Privacy Policy

1. Controller

Ryvelia UG (haftungsbeschränkt) Wasserturmstraße 3 04442 Zwenkau Germany

Represented by the managing director: Kimon Neuhoff Phone: +491631955793 Email: hi@entgeltplus.com

Where this policy refers to “we,” “us,” or “EntgeltPlus” below, this means Ryvelia UG (haftungsbeschränkt).

2. Data Protection Officer

No data protection officer has been designated at this time. Data protection inquiries may be directed to hi@entgeltplus.com. We continuously review whether an obligation to designate one exists under Art. 37 GDPR or the applicable national provisions.

3. Allocation of Roles for Licensee and User Data

Where licensees, in particular advisory firms, intermediary firms, or companies with their own advisors, enter personal data of employees, contact persons, employer or corporate clients they serve, or other third parties into EntgeltPlus, or have such data entered by authorized users, these licensees are generally themselves controllers within the meaning of the GDPR. In these cases, we process the data as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement and in accordance with the licensee’s instructions.

For our own purposes, such as managing license agreements, activating and managing user accounts, billing, security, support, error analysis, product operation, and statutory record-keeping, we act as an independent controller. Should joint controllership arise in an individual case, we will regulate the respective obligations separately.

4. Legal Bases

We process personal data only where a legal basis exists for doing so. The relevant legal bases are in particular:

• Art. 6(1)(b) GDPR for the performance of a contract, pre-contractual measures, license agreements, user accounts, support, calculations, document generation, and agreed platform functions.
• Art. 6(1)(c) GDPR for legal obligations, in particular obligations relating to commercial law, tax, accounting, and record-keeping.
• Art. 6(1)(f) GDPR for legitimate interests, in particular IT security, prevention of misuse, error analysis, product improvement, record-keeping, and legal defense.
• Art. 6(1)(a) GDPR for consent, in particular for non-essential analytics or marketing technologies.
• Art. 9 GDPR, insofar as special categories of personal data are concerned. Where such data is processed on behalf of a licensee, the licensee is responsible for the legal basis required for this. We process special categories of data for our own purposes only insofar as an additional legal basis under Art. 9(2) GDPR exists, for example for purposes of employment, social security, or insurance law, explicit consent, or the establishment, exercise, or defense of legal claims.

5. Provision of Data

The provision of certain data is necessary for using the website, concluding and performing license agreements, activating and managing user accounts, working within organizations, calculations and document generation, and communication. Without this data, we cannot provide the respective functions or services in whole or in part.

Insofar as licensees or authorized users enter data of employees or third parties, they must ensure that the data may lawfully be collected, provided, and processed and that the required information obligations are fulfilled.

6. Processing Activities

The most important processing operations are summarized below. Depending on the scope of services activated, not all operations are relevant for every licensee or user.

We process technical access data such as IP address, time, URL, referrer, browser, operating system, HTTP status, error data, and log data. The legal basis is Art. 6(1)(f) GDPR. Recipients are hosting, infrastructure, security, and support service providers. The data is stored only for as long as operation, security, error analysis, and record-keeping require; longer only in the event of a legal obligation or a security incident.

To operate the platform, we process account, organization, role, permission, usage, import, calculation, document, and log data. The legal bases are Art. 6(1)(b), (c), and (f) GDPR and, in the case of processing on behalf of a controller, Art. 28 GDPR. Recipients are in particular Hetzner, database and GraphQL infrastructure, Celestial/Auth components, and technical service providers. The data is stored for the duration of the license or user relationship and thereafter in accordance with legal obligations, the data processing agreement (DPA), legitimate interests, or our deletion policy.

For user accounts, we process name, email address, authentication data, user ID, roles, organization assignment, licensee reference, invitation status, phone number, advisor number, Chamber of Industry and Commerce (IHK) registration number, and profile picture. The legal bases are Art. 6(1)(b) and (f) GDPR. Recipients are authentication, email, hosting, and database service providers. The data is stored for the lifetime of the user account; security-relevant logs may be stored for a shorter or longer period as needed.

For organization management, roles, and access, we process organization data, licensee data, memberships, rights, invitations, administrative settings, and activity and status data. The legal bases are Art. 6(1)(b) and (f) GDPR. Recipients are authorized organization members as well as hosting, database, and authentication service providers. The data is stored for the duration of the organization, license, or user relationship; records may be retained longer.

For the platform’s professional functions, we process data of employer or corporate clients served, contact person data, employee master data, contact and employee data, salary data, tax and social security information, benefits and company pension scheme (bAV) data, tariff, insurance, and insurance company data, calculation results, consultation records, PDF/DOCX documents, and saved states. The legal bases are Art. 6(1)(b), (c), and (f) GDPR, Art. 9 GDPR where applicable, and, for customer data, generally Art. 28 GDPR. Recipients are authorized licensees and users, advisors, intermediaries, employer or corporate clients served, pension providers, insurers, service providers, and database and document generation services. The data is stored for as long as necessary for the respective process, contract, evidence, retention, or legal defense; deletion takes place in accordance with customer instructions or our deletion policy.

For imports, exports, and interfaces, we process import data, external IDs, internal user mappings, email addresses, import status, timestamps, error data, export contents, documents, and API and access data. The legal bases are Art. 6(1)(b) and (f) GDPR and, for customer data, Art. 28 GDPR. Recipients are authorized customer systems, integration partners, and hosting, database, and interface service providers. The data is stored for as long as import, export, traceability, error analysis, and contract performance require.

For digital signatures, we process the signature image, status, time, device identifier, location, user, company, and document reference, signature link, and expiration time. The legal bases are Art. 6(1)(b) and (f) GDPR and, for customer data, Art. 28 GDPR. Recipients are authorized licensees and users, document recipients, and hosting, database, and document generation services. Temporary signature requests are deleted after completion or cancellation unless they are deliberately saved; saved signatures are retained for as long as documentation, contract, or evidence require.

For uploads, we process uploaded image files, profile or organization images, file name, file type, file size, URL, and storage and access data. The legal bases are Art. 6(1)(b) and (f) GDPR. Recipients are hosting, storage, CDN, and security service providers as well as authorized users. The data is stored for as long as the associated account, profile, organization, or purpose exists; earlier deletion is possible if an authorized person deletes the data.

For transactional emails and webhooks, we process email address, name, subject, content, time of sending, delivery status, error status, invitation and system messages, attachments, and webhook events. The legal bases are Art. 6(1)(b) and (f) GDPR; for advertising, Art. 6(1)(a) GDPR or a statutory permission. Recipients are Resend, email infrastructure, and authorized recipients. Sending and evidence data is stored for as long as delivery, error analysis, security, contract, and record-keeping require.

For support and contact inquiries, we process contact details, message content, metadata, the subject of the inquiry, contract and organization reference, and attachments. The legal bases are Art. 6(1)(b) and (f) GDPR. Recipients are email, support, hosting, and communication service providers. The data is stored for as long as processing of the inquiry, contract, record-keeping, and legal defense require.

Insofar as payment, invoicing, or subscription functions are activated, we process name, email address, billing address, plan, tariff, usage quotas, invoice data, tax data, payment status, customer number, and transaction references. The legal bases are Art. 6(1)(b) and (c) GDPR. Recipients are Stripe, Autumn, banks, tax advisors, accounting, and payment and subscription service providers. Contract and invoice data is stored in accordance with statutory retention periods, generally for up to ten years.

For product and error analysis, we process usage events, page views, clicks, technical events, device and browser data, pseudonymous identifiers, and error data. For technically necessary analysis, Art. 6(1)(f) GDPR applies; for non-essential analysis, Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications and Digital Services Data Protection Act (TDDDG). Recipients are PostHog or comparable analytics and error analysis services, insofar as activated. Non-essential analysis takes place only for as long as consent exists or until it is withdrawn.

For security purposes, we process login and session data, IP addresses, device information, roles, access times, error and audit data, and API access. The legal basis is Art. 6(1)(f) GDPR. Recipients are hosting, authentication, security, database, and support service providers. The data is stored for as long as security, detection of misuse, record-keeping, and legal defense require.

7. Website with Framer

We may use Framer for the public website. Framer is used for designing, publishing, and delivering web pages. In this process, technical data required for operation and display may be processed, in particular IP address, browser and device information, time of the page visit, and content accessed.

Insofar as contact forms, demo requests, analytics functions, or comparable functions are used on the Framer website, we process the data entered there or generated for technical reasons in accordance with the purposes and legal bases set out in this Privacy Policy. Non-essential analytics or marketing technologies may only be used after valid consent has been obtained.

8. Cookies and Local Storage Technologies

We use cookies, local storage, session storage, and comparable technologies to provide the website and app, enable logins, secure sessions, save form states, continue calculations, and make functions usable.

Technically necessary storage access takes place on the basis of Section 25(2) TDDDG. The subsequent processing of personal data takes place, depending on the purpose, on the basis of Art. 6(1)(b) or (f) GDPR.

We use non-essential cookies or comparable technologies, in particular for analytics, marketing, or tracking, only with prior consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

In the app, session cookies are used in particular for authentication, and session storage entries are used for ongoing company pension scheme (bAV), benefits, assessment, or document processes. This allows entries to be retained during use and calculations or document generation to be carried out technically.

9. Service Providers Used and Planned

Depending on the function activated, we use or plan to use in particular the following service providers or systems:

• Hetzner for hosting, server, and storage infrastructure.
• Celestial and Better Auth for authentication, user, organization, and platform functions.
• Hasura, PostgreSQL, and associated database or GraphQL infrastructure for storage, queries, and role and permission logic.
• Resend for transactional emails, invitations, system messages, delivery status, and webhooks.
• Framer for the public website and web page delivery.
• PostHog for product analytics and error analysis, insofar as activated and, for non-essential use, only after consent.
• Stripe for payment processing, invoicing, and fraud prevention, insofar as paid payment functions are activated.
• Autumn for plan, subscription, quota, and entitlement management, insofar as corresponding subscription functions are activated.
• Tax advisors, legal advisors, banks, insurance and pension partners, intermediaries, employer or corporate clients served, and public authorities, insofar as this is necessary for contract, documentation, payment, retention, legal defense, or legal obligations.

With service providers that process personal data on our behalf, we conclude data processing agreements pursuant to Art. 28 GDPR insofar as this is required.

10. Transfers to Third Countries

We prefer processing within the EU or the EEA insofar as this is available for the respective service and contractually agreed. Nevertheless, individual providers, subcontractors, or support operations may involve processing outside the EU or the EEA.

A transfer to a third country takes place only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as EU standard contractual clauses, or a statutory exception. Information on specific safeguards may be requested at hi@entgeltplus.com insofar as it is not already provided in the providers’ documentation.

11. Retention Period and Deletion

We store personal data only for as long as necessary for the respective purposes. Account data is generally stored for the duration of the user, license, or contractual relationship. Contract, invoice, accounting, and tax-relevant data is stored in accordance with statutory retention periods, generally for up to ten years.

Advisory, insurance, signature, evidence, and documentation data may be stored longer insofar as this is necessary for the performance of a contract, for compliance with legal obligations, or for the establishment, exercise, or defense of legal claims. Import data, saved states, calculation results, and documents are deleted as soon as they are no longer needed for the respective purpose and no legal obligations, customer instructions, or legitimate interests preclude deletion.

12. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, and disclosure. These include in particular encrypted connections, access restrictions, role and permission concepts, logging of security-relevant operations, protection of API tokens, and a data-minimizing system configuration.

13. Rights of Data Subjects

Data subjects have, in accordance with the GDPR, the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on Art. 6(1)(e) or (f) GDPR. Where processing is based on consent, the consent may be withdrawn at any time with effect for the future without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, a message to hi@entgeltplus.com is sufficient. Where we process personal data exclusively on behalf of a licensee, we coordinate the handling of a request with the respective controller or forward the request accordingly.

14. Right to Lodge a Complaint with a Supervisory Authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The competent authority may in particular be the supervisory authority of the data subject’s habitual residence, place of work, or the place of the alleged data protection infringement. For Ryvelia UG (haftungsbeschränkt), the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte) in particular comes into consideration as the competent supervisory authority.

15. Automated Decision-Making

EntgeltPlus provides calculations, model comparisons, and documents. Under the current design, no decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects concerning data subjects takes place. Results are aids for decision-making, advice, and documentation and must be professionally reviewed in each specific individual case.

16. Changes to This Privacy Policy

We adapt this Privacy Policy when the legal situation, data processing operations, services used, or functions change. The current version is made available on the website or in the app.