Privacy policy

As of 17 October 2026. This is a convenience translation; the German version is binding.

1. Controller

Timo Kessel, Dülkener Straße 2, 41068 Mönchengladbach, Germany, email: [email protected], fax: +49 2161 9044565. You can also contact us via the contact form at provomatic.de/en/contact and via the ticket system in the customer account. There is no telephone support.

No data protection officer has been appointed; there is no legal obligation to do so under § 38 BDSG.

This policy applies to the website provomatic.de including the licence shop and the customer account.

2. Hosting and server logs

The website and the shop run on a server of Hetzner Online GmbH in Falkenstein (Germany); Hetzner processes the data as a processor (Art. 28 GDPR). Backups are transferred in encrypted form to a server in Germany operated by the controller. When a page is requested, the web server stores the IP address, time, requested address, amount of data, browser identifier and referrer. Purpose: secure operation and defence against attacks (Art. 6 (1) (f) GDPR). The server logs and the application and system logs are deleted after 14 days. The pages do not load content from third-party servers (no external fonts, videos or maps); delivery is via Cloudflare (section 3). Only with your consent does the page load the measurement script of Cloudflare Web Analytics (section 6).

3. Cloudflare

To protect against attacks (e.g. overload attacks, bots) and for fast delivery, we route all requests to provomatic.de through the network of Cloudflare, Inc., USA (proxy, protection against overload attacks and bots, firewall, cache). Cloudflare acts as a processor (Art. 28 GDPR; Cloudflare’s Data Processing Addendum is part of its customer terms) and processes the IP address and request data (requested address, time, browser identifier, referrer) and sets technically necessary cookies for bot protection. The legal basis is our legitimate interest in a secure and available service (Art. 6 (1) (f) GDPR); for the cookies, § 25 (2) no. 2 TDDDG. Data may be transferred to the USA; the basis is the adequacy decision on the EU-US Data Privacy Framework insofar as Cloudflare is certified, otherwise the European Commission’s standard contractual clauses. Cloudflare stores the data according to its own retention periods; details are in Cloudflare’s privacy policy. The licence servers (section 12) do not run via Cloudflare.

4. Cookies and local storage

We use tools for audience measurement only with your consent (sections 5 and 6). The shop sets technically necessary cookies (session, login, shopping cart, protection against form misuse); Cloudflare sets cookies for bot protection (section 3). Legal basis: § 25 (2) no. 2 TDDDG, Art. 6 (1) (b) and (f) GDPR. Your browser stores your choice of colour scheme locally (§ 25 (2) no. 2 TDDDG). No consent is required for this. When you pay, the payment providers may use their own cookies or scripts; their privacy policies apply.

5. Consent banner

On your first visit a banner asks whether you consent to audience measurement (category “Statistics”); necessary functions are always active. Accepting and rejecting are equally easy. We store your choice in a cookie or in your browser’s local storage for 12 months so that we do not have to ask you again on every visit; the legal basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (c) GDPR (proof of consent, Art. 7 (1) GDPR). As proof of your consent we store a random identifier, the time, the selected categories and the version of the banner, but no IP address, and keep it for 12 months. You can change your choice or withdraw your consent at any time via the “Cookie settings” link in the page footer; the withdrawal applies to the future.

6. Cloudflare Web Analytics

With your consent we use Cloudflare Web Analytics (Cloudflare, Inc., USA) to measure how often our pages are visited in order to improve the service. The measurement script is loaded only after your consent. This processes the page visited, the referrer, information about browser and device, loading times and your IP address, which Cloudflare processes for the transmission. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time via “Cookie settings” in the page footer. Data may be transferred to the USA; the basis is the adequacy decision on the EU-US Data Privacy Framework insofar as Cloudflare is certified, otherwise the European Commission’s standard contractual clauses. Cloudflare stores the measurement data according to its own retention periods.

7. Customer account and orders

We process name, company, address, email, VAT ID, order data, consents (with time and IP address) and payment status in order to perform the contract (Art. 6 (1) (b) GDPR) and to meet tax and commercial law obligations (Art. 6 (1) (c) GDPR, §§ 147 AO, 257 HGB, 14b UStG; retention 6 or 10 years). The VAT ID is checked with the German Federal Central Tax Office or via VIES.

8. Payment processing

Depending on the payment method, we transmit payment data to:

• Stripe (Stripe Payments Europe, Ltd., Ireland; transfer to the USA possible),
• Mollie (Mollie B.V., Netherlands),
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg),
• for bank transfer, the bank with which we hold our account.

Legal basis: Art. 6 (1) (b) GDPR. These providers are separate controllers and process the data according to their privacy policies. We do not receive complete card or account data. Insofar as data is transferred to the USA, the providers rely on the adequacy decision on the EU-US Data Privacy Framework insofar as they are certified, otherwise on standard contractual clauses.

9. Invoicing

We create invoices with our own software.

10. Communication and support

For requests by email or fax we process your details to handle them (Art. 6 (1) (b) GDPR if the request concerns a contract, otherwise (f)). Emails are stored on our own mail server. We provide support via tickets, email and Discord (Discord Inc., USA). On Discord, Discord’s terms and privacy policy also apply; we recommend not sending confidential data via Discord. Insofar as data is transferred to the USA, the safeguards of Chapter V GDPR apply (adequacy decision on the EU-US Data Privacy Framework insofar as Discord is certified, otherwise standard contractual clauses).

11. Contact form

You can write to us without logging in via the contact form (provomatic.de/en/contact). We process name, email address, subject and message in order to answer your request; a ticket is created from the request in our ticket system. The legal basis is Art. 6 (1) (b) GDPR insofar as the request concerns a contract, otherwise (f) (answering requests). We store the data like support requests (section 15).

12. Licence check of the software

Installations check their licence with our licence servers (license.provomatic.de, license2.provomatic.de, license3.provomatic.de). The licence key, product, domain and version are transmitted; the server’s IP address and the time of the check are stored as well. The raw data is kept for 90 days, after that only the domain and the time of the last check per licence. Purpose: binding the licence to the domain and enforcing the contract (Art. 6 (1) (b) and (f) GDPR). The licence servers are located in data centres of Hetzner Online GmbH in Falkenstein and Nuremberg (Germany) and Helsinki (Finland), i.e. in the EU/EEA; they do not run via Cloudflare. Details are in the privacy information for the software.

13. Status page

At monitor.provomatic.de we show the operating status of our services (Uptime Kuma). The status page contains no personal data, and Uptime Kuma does not store visitors’ IP addresses. The status page runs on a server of MAM-JAHN (sole proprietorship, owner Marco Andreas Martin Jahn) in a data centre in Frankfurt am Main; MAM-JAHN processes the data as a processor (Art. 28 GDPR). When the page is requested, the status page’s web server stores the shortened IP address (for IPv4 without the last byte, for IPv6 only the first 48 bits), time, requested address, status code, referrer and browser identifier; in case of errors it stores the full IP address in the error log. The purpose is the operation and security of the status page (Art. 6 (1) (f) GDPR). Both logs are deleted after 7 days.

14. Recipients

Internal staff; hosting provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (locations Falkenstein and Nuremberg in Germany and Helsinki in Finland); MAM-JAHN, owner Marco Andreas Martin Jahn, Frankfurt am Main, as processor for the status page (section 13); Cloudflare, Inc., USA, as processor (section 3) and, with your consent, for Web Analytics (section 6); payment service providers (section 8); authorities where required by law. Data is not passed on for advertising purposes.

15. Retention

Server, application and system logs 14 days; server logs of the status page as in section 13; data at Cloudflare, including from Web Analytics, according to its retention periods (sections 3 and 6); choice in the consent banner and proof of consent 12 months; check log of the licence servers as in section 12; log of sent emails 90 days; administration log (changes by staff, with IP address) up to 12 months; backups: daily database backups on the server 14 days, encrypted backups on the controller’s own server in Germany up to 12 months, deleted data disappears at the latest when the respective backup expires; contract data until the retention periods expire (6 or 10 years); customer account until deletion after the end of the contract, unless a retention obligation prevents this; support requests and requests by email, fax or contact form until the end of the contractual relationship or until they have been dealt with, and then until the statutory limitation periods expire.

16. Your rights

Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent (Art. 7 (3)). Requests to [email protected]. You can also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia in Düsseldorf.

17. Obligation to provide data, automated decisions

You do not have to provide any data to read the website. Without the details under section 7, no contract can be concluded. There is no automated individual decision-making or profiling.

18. Technical and organisational measures

We transmit data in encrypted form (HTTPS) and limit access to data to what is necessary.