Data Privacy

• We use strong encryption to keep your data private while in transit.
• We encrypt data on all of our devices to keep your data private while at rest.
• We continuously review our information collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems.
• We restrict access to personal information to employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined, terminated, and prosecuted if they fail to meet these obligations.

• A cookie is a tiny piece of text sent to your browser by a website you visit. It helps the website to remember information about your visit, like your preferred language and other settings, and to recall who you are after having logged in.
• You can set your browser to ask before allowing cookies or to not allow cookies at all. Refer to your browser's help to find out about the options available. Please be aware, that it is not possible to log on to our services or place an order with cookies fully deactivated.

• Information to be provided where personal data are collected from the data subject (Art. 13):
  this means we must inform you how we are going to use your personal data. We do this through this privacy policy and by informing you how your data will be used each time we collect it.
• Information to be provided where personal data have not been obtained from the data subject (Art. 14):
  not applicable, all personal data will be obtained from the data subject
• Right of access by the data subject (Art. 15):
  You have the right to access your personal data that we hold. This is called a subject access request. We must respond to your request within one month.
• Right to rectification (Art. 16):
  If you think the data we hold on you is incorrect, please inform us so we can put it right.
• Right to erasure ('right to be forgotten') (Art. 17):
  You have the right to request that we delete your data. We will do so, provided that we do not have a compelling reason for keeping it.
• Right to restriction of processing (Art. 18)
• Notification obligation regarding rectification or erasure of personal data or restriction of processing (Art. 19)
• Right to data portability (Art. 20):
  You can obtain and reuse your personal data for your own purposes across different services.
• Right to object (Art. 21):
  You have the right to object to
  • Direct marketing: you can opt out of direct marketing any time by following the instructions on how to unsubscribe included in any direct marketing message that we send to you.
  • Any processing where our lawful basis is legitimate interest (see above). If you would like to formally object to any of our legitimate interest processing, please contact us.
• Automated individual decision-making, including profiling (Art. 22):
  This is not something we do at all. If that ever changes, this policy will be updated accordingly.

Email, calendar, and file sharing run on Open-Xchange ("OX App Suite Cloud"). ( open-xchange.com/ox-cloud/privacy-policy/en)

All our subscriptions are sold via Paddle as our Merchant of Record (MoR).
A Merchant of Record is a legal entity responsible for selling goods or services to an end customer. They manage all payments and take on the associated liabilities, such as collecting sales tax, ensuring Payment Card Industry (PCI) compliance, and honoring refunds and chargebacks.