confidentiality agreements.

You can request a copy of the Standard Contractual Clauses using the contact details above.

11. No automated decisions, no profiling

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. Form data is not sent to any AI service. Providing your data is neither legally nor contractually required; without the mandatory form fields, however, we cannot process your enquiry.

12. Your rights

Within the scope of the statutory provisions you have the right at any time to:

• access the data we hold about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR);
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

www.ldi.nrw.de

13. Retention overview and changes

• server log files: only as long as necessary for operation and security;
• abuse protection (IP address in memory): no longer than 10 minutes;
• project enquiries without a contract: until fully processed, at the latest 24 months;
• contract-relevant documents: statutory retention periods of up to 10 years;
• cookie choice in your browser: 12 months or until you delete or change it.

We update this privacy notice when the website, our services or the legal situation change. The version published here applies.