Privacy Policy

Krone Baustein e.K., trading under the brand BauFin!app Eschenstieg 1 20259 Hamburg, Germany Represented by: Krzysztof Jerzy Buczyński, owner E-mail: post@baufin.app Data protection contact: datenschutz@baufin.app Tax number (Steuer-Nr.): 22/282/38532 VAT ID (USt-IdNr.): DE344558054 Commercial register: Amtsgericht Hamburg, HRA 127948

We process personal data only to the extent necessary to provide our SaaS platform BauFin!app. The legal bases are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (legitimate interest) and Art. 6(1)(a) GDPR (consent).

During registration we collect: name, e-mail address, company name, postal address and telephone number. These data are necessary for the performance of the contract.

While you use the platform, we process the business data you enter (customers, invoices, orders, expenses etc.). These data remain within your tenant area and are not accessible to other users.

For payment processing we use the following service providers:

Revolut Bank UAB, Konstitucijos ave. 21B, LT-08130 Vilnius, Lithuania. Revolut processes your payment data (card number, expiry date) as an independent controller. Privacy policy: https://www.revolut.com/legal/privacy

PayPal (Europe) S.a r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your payment data as an independent controller. Privacy policy: https://www.paypal.com/privacy

We ourselves do not store credit card numbers or bank details. From the payment service providers we receive only a confirmation that the payment has been received.

Our platform is hosted on servers in Germany. Application data are stored exclusively within the European Economic Area (EEA). For technical connection data (e.g. via the content delivery network, see below) a transfer to a third country may take place in individual cases — safeguarded by EU Standard Contractual Clauses (SCC).

We use an external content delivery network with DDoS protection. The provider processes technical connection data (IP address, browser type) as a processor; it is established outside the EEA, and the transfer takes place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

A complete list of the processors used, with names and registered offices, is provided in the data processing agreement and on request (Art. 15 GDPR). A copy of the appropriate safeguards for transfers outside the EEA (EU Standard Contractual Clauses) is likewise available on request (Art. 13(1)(f) GDPR).

We use only technically necessary cookies and localStorage entries for authentication (session token) and the language setting. No tracking cookies or analytics tools are used.

During registration and login an external bot detection service is in use. This serves the legitimate interest in protection against automated attacks (Art. 6(1)(f) GDPR).

Your data are stored for the duration of the contractual relationship. After termination or expiry of the trial period we keep your data available for collection (data export) for 90 days; after this period they are completely and irreversibly deleted, unless statutory retention obligations apply.

You can delete your account yourself at any time (Settings -> Profile -> Delete account). If you trigger the account deletion yourself, your data are deleted immediately and irreversibly; please back up any data you need beforehand using the export function. The 90-day period mentioned above applies exclusively where the contract ends by termination (collection period for the data export).

Statutory retention obligations: invoices and accounting records are retained for 10 years in accordance with § 147 AO and § 257 HGB.

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR) - you may request information about the data stored about you.
• Right to rectification (Art. 16 GDPR) - you may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) - you may request the deletion of your data.
• Right to restriction (Art. 18 GDPR) - you may request the restriction of processing.
• Right to data portability (Art. 20 GDPR) - you may receive your data in a commonly used format.
• Right to object (Art. 21 GDPR) - you may object to the processing.

To exercise your rights, please contact: datenschutz@baufin.app

You have the right to lodge a complaint with a supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter fuer Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg.

We apply technical and organisational measures to protect your data: encrypted transmission, access control, regular backups and a hardened server configuration.

Your data are completely isolated from those of other users. Access between different company areas is technically excluded.

BauFin!app offers "Datenexport Pro" as an optional, paid additional service. This service creates a complete copy of your business data every day in a machine-readable format (JSON in ZIP) and makes it available for download.

Purpose of the processing: realisation of your right to data portability (Art. 20 GDPR) in the form of a proactive service. You receive your data regularly in a structured, commonly used and machine-readable format.

Scope of the exported data: all business data stored in your tenant area (customers, invoices, orders, expenses, quotes, projects, time tracking, driver's logbook, tax records, settings) as well as uploaded media (receipts, photos, documents).

Storage location: the export files are stored with an external storage service provider (data centre Amsterdam, Netherlands, European Economic Area) with server-side encryption.

The provider of this storage is established outside the EEA; however, the processing takes place exclusively in its data centre in Amsterdam. The basis for the transfer is a data processing agreement including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention period: export files are stored for 30 days and then deleted automatically. In the user panel the exports of the last 7 days are available for download.

Delivery: you receive an e-mail notification with a personalised download link. The link is limited in time and in the number of downloads. Every download is logged for audit purposes.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract - the service is part of the booked scope of services).

You can cancel the service at any time via the platform (Settings -> Subscription). After cancellation, any remaining export files are deleted once the 30-day retention period has expired.

Independently of the "Datenexport Pro" service, you have the right at any time to receive your data in a structured, commonly used and machine-readable format. For this purpose BauFin!app provides you free of charge with the "Data copy" function (Settings -> Data copy), through which you can download a complete copy of your data as a ZIP file at any time.

The difference from the paid "Datenexport Pro" service is that the latter performs the export automatically every day, keeps the data with an external storage service provider and notifies you by e-mail. The free function requires a manual download by the user.

BauFin!app processes your business data on your behalf (processing on behalf of a controller in accordance with Art. 28 GDPR). We provide you with a data processing agreement (AVV) including the technical and organisational measures (TOM) and a list of sub-processors.

These documents are available after login in your user account under Settings -> Profile -> Legal documents.

1. Description and scope of the data processing

This site embeds the professional liability seal of Exali AG. The graphic element of the seal is loaded from the servers of Exali AG. Because of the technical design of the internet, your IP address is processed in order to transmit the graphic to your browser.

If you click the seal, you leave our site and are redirected to the servers of Exali AG.

You can find more information in the Exali privacy policy: https://www.exali.de/Ueber-exali/Rechtliches/Datenschutzerklaerung,100401.php#Verwendung/Einbindung%20des%20exali.de-Haftpflicht-Siegels

2. Legal basis for the data processing

The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest).

3. Purpose of the data processing

The processing serves the purpose of providing the legally required mandatory information on professional liability insurance pursuant to § 2(11) DL-InfoV in a visually appealing form.

4. Legitimate interest

Our legitimate interest in the processing follows from the purpose of offering an appealing online presence and of meeting our information duties in a visually appealing way.