1. Controller
Bytekontor GmbH
Bleicherwiesen 14
31224 Peine
Germany
Email: [email protected]
Data protection contact: [email protected]
2. Scope and roles
This Privacy Policy applies to the website, the administration interface for Mobile Joe Customers ("Dashboard"), Customer accounts, subscriptions, support and business contacts. Bytekontor determines the purposes and means of these processing operations.
3. Website and technical delivery
When the website or Dashboard is accessed, the systems used process technical request data. This may include the IP address, time, target address, HTTP method, status code, volume of data transferred, referrer, user agent, request ID and security events.
Bytekontor processes this data to deliver the website and Dashboard, defend against attacks, investigate errors and demonstrate secure operation. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of the Service.
Cloudflare processes network data, including IP addresses and security assessments derived from them, also for its own security and operational purposes as an independent controller. Further information, including the retention criteria, is available in the Cloudflare Privacy Policy.
4. Customer account and login
When a person registers and uses the Dashboard, Bytekontor processes:
- email address;
- password hash and email verification status;
- account, plan and time information;
- session identifier, IP address and user agent;
- app title, website address, configurations and API key metadata.
If the data subject is a party to the contract, the processing serves to enter into and perform the contract under Article 6(1)(b) GDPR. For employees or other representatives of a business Customer, it is based on Article 6(1)(f) GDPR. The legitimate interest is entering into, administering and performing the contract with the Customer.
An email address and password are required to create an account. Without this information, Bytekontor cannot provide a Customer account.
5. Subscription and payment
Bytekontor processes the plan, trial period, subscription status, and Stripe customer and subscription identifiers. Payment data is collected in Stripe Checkout or the Billing Portal. Bytekontor receives from Stripe only the information required for the subscription, invoice and payment status.
The legal basis is Article 6(1)(b) GDPR if the data subject is a party to the contract. For representatives of a business Customer, Article 6(1)(f) GDPR applies; the legitimate interest is billing under the contract and payment processing. Processing under tax and commercial law is based on Article 6(1)(c) GDPR.
Stripe processes data on Bytekontor's behalf for technical payment processing and, in particular, as an independent controller for fraud prevention and compliance with its own legal obligations. Further information is available in the Stripe Privacy Policy.
6. Email, contact form, support and business contacts
Bytekontor processes contact details, content, attachments and transmission metadata when a person requests support, initiates a business relationship or receives a service email. An email address and message are required in the contact form so that Bytekontor can process and respond to the request.
Article 6(1)(b) GDPR applies to requests for entering into or performing a contract with the data subject. In other cases, processing is based on Article 6(1)(f) GDPR; the legitimate interests are responding to requests, Customer support, troubleshooting and business communication. Communications required by law are based on Article 6(1)(c) GDPR.
Transactional emails are sent through Amazon SES in Frankfurt, Germany.
7. Newsletter and product information
For newsletters and promotional product information, Bytekontor processes the email address, information about the sign-up or Customer relationship, and data relating to sending, unsubscribing and delivery errors. EmailOctopus manages the distribution lists and campaigns; Amazon SES sends the emails.
EmailOctopus may transfer a verification value derived from the email address to companies in the Automattic group to display a contact image made publicly available through Gravatar. To the extent that this comparison involves personal data, it is based on Article 6(1)(f) GDPR. The legitimate interest is the well-organised management of the distribution list.
Emails are sent with prior voluntary and explicit consent under Article 6(1)(a) GDPR and section 7(2) no. 2 UWG. Newsletter sign-up is possible independently of a paid subscription, including during the trial period and after a subscription has ended. Bytekontor also informs existing Customers about its own similar products or services based on section 7(3) UWG. For this purpose, Bytekontor must have obtained the address in connection with a sale and no objection may have been made. The right to object is indicated when the address is collected and in every message.
Recipients may withdraw their consent or object to advertising to existing Customers at any time, for example by using the unsubscribe link in every message or by emailing [email protected]. Unsubscribing is free of charge.
Records of consent and withdrawal serve to meet the accountability obligations under Article 5(2) and Article 7 in conjunction with Article 6(1)(c) GDPR. To the extent necessary for the establishment, exercise or defence of legal claims, further records of authorisation to send emails and of unsubscribing are based on Article 6(1)(f) GDPR; this is the legitimate interest. To comply with an objection to advertising, Bytekontor stores the email address and the scope of the blocking entry solely for this purpose (Article 6(1)(c) in conjunction with Article 21(3) GDPR and section 7 UWG).
8. Cookies and similar storage
The website and Dashboard use storage for login, security and the functions requested by the user.
| Storage | Purpose | Storage period |
|---|---|---|
| Login identifier | recognise the logged-in session and allow it to be revoked | until logout, server-side revocation or no later than 90 days after login |
| Application session | session protection and technical session functions | until the end of the session or no later than 90 days after login |
Bot protection (__cf_bm, Cloudflare) |
detect and defend against malicious automated access | 30 minutes after the last activity |
Security check (cf_clearance, Cloudflare) |
store the results of the bot check | approximately one year |
Storage of the login identifier, application session, __cf_bm and cf_clearance is based on section 25(2) no. 2 TDDDG. To the extent that the stored values are personal data, the legal bases stated in sections 3 and 4 apply.
Stripe may set cookies in its own Checkout and Billing Portal. Stripe's information applies to these cookies.
9. App icons from Google
Bytekontor retrieves an app icon from Google based on the website domain provided by the Customer. During the server-side retrieval, Google receives the domain and technical request data from the server. To the extent that personal data is processed, this retrieval is based on Article 6(1)(f) GDPR. The legitimate interests are the automatic association of app icons and the secure retrieval of website icons.
The recipients are Google Ireland Limited, Ireland, and Google LLC, USA. Google processes retrieval data as an independent controller. Further information is available in the Google Privacy Policy and Google's retention information. Section 13 applies to app icons stored by Bytekontor.
10. End User Data from Customer Apps
Bytekontor processes End User Data from Customer Apps on the Customer's behalf under the DPA. The privacy policy of the relevant app contains the applicable information. End Users should direct requests concerning this data to the app provider.
11. Recipients
Bytekontor transfers personal data only to the extent necessary for the stated purposes. Recipients may include:
- providers of hosting, databases, networks, object storage, security and error diagnostics; to the extent that they process data on behalf of a Mobile Joe Customer, they are listed in the current Subprocessor List;
- Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company Limited (Ireland), and Stripe, LLC (USA), for subscriptions and payments;
- Amazon Web Services for sending emails;
- Three Hearts Digital Ltd, United Kingdom (EmailOctopus), for newsletters and product information;
- companies in the Automattic group in Ireland and the USA for the possible contact image comparison under section 7;
- Google for the retrieval described in section 9;
- legal, tax and other advisers, where engaged;
- public authorities and courts where there is a legal obligation.
12. Transfers to third countries
Some of the recipients named in section 11 have companies or infrastructure outside the European Economic Area or access data from outside it, particularly in the USA. The processing locations and intended transfer mechanisms of the subprocessors are stated in the current Subprocessor List.
Transfers to EmailOctopus in the United Kingdom are based on the European Commission's adequacy decision under Article 45 GDPR. The EU-US Data Privacy Framework applies to covered transfers to Stripe, LLC and Google LLC in the USA; EU Standard Contractual Clauses have been agreed with Stripe as a fallback. Automattic describes the use of EU Standard Contractual Clauses for transfers from the EEA to third countries without an adequacy decision. For other transfers to countries without an adequacy decision, Bytekontor uses EU Standard Contractual Clauses and necessary supplementary measures. Bytekontor may use the EU-US Data Privacy Framework for additional certified US recipients.
A copy of the agreed safeguards for transfers of personal data to third countries, in particular the EU Standard Contractual Clauses, may be requested at [email protected].
13. Retention and erasure
The following periods and criteria apply to retention and erasure:
- Customer accounts and operational Customer data: for the term of the contract, including the free basic service. After the contract ends, only data required for statutory retention obligations or for the establishment, exercise or defence of legal claims is retained;
- sessions are no longer valid after the periods stated in section 8; associated server-side session data is erased in the daily erasure run after 90 days;
- application logs at Render: seven days;
- security events in Cloudflare Security Events: 24 hours;
- request data in Cloudflare Security Analytics: seven days;
- Sentry events: 30 days under the current configuration;
- contact and support communications: until handling is complete; thereafter only to the extent required by statutory retention obligations or the establishment, exercise or defence of legal claims. Business letters subject to a retention obligation are generally retained for six years from the end of the year in which they were received or sent;
- mailing data: where consent is used, until withdrawal or unsubscribing; for advertising to existing Customers, for as long as the conditions of section 7(3) UWG are met, but no longer than until an objection is made;
- records of authorisation to send emails: while they are used and then generally until the end of the third calendar year after their last use; unsubscribe records: generally until the end of the third calendar year after unsubscribing. Longer retention occurs only to the extent required by ongoing proceedings or different statutory limitation periods;
- advertising suppression entry: for as long as necessary to comply with the objection in future advertising;
- invoices and accounting records: generally eight years from the end of the year in which they were issued or created;
- Customer data processed on behalf of the Customer: under the DPA.
14. Data subject rights
Subject to the GDPR, data subjects may request:
- access;
- rectification;
- erasure;
- restriction of processing;
- data portability;
- withdrawal of consent with effect for the future; the lawfulness of processing before withdrawal remains unaffected.
Right to object: Where processing is based on legitimate interests, data subjects have the right to object on grounds relating to their particular situation. They may object to direct marketing at any time.
Requests may be sent to [email protected].
Data subjects may lodge a complaint with a data protection supervisory authority. The State Commissioner for Data Protection of Lower Saxony is generally responsible for Bytekontor.