Privacy policy

This is a courtesy translation. The legally binding version is the German one:Datenschutzerklärung.

This policy covers the website (idahub.de), registration and the contractual relationship, and the IDA app for Android and iOS. The processing of data that customers put inside IDA is carried out on the customer instruction and is governed by the data processing agreement.

1. Controller

2. Access data / server log files

When you visit our website, information transmitted by your browser is automatically stored in server log files - in particular the IP address and the requesting provider, the date and time of access and the page requested. This processing serves the secure and stable operation of the website (Article 6(1)(f) GDPR).

3. Web analytics with Matomo

We use Matomo for anonymised analysis of website use. Your IP address is anonymised before storage, so the data cannot be attributed to a specific person. The legal basis is Article 6(1)(f) GDPR. Where the specific configuration requires consent, processing takes place on the basis of Article 6(1)(a) GDPR; consent can be withdrawn at any time.

Measuring ads in ChatGPT. If you reach this website through one of our ads in ChatGPT, the address contains a random click identifier from OpenAI. It is passed on within the website via the address, not stored in cookies or browser storage. If you sign up for a trial, after confirmation we report only this identifier to OpenAI together with the note "trial started", so we can see which ad leads to sign-ups. We do not transmit your name, e-mail address, IP address or any other personal details. The legal basis is our legitimate interest in measuring the success of our advertising (Article 6(1)(f) GDPR).

4. Contacting us

If you contact us by email or through a form, we process the details you provide in order to handle your enquiry (Article 6(1)(b) or (f) GDPR).

5. Registration, trial and contractual relationship

To set up a trial (30 days) and a customer account we process the data provided - in particular name, email address, company and credentials - and subsequently the data required to perform the contract. The legal basis is the performance of pre-contractual measures and of the contract (Article 6(1)(b) GDPR). To secure operation and prevent abuse, usage and log data may be processed (Article 6(1)(f) GDPR). When a trial is requested we store the IP address of the request for that purpose, in order to detect and prevent repeated or automated registrations. The registration form is additionally protected against automated requests by a proof-of-work puzzle solved in the browser; no cookies are set and no data is transmitted to third parties.

If you reach our website through an advertisement or a campaign link, the address contains campaign identifiers (e.g. source, campaign, ad). We pass them on in the address when you move to the sign-up form - without cookies and without storing anything in your browser - and store them together with your registration. Without campaign identifiers, your browser evaluates the referring page it sends along: if you come from a search engine or an AI service, the address only carries its name (e.g. "Google" or "Claude"), never the page address or your search term. If there are no campaign identifiers, you may optionally tell us how you heard about us. The purpose is to assess which advertising leads to registrations; the legal basis is our legitimate interest (Article 6(1)(f) GDPR).

6. Payment processing

To bill paid contracts we process the billing address, the VAT identification number and - for SEPA direct debit - the account holder, IBAN and evidence of the mandate granted (time, name and IP address at the time of granting). The legal basis is performance of the contract (Article 6(1)(b) GDPR). Bank details are held exclusively in our billing system; for collection they are transmitted to our bank. This data is retained within the periods required by commercial and tax law.

7. Processing of data inside IDA (processing on instruction)

Where customers put personal data into IDA, or have it imported or retrieved through systems they connect (directory, inventory, monitoring, telephony, email or supplier systems, for instance), we process that data exclusively on behalf of and on the instruction of the respective customer, as a processor. The basis is the data processing agreement under Article 28 GDPR. The controller for that data is the customer.

8. IDA app for Android and iOS

The IDA app is a mobile client for an IDA installation. It is used only by people who have an account there; accounts are created by the installation's administrator, never in the app. On first launch you enter the address of your installation. All content you view or record in the app (e.g. cases, times, photos, signatures, attachments) is transferred exclusively to that installation and processed there on behalf of your employer or the operator (section 7). Transfers are encrypted (HTTPS).

On the device and beyond, the app processes:

• Stored on the device: the address of your installation, session credentials and your app settings (e.g. app lock, notifications).
• Camera and photos: only when you take a photo, pick an image from your library or scan a barcode or serial number. Photos are uploaded to your installation as attachments. Barcodes are read on the device using Google ML Kit, which may send technical usage and performance data to Google, without the scanned content.
• Location: only at the push of a button (e.g. to calculate the return trip on a service report) and only while the app is open. The location is sent to your installation, used to calculate the travel time and not stored. The app never requests location in the background.
• Fingerprint, face recognition, device PIN: the app lock uses the operating system's check. The app receives only the result (confirmed or not), never biometric data.
• Notifications (push): if you allow notifications, the device obtains a device token via Firebase Cloud Messaging, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The token is stored in your installation, which uses it to send notifications to your device. A notification contains only the type and number of a case, no content; the app loads the rest from your installation once opened. Google may also process data in the USA; the basis is the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. You can turn notifications off at any time in the app or in the device settings.

The app contains no advertising, no analytics or tracking services and no crash reporting to us; as the manufacturer we receive no data about you or your usage from the app. The legal basis is providing the features you use (Art. 6(1)(b) or (f) GDPR); camera, photos, location and notifications are used only after you grant permission in the operating system (Art. 6(1)(a) GDPR), which you can revoke there at any time. Deleting your account and the data stored in it is handled by the administrator of your installation; you remove the data stored on the device by signing out or uninstalling the app.

9. Recipients and processors

Personal data is only passed on where this is necessary to perform the contract or another legal basis exists. Processors we use (hosting providers in Germany, for instance) are bound contractually under Article 28 GDPR. Transfers to third countries only take place where the statutory requirements are met.

To operate, maintain and troubleshoot IDA, we use AI assistance systems provided by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland (Claude). Error messages, logs and, in individual cases, content from IDA may be processed in the course of this where the analysis requires it. Anthropic processes this data as a processor, retains inputs and outputs for no more than 30 days and does not use them to train its models. Processing in the USA is possible; it is based on the EU standard contractual clauses (Article 46(2)(c) GDPR). The legal basis is our legitimate interest in secure and error-free operation (Article 6(1)(f) GDPR) or the data processing agreement with the customer.

Systems the customer operates themselves and connects to IDA are not processors engaged by us. Retrieving data from those systems and transmitting data to them happens on the customer instruction; the customer is responsible for the data protection admissibility and for any agreements required with the respective provider. This also applies to AI services the customer stores in IDA with their own access (for the AI chat or the AI diagnosis in remote support, for instance).

10. Retention

We store personal data only for as long as it is necessary for the purposes stated or as long as statutory retention obligations exist. Data from trial tenants is deleted at the latest 14 days after the trial ends, unless a paid contract is concluded. After the contract ends, or in the event of persistent non-payment, access is blocked; the data is deleted from the production systems after a period of 14 days. Restoration from backup copies is possible only in individual cases, against costs and without warranty; once the retention period of the backup copies has expired it is impossible. Statutory retention obligations remain unaffected.

11. SSL/TLS encryption

For security reasons this website and the service use SSL/TLS encryption.

12. Your rights

Within the statutory framework you have the right at any time to:

• information about the data stored about you (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• object to processing (Article 21 GDPR)
• withdraw consent given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, a message to the contact details above is sufficient.