Legal and Compliance

1 Responsible for data processing

Responsible for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is

Name/company: SweetConnect GmbH
Street, house number: Hohenstaufenstrasse 2
Postcode, city: 40547 Düsseldorf
E-mail: privacy@sweetconnect.io

2 General information on data processing

We process data as part of the operation of our website and our SweetConnect software as well as our Marketplace (website, software and Marketplace hereinafter collectively referred to as “offer”).

This also includes disclosure by transfer to third parties and, if applicable, to so-called third countries outside the European Union (“EU”) and the European Economic Area (“EEA”). Where we transfer data outside the EU or the EEA, we have labelled this accordingly below.

3 Data Processing

The individual data concerned, processing purposes, legal bases, recipients and any transfers to third countries are listed below:

(a) Log file when visiting the website

We log your access to our website. In doing so, we process

• Name(s) of the website(s) accessed,
• Date and time of retrieval,
• the browser type and version
• the operating system you are using
• the referrer URL (the previously visited website),
• Your IP address,
• the requesting provider.

The legal basis for data processing is our overriding legitimate interest in the continuous provision and security of our website in accordance with Art. 6 para. 1 f) GDPR.

The log file is deleted after thirty days, unless it is required to prove or clarify specific legal violations that have become known within the retention period.

(b) Hosting

• To provide our website, we use the services of the web hosting provider Raidboxes GmbH, Hafenstraße 32, 48153 Münster, which processes the data in connection with the operation of the website.
• The legal basis for data processing is our overriding legitimate interest in the provision of the website in accordance with Art. 6 (1) f) GDPR.
• To provide our software, we use the Microsoft Azure service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft Ireland Operations Limited is a subsidiary of the Microsoft Group with headquarters in the USA. Data may therefore be forwarded to Microsoft Online Inc. based in the USA and processed there.
• Microsoft is certified under the EU-US Data Privacy Framework and is covered by the EU adequacy decision for the US.
• The legal basis for data processing in our software is the fulfilment of our contractual obligations in accordance with Art. 6 para. 1 b) GDPR.
• To provide our Marketplace, we use the services of Possehl Online Solutions GmbH, Alois-Senefelder-Allee 1, 86153 Augsburg, Germany, which hosts the Marketplace and processes the data in connection with the operation of the Marketplace on our behalf.
• Possehl uses Amazon Web Services (AWS) from Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg, to host the Marketplace. It is possible that data may also be transferred to Amazon Web Services Inc. in the USA. Amazon is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
• The legal basis for data processing in our Marketplace is the fulfilment of our contractual obligations in accordance with Art. 6 para. 1 b) GDPR.

(c) Contact us

If you contact us, we will process the following data from you for the purpose of processing and handling your enquiry: Name, contact details – if provided by you – and your message.

The legal basis for data processing is our obligation to fulfil the contract and/or to fulfil our pre-contractual obligations pursuant to Art. 6 para. 1 b) GDPR and/or our overriding legitimate interest in processing your enquiry pursuant to Art. 6 para. 1 f) GDPR.

4 User account

(a) In connection with the opening and use of a user account, we process your inventory data (name, e-mail address, position/role) and your usage data (user name, password). This enables you to manage our offers and we can identify you as a customer. The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 a) GDPR.

(b) To facilitate and standardize communication on SweetConnect, the contact details of the organization administrator are made available to registered machine manufacturers on SweetConnect. These contact details are used exclusively for communication purposes on SweetConnect.

5 Downloads

You can download some free content from our website. This may include webinar recordings, e-books, newsletter archives and other content. To enable the download, you must register. The following data will be processed using the corresponding data form: Salutation, title (optional), first name, surname, e-mail address.

The legal basis for data processing is our overriding legitimate interest in optimising the marketing of our offer in accordance with Art. 6 para. 1 f) GDPR.

6 Contract processing

We process your data to fulfil our obligations within the framework of the contractual relationship between you and us.

The legal basis for data processing is the fulfilment of our contractual obligations in accordance with Art. 6 para. 1 b) GDPR and, in individual cases, the fulfilment of our legal obligations in accordance with Art. 6 para. 1 c) GDPR.

7 Customer support (ticket system)

We process your data via our ticket system in order to respond to support enquiries. We process all data that you provide to us via an enquiry, e.g. surname, first name, address, email address, telephone number and the content of the enquiry.

(a) Jira (Atlassian)

As part of our customer support, we use the Jira ticket system from Atlassian, Inc. 350 Bush Street, Level 13, San Francisco, California 94104, USA.

However, we only use data centres that are located within the European Union.

If you have entered into a pre-contractual relationship or contractual relationship with us, the legal basis for data processing is the effective fulfilment of the contract pursuant to Art. 6 para. 1 b) GDPR.

Atlassian is also certified under the EU-US Data Privacy Framework and is therefore covered by the EU’s adequacy decision for the USA.

(b) Freshdesk (Freshworks)

As part of our customer support, we use the Freshdesk ticket system from Atlassian, Inc. 2950 S. Delaware Street, Suite 201, San Mateo, California, 94403, USA.

However, we only use data centres that are located within the European Union.

If you have entered into a pre-contractual relationship or contractual relationship with us, the legal basis for data processing is the effective fulfilment of the contract pursuant to Art. 6 para. 1 b) GDPR.

Freshworks is also certified under the EU-US Data Privacy Framework and is therefore covered by the EU’s adequacy decision for the USA.

8 Electronic messages
(a) Newsletter

n order to provide you with regular information about our company and offers, we offer to send you an e-mail newsletter. When you register for the newsletter, we process the data you entered when registering (e-mail address and other voluntary information). In order to prevent misuse, we will send you an e-mail after your registration in which we ask you to confirm your registration (double opt-in procedure). In order to be able to prove the registration process in a legally compliant manner, your registration will be logged. This includes the time of registration and confirmation as well as your IP address.

The legal basis for sending the newsletter is your consent in accordance with Art. 6 para. 1 a) GDPR. Data processing in connection with the sending of the confirmation email for your registration and the associated data logging is carried out in accordance with Art. 6 Para. 1 f) GDPR on the basis of our legitimate interest in proving your proper registration.

We use Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany, as a service provider for sending the newsletter, to whom we transmit the specified data for processing on our behalf.

(b) Email system messaging software

We will inform you regularly by e-mail about the necessary technical information for using the software and the Marketplace.

We use Mailjet GmbH, Alt-Moabit 2, 10557 Berlin as a service provider for sending these e-mails.

The legal basis is the effective fulfilment of the contract in accordance with Art. 6 para. 1 b) GDPR.

9 Cookies
(a) Use of functional cookies

We use so-called cookies in our website. Cookies are small text files that are stored on your end device (PC, smartphone, tablet, etc.) and saved by your browser.

We use technically necessary session cookies on our website. The use of cookies or comparable technologies is based on Section 25 (2) TTDSG.

(b) Use of optional cookies

Information about the specific cookies we use, their providers and purposes can be found in our consent banner. Your cookie preferences are queried there and you can give us your consent to the respective services required in accordance with Section 25 (1) of the German Data Protection Act (TTDSG), revoke this consent or subsequently adjust your settings. We will then set a cookie in which data on granted or revoked consent is stored.

The data processing is carried out to fulfil our legal obligations in accordance with Art. 6 para. 1 c) GDPR.

10 Analysis tools​
(a) Google Analytics

We use the Google Analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). It is possible that data may also be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 in the USA.

Google is certified under the EU-US Data Privacy Framework and falls under the EU adequacy decision for the US.

We use Google Analytics to analyse your use of the website and the software, to compile reports on the activities within this website and to provide other services associated with the use of the website and thus improve user-friendliness.

When Google Analytics is used, the interactions of website visitors are primarily recorded and systematically analysed using cookies.

We use Google Analytics with the extension “anonymiseIp()”. This truncates IP addresses within the member states of the EU or EEA. If a transmission to Google’s servers in the USA takes place, the full IP address is only transmitted in exceptional cases and shortened there. A direct personal reference is therefore generally excluded. In particular, it is no longer possible to identify the computer or end device of the website visitor.

The following data is processed through the use of Google Analytics:

• Parts of the IP address of the system accessed by the website visitor (anonymised IP address),
• the accessed website,
• the website from which the user accessed the page on our website (referrer),
• the subpages that are accessed from the website,
• the time spent on the website,
• the frequency of visits to the website.

The use of cookies or comparable technologies set by Google takes place with your consent on the basis of Section 25 (1) sentence 1 of the GDPR. The legal basis for data processing in the context of the aforementioned Google services is your prior consent in accordance with Art. 6 para. 1 a) GDPR.

You can revoke your consent at any time with effect for the future by adjusting your preferences in our consent banner.

(b) Matomo

We use the Matomo analysis tool on our Marketplace. When you visit the Marketplace, information about your use of the website (including IP address) is stored in cookies. We process the information in order to analyse your use of the Marketplace.

We use Matomo with the extension “anonymiseIp()”. This truncates IP addresses before transmission. A direct personal reference in connection with the stored data is therefore fundamentally excluded.

If you consent to data processing via our consent banner, we will process the following data about you:

• Order details (order number; shipping and payment method)
• the website from which the user accessed the page on our website (referrer),
• the subpages that are accessed from the website,
• Statistics on A/B tests (statistics on the user’s decision for two available website layouts)

You can prevent the collection of data by activating the Do-Not-Track option in your browser. Please note that you will have to set the cookie again if you delete the cookies in your browser.

The use of cookies or comparable technologies takes place with your consent on the basis of § 25 para. 1 sentence 1 TTDSG. The legal basis for data processing is your consent in accordance with Art. 6 para. 1 a) GDPR.

11 External content

We use dynamic content (“content”) from third parties to optimise the presentation of our website. When you visit our website, a request is automatically sent to the server of the respective content provider via an interface, during which certain log data (e.g. the user’s IP address) is transmitted. The dynamic content is then transmitted to our website and displayed there.

We use external content in connection with the following functionalities:

(a) Integration of YouTube videos

We have integrated videos from the “YouTube” portal of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. Google does not store any cookies in your browser.

The legal basis for the processing is your prior consent pursuant to Art. 6 (1) a) GDPR.

It cannot be ruled out that data will be transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google is certified under the EU-US Data Privacy Framework and is therefore subject to the EU adequacy decision for the USA.

(b) Google Fonts

To make our website visually appealing, we use external fonts from Google Fonts. These are loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) when you visit the site. Google does not store any cookies in your browser. However, according to our information, the IP address of the user’s end device is transmitted to Google and stored. The processing is carried out on the basis of our overriding legitimate interest in optimising the marketing of our offer in accordance with Art. 6 para. 1 f) GDPR.

It cannot be ruled out that data will be transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google is certified under the EU-US Data Privacy Framework and is therefore subject to the EU adequacy decision for the USA.

(c) Google Forms

To make our website more attractive, we use web forms from Google Forms. These are loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) when you visit the site. Google does not store any cookies in your browser. However, according to our information, the IP address of the user’s end device is transmitted to Google and stored. The processing is carried out on the basis of our overriding legitimate interest in optimising the marketing of our offer in accordance with Art. 6 para. 1 f) GDPR.

It cannot be ruled out that data will be transmitted to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google is certified under the EU-US Data Privacy Framework and is therefore subject to the EU adequacy decision for the USA.

12 Duration of data storage

We only store personal data for as long as is necessary for the purposes for which it is processed or for as long as you have withdrawn your consent. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 10 years, regardless of the processing purposes.

13 Your rights as a data subject
(a) Information

On request, you can obtain information about all personal data that we have stored about you at any time and free of charge.

(b) Rectification, erasure, restriction of processing (blocking), objection

If you no longer consent to the storage of your personal data or if it has become incorrect, we will arrange for the deletion or blocking of your data or make the necessary corrections (insofar as this is possible under the applicable law) if instructed to do so. The same applies if we are only to process data to a limited extent in future. You have the right to object in particular in cases where your data is required for the performance of a task carried out in the public interest or where the data processing is based on our legitimate interest, as well as profiling based on this. You also have the right to object in the case of data processing for the purpose of direct advertising.

(c) Right to withdraw consent with effect for the future

You can revoke your consent at any time with effect for the future. Your revocation does not affect the legality of the processing up to the time of revocation.

(d) Data portability

If data processing is carried out on the basis of a contract, pre-contractual negotiations, consent or with the aid of automated procedures, you have the right to data portability. Upon request, we will provide you with your data in a commonly used, structured and machine-readable format so that you can transmit the data to another controller if you wish.

(e) Restriction of processing

Data for which we are not able to identify the data subject, e.g. if it has been anonymised for analysis purposes, is not covered by the above rights. Information, deletion, blocking, correction or transfer to another company may be possible with regard to this data if you provide us with additional information that allows us to identify you.

(f) Exercising your rights as a data subject and right to lodge a complaint

If you have any questions regarding the processing of your personal data, information, correction, blocking, objection or deletion of data or if you wish to transfer the data to another company, please contact privacy@sweetconnect.io.

You also have the option of complaining to a supervisory authority about your rights as a data subject.