Privacy policy

This privacy policy applies to the website sunventory.de and to the mobile Sunventory apps for iOS and Android (bundle or package identifier de.sunventory.app). It informs you about the nature, scope and purpose of the processing of personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Sunventory UG (haftungsbeschränkt)
Kurfürstendamm 102
10711 Berlin
Germany
Represented by the managing director: Bastian Maaßen
Email: bastian.maassen@sunventory.de

Registered in the commercial register of the Amtsgericht Charlottenburg (Berlin) under HRB 289934 B. For questions about data protection, please contact the address or email address above.

Principle, hosting and data residency

We process personal data according to the principle of data minimisation and exclusively within the European Union.

• Hosting: The website and the backend of the apps are operated on servers of IONOS SE (Elgendorfer Straße 57, 56410 Montabaur). The data centres used are located in Germany.
• Database: Application data is stored in a PostgreSQL database on the same backend hosted in Germany.
• Data residency: Data processed in the apps and on the website is processed exclusively in Germany at IONOS and does not leave the EU. Transactional email (invitations, password resets, verification) is also sent via the IONOS mail server operated in Germany (see Contact and email). No US cloud is used.
• No tracking in the apps: The mobile apps (iOS and Android) contain no external analytics tracking; there are no third-party analytics, advertising or tracking SDKs. No advertising IDs are processed and no cross-app tracking takes place.
• On-device document recognition: Text recognition of delivery notes (OCR) takes place exclusively on your device: on iOS via Apple's Vision framework, on Android via Google ML Kit (on-device text recognition and document scanner). For recognition, no images or text are transmitted to third parties or to the cloud; no AI cloud services are used.

Where we have individual processing operations carried out by service providers (processors), this is done on the basis of contracts under Art. 28 GDPR. The processors used are named below.

Visiting the website and server log files

When you visit sunventory.de, the web server automatically records information that your browser transmits and that is technically necessary to display the website to you and to ensure its stability and security. This includes in particular:

• the shortened/anonymised IP address,
• date and time of access,
• the requested file or URL,
• the browser type and operating system used,
• the amount of data transferred and the HTTP status code.

Retention period: These server log files are stored for a maximum of 14 days and then deleted automatically.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free, secure and stable operation of the website.

Audience measurement

For statistical analysis of website usage we may use a self-hosted analytics solution (Plausible or Umami) operated on our server located in Germany.

• No cookies are set.
• There is no transmission to third parties; the data remains on our server.
• Analysis is based on aggregated metrics that are not directly personal (e.g. page views, referrers, anonymised indicators).

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the needs-based, data-minimising design and improvement of our online offering.

Appointment booking

To arrange demo appointments we operate a self-hosted online booking tool; no external booking service is used. When you book an appointment, we process the data you provide (first and last name, email address, job title and company name, optionally company size and the email addresses of guests you invite) together with the chosen slot in order to organise, confirm and hold the appointment.

Booking data is stored in our application on servers in Germany. We send the confirmation including the calendar invitation (.ics) by email via our email service (see Contact and email); if you have named guests, they receive the confirmation in copy. You can cancel the appointment at any time via the link in the confirmation.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request). Booking data is not passed on to third parties; only for sending email do we use the service provider named under Contact and email.

Contact and email (IONOS)

If you contact us by email or via a contact form, we process your details to handle your enquiry.

For transactional email (in particular invitations, password resets and verification emails) we use the email service of IONOS SE (Elgendorfer Straße 57, 56410 Montabaur), operated within Germany. The data required for sending is processed, in particular the recipient's email address and the content of the respective message. No transfer to a third country takes place.

Legal basis: Art. 6 (1) (b) GDPR, insofar as the communication serves the initiation or performance of a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries and in the reliable sending of system-related emails). A data processing agreement under Art. 28 GDPR is in place with IONOS.

Processing in the mobile apps (iOS and Android)

The Sunventory apps for iOS and Android are the mobile companion apps to the web platform and serve to capture and manage material logistics on construction sites. The following processing operations take place as part of your use of the apps and apply equally to both platforms unless a distinction between iOS and Android is expressly made below.

Categories of data processed

• Account data: name, email address, role (site management, procurement, asset management, operations) and language setting.
• Delivery note and material photos: photos you take or select from your photo library to document a goods receipt.
• Delivery and bill-of-materials data: details of deliveries, suppliers, items, quantities as well as planned/actual values and shortfalls per site.

Permissions

The app requests only the following permissions:

• Camera and photo library: exclusively for taking or selecting delivery note and material photos. No further analysis of your photo library takes place.

On Android, capture uses the system document scanner and the system photo picker (Android Photo Picker); no separate runtime permissions for camera or photo library are requested for this.

Document recognition (OCR)

When capturing a goods receipt you can photograph the delivery note. Text recognition takes place exclusively on the device: on iOS via Apple's Vision framework, on Android via Google ML Kit (on-device text recognition and document scanner). Supplier and line items are recognised, matched against the site's bill of materials and shown to you as a suggestion; you review and confirm the values. For recognition, no images or text are transmitted to third parties or to the cloud, and no AI cloud services are used.

Storage and data flow

• Data captured in the apps is stored exclusively on the IONOS backend hosted in Germany.
• Offline capture is possible; captured data is held in a local queue and transmitted as soon as a connection is available again.
• The apps contain no tracking, no audience measurement via third parties and no processing of advertising IDs. There are no third-party analytics, advertising or tracking SDKs; the on-device components used for text recognition (Apple Vision or Google ML Kit) work locally on the device and do not transmit content to third parties.

Authentication

Sign-in uses JSON Web Tokens (JWT). The authentication token is stored securely on the device: on iOS in the iOS Keychain, on Android encrypted (AES-256) via EncryptedSharedPreferences with the key in the Android Keystore.

Legal bases

• Art. 6 (1) (b) GDPR for processing necessary to provide the contractually agreed functions and for the use of the app by you and your employer or company (performance of contract or user relationship).
• Art. 6 (1) (f) GDPR for the secure and stable technical operation of the app and the backend (legitimate interest).

Sunventory is multi-tenant. If you are invited as a user by a company, your usage data is generally processed on behalf of and under the responsibility of that company; in that respect, its privacy notices apply in addition.

Retention period

We process and store personal data only for as long as necessary to achieve the respective processing purpose or as long as statutory retention obligations exist. Server log files are deleted after a maximum of 14 days (see Visiting the website and server log files). Account and application data is deleted as soon as it is no longer needed for the contractual or user relationship and no statutory retention periods stand in the way.

Your rights as a data subject

Under the GDPR you have in particular the following rights:

• Access (Art. 15 GDPR) to the data processed about you.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data.
• Erasure (Art. 17 GDPR), unless statutory obligations stand in the way.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Objection (Art. 21 GDPR) to processing based on Art. 6 (1) (f) GDPR, on grounds relating to your particular situation.

To exercise your rights, an informal message to the address or email address given above under Controller is sufficient.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for the controller is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

Changes to this privacy policy

We reserve the right to amend this privacy policy to adapt it to changed legal situations or to changes in our services and data processing. The current version published on the website sunventory.de applies. The date given above indicates the last update.