Privacy Policy

Controller within the meaning of the GDPR:

PASit software GmbH, Staudach 10, 4863 Seewalchen, Austria

Phone +43 7662 299 98 0, email: office@bau-master.com

Data protection officer:

Gernot Schiffermayer, MLS, G&S Schiffermayer Consulting GmbH, Schönfeldweg 32, 9061 Klagenfurt-Wölfnitz, Austria

Phone +43 660 65 106 77, email: office@schiffermayer.eu

This privacy policy applies to the use of our website bau-master.com including its subdomains (e.g. our online calculators at rechner.bau-master.com and our product roadmap at roadmap.bau-master.com), to contacting us (e.g. contact form, email) and to the use of our software BauMaster (e.g. free trial or an ongoing customer relationship).

Personal data is any information that makes you identifiable as a person (e.g. name, email address, IP address).

Data subject is any person whose data is processed.

Processing means anything done with data (collecting, storing, using, disclosing, deleting).

Consent is your voluntary agreement to the processing of your data.

In particular, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to certain processing.

Where processing is based on your consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of the processing carried out before the withdrawal.

Objection (Art. 21 GDPR): Where we process data on the basis of our legitimate interests, you can object on grounds relating to your particular situation. You can also object at any time to the processing of your personal data for direct marketing purposes.

Note on legal restrictions: Please note that data subject rights under the GDPR may in individual cases be subject to legal restrictions (e.g. where exercising them would impair the fulfilment of legal obligations).

An email to office@schiffermayer.eu is sufficient for requests. So that we can handle your request as efficiently and quickly as possible, please tell us in which context you believe your personal data is being used. Where necessary, we will ask for suitable information or proof for unambiguous identification, so that we can reliably match your request.

4.1 Information on the right to lodge a complaint

If you believe that we are violating data protection law, you can lodge a complaint with the Austrian Data Protection Authority. You will find the contact details here: dsb.gv.at. Alternatively, you can send your request by email to office@schiffermayer.eu, the person responsible for data protection at PASit software GmbH.

In many cases, the processing of your data is based on a legal obligation or is necessary for the performance of a contract or for pre-contractual measures. In addition, your personal data is often processed on the basis of consent.

5.1 Visiting our website (technically necessary)

When you visit our website, our web server processes certain information for technical reasons (so-called server log files), e.g. date/time, URL/referrer, status code, browser information, IP address.

• Purpose: operating the website, error analysis, IT security
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• Storage period: usually up to 14 days, unless a security-related investigation requires longer

5.2 Contacting us (e.g. contact form, email)

When you write to us, we process the data you provide (typically name, email address, phone number and the content of your message).

• Purpose: processing/answering, follow-up questions, documentation
• Legal basis: depending on the context, contract/pre-contract (Art. 6(1)(b) GDPR) or consent (Art. 6(1)(a) GDPR)
• Storage period: as long as necessary; beyond that only within the scope of legal obligations or to enforce/defend legal claims

5.3 Cookies, consent and similar technologies

On our website we use cookies and similar technologies (e.g. local storage) to provide basic functions and – only with your consent – to analyse usage, measure the success of our advertising and embed content from other providers.

Our consent tool

We manage your choice with our own consent tool that runs on our web server (open-source software, no external provider). No data is passed on to third parties in the process. On your first visit you can choose which categories you allow; “Accept all” and “Necessary only” are equally prominent. Statistics, marketing and external media are switched off until you agree.

Categories

• Necessary (always active): basic functions of the website, security (e.g. spam protection for forms with Cloudflare Turnstile), language setting and storing your cookie choice. Content that is the purpose of the respective page and that you open yourself also loads without separate consent: forms and appointment booking (Zoho Forms, Zoho Bookings) and the questionnaire on the “Who is it for?” page (involve.me). Legal basis: Art. 6(1)(b) or (f) GDPR; for information on your device § 165(3) TKG 2021 (strictly necessary).
• Statistics: Google Analytics; Usermaven with cookie (recognition across several visits).
• Marketing: Google Ads (incl. Enhanced Conversions and offline conversion import), Capterra / Gartner Digital Markets, Convertful (notice pop-ups).
• External media: Vimeo, YouTube, ProvenExpert. Videos and the review badge show a placeholder before consent; data is only transmitted to the respective provider with your consent or when you click “Load video” or “Load reviews”.

The legal basis for statistics, marketing and external media is your consent (Art. 6(1)(a) GDPR and § 165(3) TKG 2021).

Google Consent Mode v2 (“Basic”)

We use Google Consent Mode v2 in “Basic” mode: Google services – including Google Tag Manager – are only loaded after you have consented to the statistics or marketing category. Without consent, no data is transmitted to Google. Your choice is passed on to the Google services so that they only work within the permitted scope.

Cookieless reach measurement (Usermaven)

Even without consent, we measure the reach of our website anonymously with Usermaven: without cookies, with a shortened IP address and without a persistent identifier that could recognise you across several visits. For transmission, the measurement data is briefly buffered in your browser’s storage (local storage). Form contents are not recorded. Purpose: understanding and improving the reach and use of our pages. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). If you consent to the statistics category, Usermaven measures with a cookie from the next page view; if you withdraw consent, this cookie is deleted.

Proof of your consent

To be able to prove that and to what extent you have consented (Art. 7(1) GDPR), we store the following on our web server for every choice made in the banner: a randomly generated ID (the same as in the “cc_cookie” cookie in your browser), time, version of the banner, type of choice (all / selection / necessary only), selected categories and services, language and the page on which you made your choice. We store no IP address and no browser identifier. The entries are deleted automatically after 3 years. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can find your ID in the cookie settings; it allows us to match your entry unambiguously in the event of a request.

Third-party providers / third countries (e.g. USA)

Cookies and similar technologies may also be used by us and by third-party providers (e.g. providers of analytics or advertising services) to process personal data. These third-party providers may be based in third countries (e.g. USA) or process data there. For certain third countries there may be no adequate level of data protection within the meaning of the GDPR. There may therefore be a risk that authorities in the third country access data and that no effective legal remedies are available against this.

Consent, withdrawal and settings

By clicking “Accept all” or activating individual categories, you consent to the use of the respective technologies and – depending on the services used – to any transfer to recipients in third countries.

You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page; the cookies and browser storage entries concerned are deleted in the process. Necessary cookies cannot be deactivated because they are required to operate the website. The name, provider, purpose and storage period of the individual cookies can also be found in the cookie settings. We ask for your choice again when the services we use change, and after 6 months at the latest.

5.4 Use of our software / BauMaster free trial

When you use BauMaster (e.g. via a free trial or as a customer), we process personal data in order to provide, operate and secure the software, provide support and develop it further.

Which data may be involved?

Depending on use and role (e.g. administrator, user, contact person), the following data in particular may be processed:

• Account and contact data: name, email address, phone number, company, role/function, language settings.
• Login and security data: access data (usually encrypted/secured), login times, technical security information.
• Usage and device data: e.g. browser used, operating system, device identifiers, IP address, timestamps.
• Content/project data in BauMaster: data that you (or authorised persons in your company) enter or upload in BauMaster (e.g. project information, reports, photos, documents, notes).
• Support and communication data: contents of support requests, emails, chat histories or screenshots, if you provide them to us for error analysis.
• Source/campaign information: if you reach our registration page via a campaign link, we process the source information passed in the URL in order to understand which campaign led to your free trial. Details in section 5.8.

What do we use this data for?

• Providing the software and its functions: user management, authentication, synchronisation, storage and display of your content.
• Operation and security: protection against misuse, defence against attacks, error analysis, stability and performance monitoring.
• Customer care and support: handling requests, help with technical problems.
• Billing and contract processing (for customers): where necessary for performing the contract and fulfilling legal obligations.

Legal bases

• Contract/pre-contract (Art. 6(1)(b) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)
• Consent (Art. 6(1)(a) GDPR), where we obtain it in the specific case

Storage period / deletion

We generally only store personal data for as long as necessary for the purposes stated above.

• We typically store data from free trials and use for the duration of the free trial/contract. When a free trial ends or a contract is terminated, our deletion script provides for a safety period of 180 days before your data is finally and irrevocably deleted.
• Beyond that, we only store data where statutory retention obligations or limitation periods require it or where it is necessary to establish or defend legal claims.

Details on recipients and the service providers/tools used can be found in sections 6 and 9 and in the respective tool details below.

5.5 Newsletter (Zoho Campaigns)

If you subscribe to our newsletter, we process your personal data in order to send you regular information about BauMaster (e.g. product news, updates, invitations and offers) by email.

Which data do we process?

• Master data: your email address and, if provided, your name.
• Proof of subscription: time of subscription and confirmation (double opt-in) as well as technical log data, so that we can prove your consent.
• Performance figures: we evaluate whether a newsletter was opened and whether links were clicked (aggregated open and click rate). We do not use individual click tracking for marketing purposes via website tracking/cookies.

Purposes of processing

• Sending the newsletter
• Measuring and improving the content (open and click rate)

Legal basis

• Sending the newsletter and measuring performance: consent (Art. 6(1)(a) GDPR)
• Logging/proof of your consent (double opt-in): legitimate interest (Art. 6(1)(f) GDPR), so that we can document a lawful subscription

Recipients / service providers

The newsletter is sent and evaluated via Zoho Campaigns (ZOHO One) as a service provider (processor).

Storage period

We generally store your newsletter data until you withdraw your consent (unsubscribe). We keep log data proving consent for as long as necessary for documentation and to establish or defend legal claims.

Withdrawal / unsubscribing

You can withdraw your consent at any time with effect for the future by using the unsubscribe link in every newsletter or by contacting us. The withdrawal does not affect the lawfulness of the processing carried out until then.

5.6 Direct marketing / CRM communication (Zoho CRM, BauMaster app)

We process personal data of prospects and customers in order to communicate with you within the business relationship or in preparation of a contract. Contact may be made e.g. by email or phone and is documented in our CRM. Emails may also be sent from within the BauMaster app.

Which data do we process?

• Contact data: name, email address, phone number, company, function/role
• Communication data: contents and metadata of emails/messages, call notes, contact and case history
• Organisational data: e.g. responsibilities, status (prospect/customer), appointment reference

Purposes of processing

• Answering enquiries and coordination in preparation of a contract
• Customer communication (e.g. information on use, processing, changes)
• Direct marketing within the legal framework (e.g. product information)

Legal basis

• Contract/pre-contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR), in particular in customer care and direct marketing

Storage period

We generally store the data for as long as necessary for communication and (pre-)contractual processing. Beyond that, data is only stored within the scope of legal obligations or to establish or defend legal claims. On request, all customer data in ZOHO CRM can be deleted manually.

Objection

You can object at any time to the processing of your personal data for direct marketing purposes (Art. 21 GDPR).

5.7 Online appointments: booking (ZOHO Bookings), meetings and transcripts (Notion)

You can book an appointment via our website or directly via a link – for example a consultation, an online demo, an interview, a research/UX session or a testimonial.

(a) Appointment booking (Zoho Bookings)

We use Zoho Bookings to arrange appointments. In doing so, we process:

• name and contact details (e.g. email, phone number if provided)
• appointment data (date/time, time zone, service booked)
• any free text/notes you provide when booking
• whether you agree to the meeting being transcribed (see point b)

Purposes: arranging and handling appointments, reminders, preparing and holding the meeting.

Legal basis: contract/pre-contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) in efficient appointment organisation.

Storage period: as long as necessary for handling the appointment; beyond that only within the scope of legal obligations or to establish or defend legal claims.

(b) Holding the online meeting and transcript

We hold online meetings via Microsoft Teams, Zoom or Notion. For online demos, consultations, interviews, research/UX sessions and testimonials we use Notion’s “AI Meeting Notes” feature. The spoken audio is converted into text live (“transcript”), and a summary with action items is created from it automatically.

A transcript is only made with your prior consent. We inform you about the use of this feature before the start and only start the transcript once all participants have agreed; we document the consent given. You can always take part in the meeting without a transcript – this will not disadvantage you in any way. You can withdraw your consent during the meeting and afterwards at any time; we will then stop the transcript immediately and delete it without delay at your request.

The following is processed:

• the spoken audio for the purpose of conversion into text – no audio or video recording is stored; the audio data is only processed for live transcription and then discarded (only in the event of a technical error is a copy kept for a maximum of 3 days for reprocessing)
• the resulting transcript, including speaker attribution
• the automatically generated summary and derived action items
• metadata (date, duration, participants) and the content you share in the meeting

(c) What we use the transcript and summary for

• to capture your requirements and needs completely and pass them on correctly internally
• to derive and complete tasks and next steps from the meeting (e.g. sending documents, preparing an offer, setting up a free trial, clarifying questions)
• to improve our product, our advice and our information material
• for testimonial interviews, to create a reference report or use case – publication only takes place after you have expressly approved the final text

(d) AI-supported processing

Transcription, summary and task recognition are carried out by Notion AI. Your data is not used to train AI models. There is no automated decision-making within the meaning of Art. 22 GDPR – all assessments and decisions are made by employees.

(e) Storage location and data processing agreement

We use Notion on the Enterprise plan with EU data residency, i.e. your content is stored on servers in the European Union. A data processing agreement in accordance with Art. 28 GDPR is in place with Notion. Notion uses sub-processors for speech and text processing; where this involves a transfer to a third country, it is safeguarded by EU standard contractual clauses and additional safeguards in accordance with Chapter V GDPR. For Enterprise workspaces, zero data retention applies to the AI providers.

(f) Sharing with agencies

We reserve the right to pass on transcripts in anonymised or pseudonymised form (without names, company and contact details) to agencies that support us in creating content and graphics. Data processing agreements in accordance with Art. 28 GDPR are in place with these service providers. Your name or your company is only disclosed with your separate consent (e.g. for reference reports).

(g) Legal bases

• Transcript, transcription and AI-supported evaluation: Art. 6(1)(a) GDPR (consent)
• Holding the appointment and handling the resulting next steps: Art. 6(1)(b) GDPR
• Documenting the consent given: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR

(h) Storage period

Transcripts are deleted automatically by the system after one year. No audio or video recording is stored (see point b). We store notes and tasks derived from the meeting as part of our customer management in accordance with section 5.6. You can request the withdrawal of your consent and early deletion at any time at office@bau-master.com or from our data protection officer (office@schiffermayer.eu).

Campaign source for appointment bookings: If you reach our booking page via a campaign link, we pass the source information on to the booking (see section 5.8).

5.8 Campaign links (source information)

Some of our links contain source information, e.g. which campaign or landing page you come from (parameter “TZQ” for free-trial registration, “dq” for downloads and e-books, “TBQ” for appointment booking).

• What happens: our web server passes the value directly into the respective form or booking. The parameter is then removed immediately from your browser’s address bar so that no other services (e.g. analytics tools) capture it.
• No cookie, no browser storage: the value is neither stored in cookies nor in your browser’s storage and is not passed on to analytics or advertising services.
• Content: the source information is only assigned at campaign level (e.g. “lp-architekten”), not personalised. It is stored together with your registration, download request or booking.
• Purpose: to understand which campaign led to a free trial, a download or an appointment, in order to improve our advertising.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Storage period: the same as the associated data (sections 5.4, 5.7 and 5.9).

5.9 Downloads and e-books

For downloads (e.g. templates, checklists, e-books) we use forms from Zoho Forms. After submitting, you receive an email with a confirmation link; we only provide the download after confirmation.

• Data: the data entered in the form (e.g. name, email address, company), time of the request and of the confirmation, and the source information if applicable (section 5.8).
• Purpose: providing the requested download, proof of confirmation, and contact where applicable within the scope of section 5.6.
• Legal basis: contract/pre-contract (Art. 6(1)(b) GDPR); proof of confirmation: legitimate interest (Art. 6(1)(f) GDPR); for further marketing use, your consent where applicable (Art. 6(1)(a) GDPR).
• Recipient: Zoho (Zoho One) as processor.
• Storage period: until withdrawn.

As a rule, we do not simply pass personal data on to third parties. Data is only disclosed where this is necessary and there is a legal basis, for example:

• to service providers (processors) who process data exclusively on our instructions (in particular IT/hosting, maintenance, analytics/monitoring, support, CRM/communication, marketing tools depending on consent)
• to partners/recipients, where necessary to perform the contract (e.g. payment/billing service providers, shipping/communication – depending on the specific process)
• to authorities/courts, where we are legally obliged to do so

Where service providers act for us as processors, this is based on a contract in accordance with Art. 28 GDPR (data processing), where required.

6.1 Transfers to third countries (e.g. USA)

Some services/providers may process data outside the EU/EEA (e.g. in the USA) or use sub-processors in third countries. When we use such services, we ensure the safeguards required under the GDPR (e.g. adequacy decision, standard contractual clauses, additional measures).

Despite these safeguards, there may in individual cases be a risk that authorities in the third country gain access to data.

Specific information on recipient countries, safeguards and – where available – storage periods can be found in the overview (section 9) and in the details on selected tools.

6.2 No automated decisions (note on Art. 22 GDPR)

We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we use appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect your personal data against loss, destruction, manipulation and unauthorised access.

These include in particular:

• pseudonymisation and encryption of personal data (in particular transport encryption, e.g. TLS)
• measures to ensure the confidentiality, integrity, availability and resilience of systems and services
• access controls and authorisation concepts
• backups and procedures for quickly restoring the availability of data in the event of incidents
• regular testing, assessment and evaluation of the effectiveness of the security measures

Please keep access data confidential and protect your devices against unauthorised access.

We adapt this privacy policy when our website, processes or the legal situation change.

Internal systems (self-hosted / own infrastructure)

To operate our website and individual functions (e.g. content and learning area), we also use systems that we operate ourselves (self-hosted). No personal data is transferred independently to the manufacturer of the respective software.

The technical data arising in the process (in particular server/access logs, error logs where applicable) is processed as part of technical operation by our hosting and IT service providers as processors (e.g. hosting/IT for the website or infrastructure hosting).

The following tool blocks contain the essential information for each processing operation (purpose, data categories, legal basis, recipients/third country, storage period and withdrawal/objection).

Consent tool (cookie settings, self-hosted)

Operator:	PASit software GmbH (own software on our web server, open source, no external provider)
Place of processing:	Austria (web server at flexbit)
Transfer to third countries:	no
Purpose of processing:	Managing your cookie choice and proof of consent (Art. 7(1) GDPR)
Legal basis:	Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; “cc_cookie” cookie: § 165(3) TKG 2021 (strictly necessary)
Data transferred:	random ID, time, banner version, type of choice, selected categories and services, language, page – no IP address, no browser identifier
Data subjects:	Website users who make a choice in the cookie banner
Storage period:	“cc_cookie” in the browser: 6 months; proof on the server: 3 years, then deleted automatically
Note:	Withdrawal and changes at any time via “Cookie settings” in the footer.

flexbit (website hosting/IT)

Operator:	flexbit
Place of processing:	Austria (Gurten, AT)
Transfer to third countries:	no
Operator’s privacy policy:	https://flexbit.at/impressum/
Purpose of processing:	Technical operation, hosting, maintenance and IT support of the website
Legal basis:	Art. 6(1)(b) GDPR (contract) and/or Art. 6(1)(f) GDPR (operation/security)
Data transferred:	Server/access logs, technical diagnostic data where applicable; content only where necessary for operation/support
Data subjects:	Website users; contact persons in support cases
Storage period:	Depending on purpose; logs typically time-limited; otherwise project/contract term + legal obligations
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement).

next layer (app hosting)

Operator:	next layer, Vienna
Place of processing:	Austria (data centres in Vienna)
Transfer to third countries:	no
Operator’s privacy policy:	https://www.nextlayer.at/datenschutz/
Purpose of processing:	Hosting/operation of the BauMaster infrastructure
Legal basis:	Art. 6(1)(b) GDPR (contract) and/or Art. 6(1)(f) GDPR (operation/security)
Data transferred:	Server/access logs, technical diagnostic data, infrastructure metadata where applicable
Data subjects:	Users of the app/services (indirectly via technical data)
Storage period:	Depending on purpose; logs typically time-limited; otherwise contract/project term + legal obligations
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement)

Google Analytics

Operator:	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://policies.google.com/privacy?hl=en
Purpose of processing:	Reach measurement / usage analysis (statistics); with Google Signals additionally cross-device analysis for users who are signed in to Google and have allowed personalised advertising
Legal basis:	Art. 6(1)(a) GDPR (consent), statistics category; Google Signals only additionally with consent to marketing
Data transferred:	Online identifiers (cookies/IDs), usage/interaction data, device/browser information, IP address where applicable (depending on configuration)
Data subjects:	Website users who have consented to statistics
Storage period:	Google Analytics stores cookies in your web browser for two years from your last visit. Event data in Google Analytics is deleted after 14 months.
Note:	Google processes the website usage data on our behalf and contractually commits to measures ensuring the security and confidentiality of the processed data. Google Analytics only loads after consent (Consent Mode “Basic”).

Google Tag Manager

Operator:	Google Ireland Limited
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://policies.google.com/privacy?hl=en
Purpose of processing:	Technical integration/control of website tags (container)
Legal basis:	Art. 6(1)(a) GDPR (consent): Tag Manager is only loaded once you have consented to statistics or marketing.
Data transferred:	HTTP request logs; beyond that depending on the tags included in the container
Data subjects:	Website users who have consented to statistics or marketing
Storage period:	According to Google, HTTP request logs are deleted within 14 days.
Note:

Google Search Console

Operator:	Google Ireland Limited
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://policies.google.com/privacy?hl=en
Purpose of processing:	Technical analysis/optimisation of the website’s performance in Google Search
Legal basis:	Art. 6(1)(f) GDPR (legitimate interest: error analysis/optimisation)
Data transferred:	Aggregated performance/search data
Data subjects:	Website users (indirectly, usually aggregated data)
Storage period:	Performance data in Search Console: typically available for 16 months.
Note:	Objection possible where processing is based on legitimate interest (Art. 21 GDPR).

Google Ads

Operator:	Google Ireland Limited (Google LLC where applicable)
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://support.google.com/google-ads/answer/12929169?hl=en
Purpose of processing:	Advertising, conversion tracking, attribution; Enhanced Conversions and offline conversion import: determining whether an ad led to a registration, enquiry or appointment booking
Legal basis:	Art. 6(1)(a) GDPR (consent), marketing category
Data transferred:	Online identifiers (e.g. gcl), usage/interaction data, IP address where applicable, conversion events; after submitting a form (free trial, contact, appointment booking, webinar): hashed (encrypted, unreadable) email address and the ad click ID. These are transmitted to Google Ads via a Google Apps Script in our Google account – only with consent to marketing.
Data subjects:	Website users who have consented to marketing
Storage period:	Reporting data: available for up to 11 years; conversion cookies (gcl): typically 90 days.
Note:	Consent can be withdrawn at any time via “Cookie settings”.

Google Firebase

Operator:	Google (Firebase)
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://firebase.google.com/support/privacy
Purpose of processing:	App functions (e.g. push notifications) and analysis/monitoring where applicable
Legal basis:	Necessary app functions: Art. 6(1)(b) GDPR; analytics/tracking (where used): Art. 6(1)(a) GDPR
Data transferred:	Device/app information, online identifiers where applicable, push token, usage/event data where applicable (depending on module)
Data subjects:	Users of the BauMaster app
Storage period:	If Firebase/GA4 Analytics is used: up to 14 months
Note:	Only basic modules are used.

LoopedIn (product roadmap roadmap.bau-master.com)

Operator:	MINTDESIGNSUK Ltd (LoopedIn), United Kingdom
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://www.loopedin.io/privacy
Purpose of processing:	Public product roadmap, ideas and product feedback at roadmap.bau-master.com
Legal basis:	Visiting the page: Art. 6(1)(f) GDPR (legitimate interest: providing the roadmap and protection against misuse); submitting ideas and comments: Art. 6(1)(a) GDPR (consent)
Data transferred:	Feedback/communication content; contact details where applicable; technical metadata (e.g. IP address) per use
Data subjects:	Visitors of roadmap.bau-master.com
Storage period:	Per provider; submitted ideas and comments for as long as the roadmap exists or until deleted at your request
Note:	Name and email address only when submitting ideas or comments. According to the provider, data of EU customers is stored with Amazon Web Services in Frankfurt; the provider is based in the United Kingdom (EU Commission adequacy decision). The page also embeds Google Fonts, Google reCAPTCHA and hCaptcha (spam protection) and optionally “Sign in with Google”; in the process, the IP address is transmitted to these providers (including in the USA).

Zoho One (CRM, email marketing, forms)

Operator:	Zoho
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://www.zoho.com/privacy.html
Purpose of processing:	CRM/customer management, communication, email marketing, billing (depending on modules); forms on the website (Zoho Forms: contact, downloads and e-books), linking enquiries to ads (click ID, only with consent to marketing)
Legal basis:	Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR; Art. 6(1)(f) GDPR where applicable; click ID: Art. 6(1)(a) GDPR
Data transferred:	Contact/master data, communication content, contract/billing data where applicable; form entries; technical cookies of the forms
Data subjects:	Customers/prospects
Storage period:	After termination, deletion from the active database in the next clean-up (up to 6 months), backups a further 3 months.
Note:	Data can be deleted immediately on request. Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement); unsubscribe link in every newsletter. Forms load without separate consent because they are the purpose of the respective page.

Involve.me (website)

Operator:	Involve.me
Place of processing:	EU; images via imgix (USA)
Transfer to third countries:	yes – the questionnaire’s images are delivered via the imgix service (Imgix, Inc., USA); according to the provider, Imgix is certified under the EU-US Data Privacy Framework (adequacy decision)
Operator’s privacy policy:	https://www.involve.me/privacy
Purpose of processing:	Forms/surveys (questionnaire on the “Who is it for?” page)
Legal basis:	Loading the questionnaire: Art. 6(1)(f) GDPR (the questionnaire is the purpose of the page and is opened by you); entries: Art. 6(1)(a) GDPR or Art. 6(1)(b) GDPR (depending on the purpose of the form)
Data transferred:	Form/survey entries, contact details (per form), technical metadata (e.g. IP address when loading). No cookies and no browser storage are set when loading. When the questionnaire loads, involve.me also embeds fonts via Bunny Fonts (BunnyWay d.o.o., Slovenia) and images via imgix; your IP address is transmitted to these services.
Data subjects:	Website users
Storage period:	Default settings
Note:	Individual entries are deleted manually

Vimeo

Operator:	Vimeo
Place of processing:	USA and other countries
Transfer to third countries:	Yes
Operator’s privacy policy:	https://vimeo.com/legal/privacy/policy
Purpose of processing:	Embedding videos
Legal basis:	Art. 6(1)(a) GDPR (consent), external media category or click on “Load video”
Data transferred:	Technical data (e.g. IP address), device/browser information, cookies/IDs where applicable (depending on embedding mode)
Data subjects:	Users of the website/app who load embedded videos
Storage period:	Cookies per provider, only after the video is loaded; preview images come from our own server
Note:	Consent can be withdrawn via “Cookie settings”.

YouTube

Operator:	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Place of processing:	Ireland, EU, USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://policies.google.com/privacy?hl=en
Purpose of processing:	Embedding videos (e.g. webinar recordings, blog posts)
Legal basis:	Art. 6(1)(a) GDPR (consent), external media category or click on “Load video”
Data transferred:	IP address, device/browser information, cookies/IDs where applicable (e.g. VISITOR_INFO1_LIVE, YSC)
Data subjects:	Website users who load a video
Storage period:	Per provider
Note:	Where possible in privacy-enhanced mode (youtube-nocookie.com); preview images come from our own server.

ProvenExpert

Operator:	Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany
Place of processing:	Germany/EU
Transfer to third countries:	possible (per provider, safeguarded by appropriate contracts)
Operator’s privacy policy:	https://www.provenexpert.com/en-gb/privacy-policy/
Purpose of processing:	Displaying our review badge in the footer
Legal basis:	Art. 6(1)(a) GDPR (consent), external media category or click on “Load reviews”
Data transferred:	IP address, device/browser information, page visited; short-term buffer in the browser
Data subjects:	Website users who load the badge
Storage period:	Per provider
Note:

Usermaven

Operator:	Usermaven Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA
Place of processing:	Analytics data hosted in Germany (Hetzner Online GmbH); according to the provider mainly in the EEA, individual sub-processors also outside the EU
Transfer to third countries:	possible (provider based in the USA) – safeguarded by EU standard contractual clauses (Art. 46 GDPR)
Operator’s privacy policy:	https://usermaven.com/privacy
Purpose of processing:	Reach measurement and usage analysis of the website; data is transmitted via our own subdomain
Legal basis:	without consent (cookieless, IP shortened): Art. 6(1)(f) GDPR; with cookie: Art. 6(1)(a) GDPR (consent to statistics)
Data transferred:	pages visited, clicks, referrer, device/browser information, shortened IP address; with consent additionally a visitor ID (cookie “__eventn_id_*”). No form contents.
Data subjects:	Users of the website and of rechner.bau-master.com
Storage period:	Cookie “__eventn_id_*”: up to 400 days; analytics data: for as long as the service is used, deleted no later than 30 days after the end of the contract (according to the provider’s data processing agreement)
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement). If consent to statistics is withdrawn, the cookie is deleted.

Convertful

Operator:	Sovereign Net LTD (d/b/a Convertful), Craigmuir Chambers, Road Town, Tortola, British Virgin Islands
Place of processing:	According to the provider, storage in the USA, processing in Europe and the USA
Transfer to third countries:	Yes
Operator’s privacy policy:	https://convertful.com/legal/privacy/
Purpose of processing:	Notice pop-ups (e.g. webinar announcements) and how often they are shown
Legal basis:	Art. 6(1)(a) GDPR (consent), marketing category
Data transferred:	Visitor and session ID (cookies “conv_person”, “conv_session”, “conv_lastEvents”), display and click events, device/browser information
Data subjects:	Website users who have consented to marketing
Storage period:	Per provider
Note:	Only used after consent (marketing category). There is no adequacy decision for the transfer to the USA for this provider; it is based on your explicit consent (Art. 49(1)(a) GDPR). There may therefore be a risk that authorities in the USA access data.

Capterra / Gartner Digital Markets

Operator:	Gartner Digital Markets (Capterra), Stamford, CT, USA
Place of processing:	USA
Transfer to third countries:	Yes – Gartner, Inc. including Capterra is certified under the EU-US Data Privacy Framework (adequacy decision)
Operator’s privacy policy:	https://www.capterra.com/legal_privacy_policy
Purpose of processing:	Measuring the success of listings on software comparison portals (Capterra, GetApp, Software Advice): whether a visit from there led to a registration, enquiry or appointment booking
Legal basis:	Art. 6(1)(a) GDPR (consent), marketing category
Data transferred:	Page views and conversion events, online identifiers, device/browser information, IP address
Data subjects:	Website users who have consented to marketing
Storage period:	Per provider
Note:	Only used after consent (marketing category); can be withdrawn at any time via “Cookie settings”.

Cloudflare Turnstile

Operator:	Cloudflare, Inc., San Francisco, USA
Place of processing:	Worldwide network, including the USA
Transfer to third countries:	Yes – Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision)
Operator’s privacy policy:	https://www.cloudflare.com/privacypolicy/
Purpose of processing:	Protecting the registration forms against spam and automated sign-ups
Legal basis:	Art. 6(1)(f) GDPR (legitimate interest: security); § 165(3) TKG 2021 (strictly necessary)
Data transferred:	IP address, device/browser information, technical signals for detecting automated access; no cookies observed
Data subjects:	Users of the registration pages
Storage period:	Per provider
Note:

Userflow (BauMaster app)

Operator:	Userflow
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://www.userflow.com/policies/privacy
Purpose of processing:	In-app announcements/communication (user guidance)
Legal basis:	Art. 6(1)(f) GDPR (consent)
Data transferred:	Usage/interaction data, online identifiers/IDs where applicable
Data subjects:	Users of the BauMaster app
Storage period:	As long as the BauMaster account exists
Note:

PostHog (product analytics)

Operator:	PostHog Cloud EU
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://posthog.com/privacy
Purpose of processing:	Product/usage analysis to improve the app
Legal basis:	Art. 6(1)(a) GDPR (consent)
Data transferred:	Usage/event data, device information, IDs
Data subjects:	Users of the app/web
Storage period:	Cloud: usually 1 year (free plan)
Note:

Microsoft Teams (meetings)

Operator:	Microsoft (depending on tenant)
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://privacy.microsoft.com/en-gb/privacystatement
Purpose of processing:	Online meetings/communication
Legal basis:	Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (depending on context)
Data transferred:	Meeting/participation data; chat/files/metadata where applicable
Data subjects:	Meeting participants
Storage period:	According to Microsoft’s general policies
Note:

Zoom (meetings/webinars)

Operator:	Zoom
Place of processing:	EU
Transfer to third countries:	Possible
Operator’s privacy policy:	https://www.zoom.com/en/trust/privacy/privacy-statement/
Purpose of processing:	Online meetings/webinars, recordings where applicable
Legal basis:	Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (depending on context)
Data transferred:	Account/participation data, meeting metadata; audio/video/chat/content where recorded
Data subjects:	Meeting participants
Storage period:	Cloud recordings: as long as the account is active
Note:	Recordings are deleted internally once a year

Zoho Desk (support)

Operator:	Zoho
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://www.zoho.com/privacy.html
Purpose of processing:	Support/ticketing, online help
Legal basis:	Art. 6(1)(b) GDPR (contract/pre-contract) and/or Art. 6(1)(f) GDPR
Data transferred:	Contact/master data, support communication content, ticket metadata
Data subjects:	Customers/prospects/users (support requests)
Storage period:	After termination, deletion from the active database in the next clean-up (up to 6 months), backups a further 3 months.
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement)

Zoho Bookings (appointment booking)

Operator:	Zoho
Place of processing:	EU
Transfer to third countries:	no
Operator’s privacy policy:	https://www.zoho.com/privacy.html
Purpose of processing:	Online appointment booking, personal training sessions
Legal basis:	Art. 6(1)(b) GDPR
Data transferred:	Contact details such as name and email, notes; campaign source where applicable (section 5.8); technical cookies of the booking page
Data subjects:	Customers/prospects
Storage period:	After termination, deletion from the active database in the next clean-up (up to 6 months), backups a further 3 months.
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement). The booking page loads without separate consent because it is the purpose of the page.

Notion

Operator:	Notion
Place of processing:	EU (Enterprise plan with EU data residency)
Transfer to third countries:	Yes, limited: for speech and text processing (transcription, summary), Notion uses sub-processors, some of which process data in third countries. Safeguarded by EU standard contractual clauses and additional measures in accordance with Chapter V GDPR; for Enterprise workspaces, zero data retention applies to the AI providers.
Operator’s privacy policy:	https://www.notion.com/privacy
Purpose of processing:	Consultations, online demo, interview, research/UX session, testimonial/use case; transcript and automatic summary with action items via the “AI Meeting Notes” feature – only with the prior consent of all participants
Legal basis:	Art. 6(1)(a) GDPR (consent: transcript, transcription, AI-supported evaluation); Art. 6(1)(b) GDPR (holding the appointment and next steps); Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (documenting consent)
Data transferred:	Contact details (name, email), industry, notes; spoken audio only for live transcription; transcript incl. speaker attribution; automatically generated summary and tasks; meeting metadata (date, duration, participants). No audio or video recording is stored.
Data subjects:	Customers/prospects and participants in online appointments
Storage period:	Transcripts: automatic deletion by the system after 1 year (setting “Automatic transcript deletion: after 1 year”). No audio/video recordings are stored (local audio storage disabled); in the event of an error, an audio copy is kept for a maximum of 3 days for reprocessing. Derived notes and tasks in accordance with section 5.6; early deletion at any time on request.
Note:	Processing on our behalf in accordance with Art. 28 GDPR (data processing agreement). Content is not used to train AI models; no automated decision-making within the meaning of Art. 22 GDPR. Transcript only with prior consent, which can be withdrawn at any time (stop and deletion). Transcripts are only passed on to supporting agencies in anonymised or pseudonymised form on the basis of a data processing agreement. Details in section 5.7.