Privacy Policy

Introduction

With the following privacy policy, we would like to inform you which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent in connection with providing our application.

The terms used are gender-neutral.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Last updated: 30 June 2022

Contents

  • Introduction
  • Controller
  • Overview of processing
  • Relevant legal bases
  • Security measures
  • Transfer of personal data
  • Deletion of data
  • Use of cookies
  • Business services
  • Payment procedures
  • Provision of the online service and web hosting
  • Registration, login and user account
  • Contact and enquiry management
  • Amendment and updating of the privacy policy
  • Rights of data subjects
  • Definitions

Controller

Katiba Technology GmbH
Heisinger Str. 12
87437 Kempten, Germany

Email address:

info@lead-table.com

Legal notice:

https://portal.lead-table.com/impressum

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

  • Inventory data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta/communication data.

Categories of data subjects

  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Business and contractual partners.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Security measures.
  • Office and organisational procedures.
  • Managing and responding to enquiries.
  • Feedback.
  • Provision of our online service and user-friendliness.
  • IT infrastructure.

Relevant legal bases

Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or registered office. If more specific legal bases apply in individual cases, we will inform you of these in this privacy policy.

  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Germany. These include in particular the Act on the Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transfers, as well as automated individual decision-making including profiling. It also governs data processing for employment purposes (Section 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships and the consent of employees. In addition, the data protection laws of the individual German federal states may apply.

Security measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input, disclosure, availability and separation of the data. We have also established procedures to ensure that data subjects’ rights are exercised, data is deleted and threats to data are responded to. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principles of data protection by design and by default.

SSL encryption (https): To protect the data you transmit via our online service, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in your browser’s address bar.

Transfer of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content embedded in a website. In such cases, we comply with the statutory requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data to protect it.

Data transfer within the organisation: We may transfer personal data to other units within our organisation or grant them access to this data. Where this disclosure is made for administrative purposes, it is based on our legitimate business and commercial interests, or takes place where it is necessary to fulfil our contractual obligations or where the data subjects have given their consent or there is a legal permission.

This website uses cookies. We use cookies to personalise content and ads, to provide social media features and to analyse traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected from your use of their services.

Cookies are small text files used by websites to make the user experience more efficient.

By law, we may store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission.

This site uses different types of cookies. Some cookies are placed by third parties that appear on our pages.

You can change or withdraw your consent at any time via the cookie declaration on our website.

Find out more in our privacy policy about who we are, how you can contact us and how we process personal data.

Please state your consent ID and the date when you contact us regarding your consent.

Deletion of data

The data we process will be deleted in accordance with the statutory requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person.

Our privacy notices may also contain further information on the retention and deletion of data that takes precedence for the respective processing operations.

Webflow

We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow records various log files, including your IP addresses.

Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are necessary to display the site, to provide certain website functions and to ensure security (necessary cookies).

For details, please see Webflow’s privacy policy: EU & Swiss Privacy Policy | Webflow 32.

Webflow is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in displaying our website as reliably as possible. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details can be found here: EU & Swiss Privacy Policy | Webflow 32.

Data processing on our behalf

We have concluded a data processing agreement (DPA) with the provider named above. This is a contract required by data protection law which ensures that the provider only processes our website visitors’ personal data in accordance with our instructions and in compliance with the GDPR.

Use of cookies

Cookies are small text files or other storage markers that store information on end devices and read information from them – for example, to store the login status of a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used in an online service. Cookies may also be used for various purposes, e.g. to ensure the functionality, security and convenience of online services and to analyse visitor flows.

Notes on consent: We use cookies in accordance with the statutory provisions. We therefore obtain users’ prior consent, except where this is not required by law. In particular, consent is not required if storing and reading information, including cookies, is strictly necessary to provide users with a telemedia service they have expressly requested (i.e. our online service). The revocable consent is clearly communicated to users and contains information on the respective use of cookies.

Notes on legal bases under data protection law: The legal basis on which we process users’ personal data using cookies depends on whether we ask users for their consent. If users consent, the legal basis for processing their data is the consent given. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online service and improving its usability) or, where this is done in the course of fulfilling our contractual obligations, where the use of cookies is necessary to fulfil our contractual obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
  • Persistent cookies: Persistent cookies remain stored even after the end device has been closed. For example, the login status can be saved or preferred content displayed directly when the user visits a website again. The user data collected with the help of cookies may also be used to measure reach. Unless we provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are persistent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw any consent they have given at any time and can also object to processing in accordance with the statutory requirements of Art. 21 GDPR. Users can also declare their objection via their browser settings, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further information on processing operations, procedures and services:

  • Processing of cookie data on the basis of consent: We use a cookie consent management procedure through which users’ consent to the use of cookies, or to the processing operations and providers named in the cookie consent management procedure, is obtained and can be managed and withdrawn by users. The declaration of consent is stored so that it does not have to be requested again and so that consent can be proven in accordance with the legal obligation. Storage can take place on the server side and/or in a cookie (a so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following applies: consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) and the browser, system and end device used.

Business services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships and related measures, and in the context of communication with contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations. These include, in particular, the obligations to provide the agreed services, any obligations to update and remedies in the event of warranty claims and other service disruptions. We also process the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations and the organisation of our company. In addition, we process the data on the basis of our legitimate interests in proper and commercially sound business management and in security measures to protect our contractual partners and our business operations against misuse and threats to their data, secrets, information and rights (e.g. to involve telecommunications, transport and other auxiliary services, as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Within the framework of applicable law, we only pass on contractual partners’ data to third parties to the extent necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about other forms of processing, e.g. for marketing purposes, in this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant to tax law and for commercial books, inventories, opening balance sheets, annual financial statements, the working instructions and other organisational documents required to understand these documents, and accounting vouchers; it is six years for commercial and business letters received and copies of commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, opening balance sheet, annual financial statement or management report was prepared, the commercial or business letter was received or sent, the accounting voucher was created, the record was made or the other documents were created.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply to the relationship between users and providers.

  • Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, phone numbers); contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers; prospective customers; business and contractual partners.
  • Purposes of processing: Provision of contractual services and customer service; security measures; contact requests and communication; office and organisational procedures; managing and responding to enquiries.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legal obligation (Art. 6(1)(1)(c) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Customer account: Contractual partners can create an account within our online service (e.g. customer or user account, “customer account” for short). If registration of a customer account is required, contractual partners will be informed of this and of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. During registration and subsequent logins and use of the customer account, we store customers’ IP addresses together with the access times in order to be able to prove registration and prevent any misuse of the customer account. If customers have terminated their customer account, the data relating to the customer account will be deleted unless its retention is required for legal reasons. It is the customers’ responsibility to back up their data upon termination of the customer account; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
  • Provision of software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as “users”) in order to provide our contractual services to them and, on the basis of legitimate interests, to ensure the security of our service and to develop it further. The required information is marked as such when the order or comparable contract is concluded and includes the information needed to provide and invoice the services, as well as contact information for any queries; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Payment procedures

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, in addition to banks and credit institutions, use other service providers for this purpose (collectively “payment service providers”).

The data processed by payment service providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient-related information. This information is required to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. This means that we do not receive any account or credit card information, but only confirmation or refusal of the payment. In some cases, payment service providers may transfer the data to credit agencies for the purpose of identity and credit checks. For more information, please refer to the terms and conditions and privacy notices of the payment service providers.

Payment transactions are subject to the terms and conditions and privacy notices of the respective payment service providers, which can be accessed on their websites or transaction applications. We also refer to these for further information and for exercising rights of withdrawal, access and other data subject rights.

  • Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers; prospective customers.
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Further information on processing operations, procedures and services:

  • Stripe: Payment services (technical integration of online payment methods); Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); Website: https://stripe.com; Privacy policy: https://stripe.com/de/privacy.

Provision of the online service and web hosting

In order to provide our online service securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online service can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed in the context of providing the hosting service may include all information relating to the users of our online service that arises in the course of use and communication. This regularly includes the IP address, which is necessary to deliver the content of online services to browsers, and all entries made within our online service or on websites.

  • Types of data processed: Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online service and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Email sending and hosting: The web hosting services we use also include sending, receiving and storing emails. For these purposes, the addresses of the recipients and senders, other information relating to the sending of emails (e.g. the providers involved) and the content of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form over the internet. As a rule, emails are encrypted in transit, but (unless end-to-end encryption is used) not on the servers from which they are sent and received. We therefore cannot accept any responsibility for the transmission path of emails between the sender and receipt on our server; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
  • Collection of access data and log files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). Server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g. to prevent server overload (in particular in the event of abusive attacks, so-called DDoS attacks), and to ensure server load and stability; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidence purposes is exempt from deletion until the respective incident has been finally clarified.

Registration, login and user account

Users can create a user account. During registration, users are informed of the mandatory information required, which is processed for the purpose of providing the user account on the basis of the fulfilment of contractual obligations. The data processed includes, in particular, the login information (username, password and an email address).

When our registration and login functions and the user account are used, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests and those of users in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about events relevant to their user account, such as technical changes.

  • Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. email, phone numbers); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; security measures; managing and responding to enquiries; provision of our online service and user-friendliness.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Registration with pseudonyms: Users may use pseudonyms instead of their real names as usernames; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
  • Deletion of data after termination: If users have terminated their user account, their data relating to the user account will be deleted, subject to a legal permission, obligation or the users’ consent; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
  • No obligation to retain data: It is the users’ responsibility to back up their data before the end of the contract upon termination. We are entitled to irretrievably delete all of the user’s data stored during the term of the contract; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Contact and enquiry management

When you contact us (e.g. via contact form, email, phone or social media) and in the context of existing user and business relationships, the information provided by the enquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

Contact requests are answered and contact and enquiry data is managed in the context of contractual or pre-contractual relationships in order to fulfil our contractual obligations or to respond to (pre-)contractual enquiries and otherwise on the basis of our legitimate interests in responding to enquiries and maintaining user or business relationships.

  • Types of data processed: Contact data (e.g. email, phone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Provision of contractual services and customer service; contact requests and communication; managing and responding to enquiries; feedback (e.g. collecting feedback via an online form); provision of our online service and user-friendliness.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: When users contact us via our contact form, email or other communication channels, we process the data provided to us in this context to handle the matter communicated. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships to the extent necessary for their fulfilment and otherwise on the basis of our legitimate interests and the interests of the communication partners in responding to the matters raised and our statutory retention obligations; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Amendment and updating of the privacy policy

Please check the content of our privacy policy regularly. We will amend the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time and please check the information before making contact.

Rights of data subjects

As a data subject, you have various rights under the GDPR, arising in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
  • Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain access to this data, as well as further information and a copy of the data, in accordance with the statutory requirements.
  • Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, to request restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory requirements, or to request its transfer to another controller.
  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Definitions

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined primarily in Art. 4 GDPR. The legal definitions are binding. The following explanations are primarily intended to aid understanding. The terms are sorted alphabetically.

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Controller: “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, transfer or deletion.

‍