Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws, as well as other data protection regulations, is:

myinterfacedata, Florian Alraun, Meßhäuser Weg 7, 29614 Soltau, Germany. Email: info@myinterfacedata.com. Phone: +49 30 4397920277

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Personal data is generally processed only with the user's consent, except where prior consent is not possible for factual reasons and processing is permitted by law.

For the technical and organisational security of our data processing operations, we follow the recommendations of the German Federal Office for Information Security (BSI), in particular the BSI IT-Grundschutz Compendium, and implement appropriate measures to ensure an adequate level of protection (Art. 32 GDPR).

3. Legal Basis for Data Processing

Where we obtain the consent of the data subject for processing operations, Art. 6(1)(a) GDPR serves as the legal basis.

For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to take pre-contractual measures (e.g. registration, booking a monthly subscription).

Where processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of our legitimate interests or those of a third party, and those interests are not overridden by the interests or fundamental rights of the data subject, Art. 6(1)(f) GDPR serves as the legal basis.

4. Categories of Data Collected and Purposes

Account data: Upon registration, we collect name (optional), email address, and password (stored in encrypted form). This data is processed for contract performance and account management (Art. 6(1)(b) GDPR).

Payment and subscription data: In connection with paid monthly subscriptions (Pro, Pro+, Business), payment processing is handled entirely by Paddle (Paddle.com Market Limited, 15 Dock Street, London, E1 8JN, United Kingdom), acting as the Merchant of Record. Payment information (e.g. credit card details), billing address, and transaction data are processed exclusively for payment processing and billing history (Art. 6(1)(b) GDPR). Full payment data is stored solely with Paddle; we only store reference data (e.g. Paddle customer ID, subscription ID) and payment status.

Usage data: To provide and improve our services (WMS CSV checks, XML mapping, SQL generator, data validation, barcode generator, ZPL viewer, CSV comparison), we process uploaded files and input data. This data is used solely for the processing task initiated by the user and is not permanently stored unless the data logging feature is active under the selected plan.

Server log data: When accessing our platform, information is automatically stored in server log files: IP address (anonymised after 7 days), browser type and version, operating system, referrer URL, hostname of the accessing device, and time of the server request. This data cannot be attributed to a specific person and is processed for security and system stability purposes (Art. 6(1)(f) GDPR).

5. Cookies, Local Storage and Tracking

Our platform does not set any cookies itself. Technically necessary management of login sessions, language settings and theme preferences uses browser localStorage exclusively. This does not involve tracking and is not subject to cookie consent requirements under applicable law, as it is technically necessary for the operation of the platform.

On the Pricing (/pricing) and Account (/account) pages, JavaScript from Paddle (cdn.paddle.com) is loaded as required for payment processing. Paddle may set technically necessary cookies for fraud prevention and transaction processing purposes. These cookies are set by Paddle under its own responsibility as part of the payment service and are required to provide that service (Art. 6(1)(b) GDPR).

We do not use tracking cookies, analytics cookies, or cookies for advertising purposes. No third-party tracking (e.g. Google Analytics) is used.

6. Monthly Subscription – Special Notes on Data Processing

When you take out a monthly subscription, you enter into an agreement with us for recurring monthly services. All payment processing is handled by Paddle (Paddle.com Market Limited, 15 Dock Street, London, E1 8JN, United Kingdom, and Paddle.com, Inc., 2185 The Alameda, Suite 250, San Jose, CA 95126, USA).

Paddle as Merchant of Record: Paddle acts as the Merchant of Record for all transactions. This means Paddle collects payments in its own name, issues invoices, remits VAT, and handles refunds and chargebacks. For the payment transaction, Paddle is therefore your direct contracting party; your contractual service relationship regarding use of the platform remains with myinterfacedata.

Data processed by Paddle: In the course of payment processing, we transmit your email address and selected subscription tier to Paddle. Paddle independently collects and processes your name, billing address, payment information (e.g. credit card details), and transaction data. Paddle processes this data under its own privacy policy, available at https://www.paddle.com/legal/privacy.

Data transfers to third countries: Paddle is headquartered in the United Kingdom, which has been recognised as a safe third country by the European Commission under an adequacy decision pursuant to Art. 45 GDPR. For any data transfers to the USA, Paddle relies on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The requirements of Art. 44 et seq. GDPR are complied with.

Ongoing billing: Monthly automatic charges are processed by Paddle via the payment method you have stored with Paddle. We do not store full payment details ourselves; we only retain reference data (e.g. Paddle customer ID, subscription ID) and payment status.

Cancellation: After cancellation of the subscription, your personal data stored with us will be retained for the duration of the statutory retention periods (generally 10 years for tax-relevant records pursuant to applicable tax and commercial law) and then deleted. Data stored by Paddle is subject to Paddle's own retention and deletion terms under its privacy policy.

Invoices and payment receipts are retained by Paddle and by us for a minimum of 10 years in accordance with statutory commercial and tax law retention obligations.

7. Disclosure of Data to Third Parties

Your personal data will not be transferred to third parties for purposes other than those listed below.

Data processors and independent third parties: We use external service providers (as data processors pursuant to Art. 28 GDPR). In addition, we use Paddle (Paddle.com Market Limited, United Kingdom) as our payment service provider, which in its role as Merchant of Record processes personal data (in particular payment and transaction data) as an independent controller within the meaning of Art. 4(7) GDPR.

Web hosting and database hosting: Our website and database are hosted by 1&1 IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). All servers are located at IONOS's Berlin data centre and are fully subject to the GDPR. Processing is carried out under a data processing agreement pursuant to Art. 28 GDPR. For more information, please see IONOS's privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/.

Transactional email delivery: For the automated sending of technical emails (e.g. registration confirmation, email verification, password reset), we use Amazon Simple Email Service (Amazon SES) provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Email delivery is restricted to the AWS region eu-central-1 (Frankfurt am Main, Germany); data is processed exclusively within the EU/EEA. Processing is carried out under a data processing agreement pursuant to Art. 28 GDPR. For more information, see Amazon Web Services' privacy policy at https://aws.amazon.com/privacy/.

Legal obligations: Where required by law or in response to official requests, data may be transferred to the competent authorities (Art. 6(1)(c) GDPR).

Transfer to third countries outside the EU/EEA only takes place if an adequate level of data protection is ensured (e.g. through EU Standard Contractual Clauses pursuant to Art. 46 GDPR or an adequacy decision by the European Commission).

8. Use of an AI-Powered Voice Assistant for Incoming Calls

To handle incoming phone inquiries in an automated manner, we use the IONOS AI telephone assistant. This system processes call content on our behalf in order to record, forward, or respond to your inquiry. The process involves automatic speech recognition (Speech-to-Text), semantic analysis (Natural Language Processing), and, where applicable, text generation (Text-to-Speech).

Call content may be recorded, transcribed, or documented. This only occurs if you have been informed at the beginning of the call and choose to continue the conversation. You may end the call at any time to prevent processing.

Data processed includes in particular your statements during the call, technical connection data (date, time, duration), and any personal details voluntarily provided such as name or phone number. Interaction data may also be processed, for example relating to the flow of the conversation or disconnections.

The legal bases are Art. 6(1)(b) GDPR (for the initiation or performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient and scalable communication).

For technical implementation, we use sub-processors, particularly for hosting, speech recognition, and semantic analysis. Personal data may be transferred to the USA by the sub-processor. In principle, this is based on an adequacy decision pursuant to Art. 45 GDPR, as the service providers are certified under the EU-U.S. Data Privacy Framework. Where no such decision exists, the transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and supplementary safeguards. The requirements of Art. 44 GDPR are complied with.

To improve speech processing, pseudonymised data may be used for training purposes. Re-identification of individuals is excluded or substantially impeded. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Data is retained only for as long as necessary for the stated purposes. It is then automatically deleted or anonymised.

9. Data Security (BSI Measures)

We implement technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. These measures follow the recommendations of the BSI IT-Grundschutz Compendium and include in particular:

Transport encryption: All data is transmitted exclusively via encrypted connections (TLS/HTTPS).

Password security: Passwords are stored using modern cryptographic hash functions (bcrypt); passwords are never stored in plain text.

Access controls: Data access is restricted to the minimum necessary for service delivery (principle of least privilege).

Regular security reviews: Our systems are regularly reviewed for vulnerabilities.

Data minimisation: We only collect data that is actually required for the respective processing purpose (Art. 5(1)(c) GDPR).

10. Retention Period and Deletion

Personal data is deleted or blocked as soon as the purpose of storage no longer applies and no statutory retention obligations prevent deletion.

Account data: After deletion of the user account, all personal account data is deleted within 30 days, unless statutory retention obligations apply.

Payment and billing data: Retained for at least 10 years in accordance with applicable tax and commercial law.

Server log data: Full IP addresses are anonymised after no more than 7 days; anonymised log data may be retained for up to 90 days for security purposes.

Uploaded files and processing content: Deleted immediately after processing is complete, unless the data logging feature is active under the selected plan.

11. Your Rights as a Data Subject

You have the following rights with regard to personal data concerning you:

Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you.

Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate or incomplete personal data we hold about you.

Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data stored by us, unless processing is required for exercising the right of freedom of expression, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.

Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your personal data.

Right to data portability (Art. 20 GDPR): You may receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or request its transfer to another controller.

Right to object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing.

Right to withdraw consent (Art. 7(3) GDPR): Where data processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, please contact us by email at: info@myinterfacedata.com or by phone at: +49 30 4397920277

12. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).

The competent supervisory authority for Germany is generally the data protection authority of the federal state in which our company is based. An overview of all German data protection authorities can be found at: https://www.bfdi.bund.de

13. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to ensure it always reflects current legal requirements or to implement changes to our services, e.g. upon the introduction of new services or changes to the legal framework.

The updated Privacy Policy will apply from the time of your next visit. The date of the last update is indicated at the top of this page.