Information obligations

Information pursuant to Art. 13 GDPR

for new contacts in the context of our business relationships

Controller responsible for data processing

Katiba Technology GmbH

Heisinger Straße 12

D-87437 Kempten

Germany

Purposes of data processing

We only process your personal data in compliance with the relevant data protection regulations.

We use your data to respond to enquiries, to contact and communicate with you about your concern and to perform contracts.

We store and process your data in our internal administration programs, email program and office programs. If you book a package or use our free trial licence, your data will also be used to assign user rights in our product LeadTable.

Access to your data is defined by a rights and roles concept and is only granted to the group of people required for the respective purpose.

Legal basis for processing

The legal basis for processing your personal data is primarily Art. 6(1)(b) GDPR. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract.

Where applicable, we also base processing on Art. 6(1)(f) GDPR. Processing takes place on the basis of legitimate interests. We assume that processing, for example for communication purposes, is also in the interests of the data subject. This also covers the storage of your data in our systems.

For certain other processing operations, we also rely on your consent (Art. 6(1)(a) GDPR). In these cases, we obtain your consent separately.

Your personal data may also be processed on the basis of applicable laws (Art. 6(1)(c) GDPR).

Storage period or criteria for determining the period

We only retain the data you provide to us for as long as necessary to fulfil the purposes stated above or as required by the various retention periods laid down by law. For example, the retention period for your data may derive from Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO). These require every merchant to retain commercial books for 10 years and commercial letters (including contract-related emails) for 6 years. The retention period begins at the end of the calendar year in which the last entry was made in the commercial book or the commercial letter was received or sent.

Once the respective purpose no longer applies or the relevant periods have expired, your data will be routinely blocked or deleted in accordance with the statutory provisions.

Disclosure of your data to third parties

We only transfer your personal data to third parties if this is permitted by law or you have given your consent.

We pass your data on to the following service providers for the purposes described:

Brevo (formerly Sendinblue) – sending newsletters (if you have subscribed) and notifications within LeadTable

Stripe (payment service) – payment processing

Amazon Web Services – cloud hosting & infrastructure

MongoDB Atlas – database hosting

Vercel Inc. – front-end hosting

Sentry (Functional Software Inc.) – error tracking

ChartMogul GmbH & Co. KG – CRM/KPI management

HubSpot Germany GmbH – CRM management

Intercom, Inc. – support activities in connection with use of the software

Some of these providers (e.g. Intercom, Stripe, Vercel, Sentry) are based in the USA. Data is transferred on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Data transfer to a third country or an international organisation

Third countries are countries in which the GDPR is not directly applicable law. In principle, this includes all countries outside the EU or the European Economic Area.

No direct transfer of data to a third country or an international organisation takes place without a legal basis.

As we use Microsoft services, we cannot rule out (despite servers being set to the EU/Germany) that data may be transferred to a third country.

The following applies to data transfers to the USA: since July 2023, there has been an adequacy decision by the European Commission (Data Privacy Framework) recognising the USA as a third country with a level of data protection comparable to that of the EU. The adequacy decision can now serve as the basis for data transfers to certified organisations in the USA.

According to the list of certified companies published by the US Department of Commerce, Microsoft Corporation and Twilio Inc. (SendGrid) are listed as certified companies.

Withdrawal of consent

Where processing is based on consent, you may withdraw your consent to the use of your data for internal purposes at any time with effect for the future. To do so, simply send an email to datenschutz@lead-table.com. You may of course also send your withdrawal in writing by post to the address given for the controller.

Information on your rights as a data subject

You have the right to obtain information from us about the data we process about you (Art. 15 GDPR). You can also request that we correct inaccurate personal data about you (Art. 16 GDPR). Where applicable, you can request that the personal data processed about you be erased (Art. 17 GDPR) or that processing be restricted (Art. 18 GDPR). In certain cases, you also have the right to data portability (Art. 20 GDPR). Under certain circumstances, you can also object to processing (Art. 21 GDPR).

Contact details of the data protection officer

Datenschutzkanzlei Lenz GmbH & Co. KG

Sven Lenz

Bahnhofstraße 50, D-87435 Kempten

Phone: +49 831 930653-00

If you have any questions about data protection or other data protection matters, please email our data protection team: datenschutz@lead-table.com

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that your personal data is not being processed lawfully.

The address of the supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 27, 91522 Ansbach, Germany

Phone: +49 981 53-1300

Fax: +49 981 53-981300

You can open the complaint form via the following link: https://www.lda.bayern.de/de/beschwerde.html

Changes to our privacy notice

We reserve the right to amend our privacy notice at short notice so that it always complies with current legal requirements.

‍