Information about data processing

Privacy policy

1. Controller

Moritz Göppner Consulting GmbH
Im Stöckig 71
90765 Fürth
Email: info@postenheld.com

2. Data we process

When operating POSTENHELD, we process account and contact details, roles and location assignments, technical access and security data, and the operational data entered by the customer. This may include items, production rules, recipes, batch details, To Dos, invoice data, print logs and voluntarily submitted help, feedback and feature requests. When billing is enabled, payment data is processed directly by Stripe; POSTENHELD does not store complete card or bank details.

3. Purposes and legal bases

Processing is carried out to provide and secure the service, perform the contract, bill customers and meet legal obligations. Where customers process personal data of their employees in POSTENHELD, processing takes place on the respective customer’s instructions under a data-processing agreement.

4. Email communication

Necessary customer information about operations, security, incidents, billing or material changes to the booked service is sent to the stored business or admin address. These messages support contract performance and secure operation and contain no advertising.

POSTENHELD sends newsletters, tips, general product news and offers only with voluntary consent under Art. 6(1)(a) GDPR. To document consent, we store the email address used, time, source and status of consent and any withdrawal. Owners and administrators may manage consent in the company account at any time; every promotional email also contains an unsubscribe link. Withdrawal does not affect the lawfulness of earlier processing and does not affect required contract, security or To Do emails. We currently use neither tracking pixels nor personalised usage profiles for these messages.

5. Recipients and service providers

IONOS is used for hosting, email delivery, backups and technical operations. Stripe may be used for payments, subscriptions and invoices. Other subprocessors are documented in a separate, current list.

6. Retention periods

Account data is stored for the duration of the contract. Operational and log data is deleted or anonymised after the agreed deletion periods unless statutory retention requirements apply. Proof of consent is retained until the relevant evidence and limitation periods expire. Security logs are retained only as long as necessary for evidence and abuse prevention.

7. Help, feedback and feature requests

When you use the protected help area, we store the customer account, user, optional location assignment, category, subject, message, approved safe context and processing history for customer support and contract performance. Other customers cannot see these requests. Resolved or closed cases are generally retained for traceability for 24 months after the latest closure and are then deleted by the daily maintenance process; open cases are not deleted automatically. Legal obligations and legitimate evidentiary interests may require a different period in individual cases.

8. Cookies and local storage

The application uses only technically necessary session information and a local cache for the installable web app. Analytics, advertising and profiling services are not integrated. If such services are added later, suitable consent management will be implemented first.

9. Data-subject rights

Within the scope provided by law, data subjects have rights including access, rectification, deletion, restriction, data portability, withdrawal of consent and objection. They also have the right to lodge a complaint with a data-protection supervisory authority.

10. Security and international transfers

POSTENHELD uses role-based access, tenant separation, encrypted connections, logging and backups. Where service providers process data outside the EEA, the required transfer mechanisms and safeguards are agreed.

Draft status: Before launch, this policy must be legally reviewed and completed against the actual hosting, email, payment and deletion configuration.