Data Privacy

This privacy policy informs you about the type, scope and purpose of the processing of personal data within our website and beyond in the case of a contact or a contractual relationship with us, unless otherwise contractually agreed. This privacy policy is applicable regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the website is executed.

For a description of the terms used, such as “personal data” or “processing” of personal data, we would like to refer to the definitions in article 4 of the General Data Protection Regulation (GDPR).

The term “user” describes all categories of data subjects affected by data processing and is to be understood as gender-neutral. The categories include business partners, customers, interested people, and other visitors of our website.

The term “customer” describes all categories of data subjects who have a contractual relationship with us and who are affected by the data processing. The term is to be understood as gender-neutral. The categories include business partners & customers.

The following personal data of the users are processed in the context of the use of our website:

Data of users and customers will only be processed if a legal permission exists and therefore always in compliance with the applicable data protection regulations. This means that we will only process your personal data if one or more of the conditions described below are given:

In the following, we provide you an overview of the legal basis for the conditions – mentioned under point 1.5 – for the permissions to process personal data:

The processing of personal data by Google reCAPTCHA is based on our legitimate interest in ensuring the security of our website, preventing misuse and ensuring the availability of our services (Art. 6 para. 1 lit. f GDPR). Further information can be found in section 3.4. of this privacy policy.

We take organizational, contractual and technical security measures in accordance with the state of the art to ensure that the regulations of the data protection laws are complied with and thus to protect the data processed by us against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons.

The security measures include in particular the encrypted transmission of your data between your browser and our server. The encryption method “Secure Sockets Layer (SSL)” is used for this. We also protect your data by setting appropriate access restrictions to our servers.

We only share personal data of our users and customers with third parties if the transfer is permitted by law. I.e. a transfer of data to third parties only takes place if, for example, this is necessary for contractual purposes – based on article 6 paragraph 1 letter b. GDPR – or on the basis of legitimate interests on our part in the economic and effective operation of our business – according to article 6 paragraph 1 letter f. GDPR.

Insofar we use subcontractors for the provision of our services, we take legal measures as well as technical and organizational measures to ensure the protection of the personal data of users and customers in accordance with the statutory provisions.

If our website uses content, tools or other methods from other providers (hereinafter referred to as ” third-party providers”) whose registered office is located in a third country, it must be assumed that your personal data will be transferred to this third country. A “Third Country” is understood to be a country in which the GDPR is not directly applicable law. Particularly, these are countries outside the European Union or outside the European Economic Area. The transfer of your data to such a third country will only take place if either an adequate level of data protection, a consent by you or otherwise a legal permission exists.

We use the “Google reCAPTCHA” service on our website, which is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google reCAPTCHA is used to ensure that entries in our contact form are made by a natural person and to prevent misuse by automated enquiries. This is done on the basis of our legitimate interest in the security of our website and the prevention of spam attacks in accordance with Art. 6 para. 1 lit. f GDPR.

Google reCAPTCHA analyses various information, such as the IP address, user behaviour on the website, hardware and software used and the time spent on the website by the user. Data may be transmitted to Google servers in the USA.

Further information on Google reCAPTCHA and Google’s privacy policy can be found at https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/about/.

As Google reCAPTCHA is necessary for the security and functionality of the website, the service is also used in the consent layer without consent. However, you can object to this processing at any time by stopping the use of the website or making the appropriate browser settings.

Insofar as a contractual relationship with you is established and you become our customer, we process your data (e.g. name and addresses as well as contact data) and contractual data (e.g. services used, name of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to article 6 paragraph 1 letter b. GDPR.

Contact data communicated to us by the customer (e.g. company name, first and last name as well as email address & telephone number of a contact person, address) as well as business email traffic, within the scope of the services “Azure” & “Microsoft 365”, are stored on the servers of Microsoft Corporation (hereinafter referred to as “Microsoft”).

This also applies to personal data which are part of orders, contracts, notes or similar documents, as we also use Azure or Microsoft 365 to centrally store documents and share them internally.

Despite Microsoft’s headquarters in the USA, the personal data we process are always stored on servers located in Germany or inside the European Union / inside the European Economic Area.

To additionally ensure the secure handling of this data, we have concluded a data processing agreement with Microsoft. This contract regulates that Microsoft only processes the data within the scope of our order and not beyond.

We use the Calendly appointment service for booking and allocating appointments between interested parties / customers and our employees. Calendly is a tool from the company of the same name, Calendly LLC (hereinafter referred to as “Calendly”). The e-mail address, name, telephone number (if applicable) and the request are stored on Calendly’s servers.

The data is processed on the systems of Calendly. Calendly has its headquarters in the USA and the personal data requested is therefore stored in the USA. As GitHub is headquartered in the USA and stores the data there, data of the user or the customer are transferred to a third country which is not located in the European Union or the European Economic Area.

In order to ensure the secure handling of this data, we have concluded a data processing agreement with Calendly. This contract regulates that Calendly only processes the data within the scope of our order and not beyond.

For the time-related billing of our customer projects, our employees record their working hours in a time recording system that we use. We use Moco, which is provided by hundertzehn GmbH (hereinafter referred to as “hundertzehn”).

We store the company names of our customers in Moco so that we can assign the recorded times to the correct customer for billing purposes. This data is processed on the systems of hundertzehn. hundertzehn has its headquarters in Switzerland and the storage of the company names processed by us (which may be classified as personal data) therefore takes place in Switzerland.

In order to ensure the secure handling of this data, we have concluded a data processing agreement with hundertzehn. This contract regulates that hundertzehn only processes the data within the scope of our order and not beyond.

We bill our customers using the “Moco” web service of hundertzehn GmbH (hereinafter referred to as “hundertzehn” or “Moco”). For this purpose, we store our customer’s data in Moco. hundertzehn is a company headquartered in Switzerland.

At Moco, we store the company name, the first and last name of any contact persons named to us by the customer, the address of the company, contact details (telephone, fax, e-mail) of the company or of any contact persons named to us by the customer. This data is used exclusively for the purpose of invoicing and for sending the invoice by e-mail or post.

In order to ensure the secure handling of this data, we have concluded a data processing agreement with hundertzehn. This contract regulates that hundertzehn only processes the data within the scope of our order and not beyond.

We record our receipts in the form of incoming invoices with GetMyInvoices from fino data services GmbH (hereinafter referred to as GetMyInvoices). For this purpose and through automatic document recognition, the data of our suppliers and, if applicable, our customers are stored with GetMyInvoices. Data is stored within Germany or the EU / European Economic Area.

In order to ensure the secure handling of this data, we have concluded a contract with GetMyInvoices for commissioned data processing. This contract stipulates that GetMyInvoices will only process the data within the scope of our order and not beyond.

We automatically forward the receipts and data collected in GetMyInvoices to Moco of hundertzehn GmbH (hereinafter referred to as ‘hundertzehn’ or ‘Moco’ / see also 4.4) for further processing and, if necessary, for further invoicing. For this purpose, we store our customer’s data in Moco. hundertzehn is a company headquartered in Switzerland.

At Moco, we store the company name, the first and last name of any contact persons named to us by the customer or supplier, the address of the company and contact details (telephone, fax, e-mail) of the company. This data is used exclusively for the purpose of invoicing or billing and for sending the invoice by e-mail or post.

For accounting purposes, documents from Moco are automatically forwarded to DATEV eG (hereinafter referred to as ‘DATEV’). For this purpose, we store the data of our customers and suppliers with DATEV. DATEV is a company whose headquarters are in Germany and therefore in the EU or the European Economic Area. The GDPR is therefore also directly applicable law for DATEV.

At DATEV, we store the company name, the first name and surname of any contact persons named to us by the customer, the address of the company, contact details (telephone, fax, e-mail) of the company. This data is used exclusively for invoicing and accounting purposes and is stored within Germany or the EU / European Economic Area.

In order to ensure the secure handling of this data, we have concluded a contract with DATEV for commissioned data processing. This contract stipulates that DATEV will only process the data within the scope of our order and not beyond.

We carry out our bookkeeping with the help of DATEV eG (hereinafter referred to as ‘DATEV’ / see also 4.6). For this purpose, we store the data of our customers and suppliers with DATEV. DATEV is a company whose headquarters are in Germany and therefore in the EU or the European Economic Area. This means that the GDPR is also directly applicable law for DATEV.

In order to ensure the secure handling of this data, we have concluded a contract with DATEV for commissioned data processing. This contract stipulates that DATEV will only process the data within the scope of our order and not beyond.

In the case of providing domains and SSL certificates, we transfer personal customer data to InterNetX GmbH (hereinafter referred to as “InterNetX”) and store them there. In detail, this includes customer master data (name, first name, address, date of birth), communication data (mail address, telephone number), contract master data (e.g. product, interest), customer history and logs (e.g. about orders), configuration data and stored user IDs. InterNetX is a company headquartered in Germany and therefore in the European Union or the European Economic Area. This means that the GDPR is also directly applicable law for InterNetX.

To ensure the secure handling of this data, we have concluded a data processing agreement with InterNetX. This contract regulates that InterNetX will only process the data within the scope of our order and not beyond. The data is stored in Germany or the European Union / the European Economic Area.

In the context of software versioning, we partly store our source codes on servers of GitHub Inc (hereinafter referred to as “GitHub”). If users or customers are granted access to our source codes on GitHub, this also involves the processing of personal data (in particular contact data such as first name and last name, email address and, if applicable, address) by GitHub. In this case, the data subject usually registers himself or herself at GitHub, so that the data processing no longer takes place in the context of a subcontracting relationship between Evolution Codes OHG and GitHub.

In individual cases, it may occur that personal data is stored in source codes and is therefore also stored on GitHub’s servers as part of the storage of these source codes. The storage of personal data within the source code in this way is, in general, not advised.

As GitHub is headquartered in the USA and stores the data there, data of the user or the customer are transferred to a third country which is not located in the European Union or the European Economic Area.

To ensure the secure handling of this data, we have concluded a data processing agreement with GitHub. This contract regulates that GitHub only processes the data within the scope of our order and not beyond.

To be able to manage projects and project tasks (plan, organize, administer), we use the project management system Jira, within a cloud of Atlassian Pty Ltd (hereinafter referred to as “Atlassian”). If users or customers are granted access to the project management system, this also involves the processing of personal data ( particularly contact data such as first name and last name, mail address and, if applicable, address and, if necessary, a profile picture).

Despite Atlassian’s headquarters in Australia, the personal data processed by us are always stored on servers located in Germany or inside the European Union / inside the European Economic Area.

To ensure the secure handling of this data in addition, we have concluded a data processing agreement with Atlassian. This contract regulates that Atlassian only processes the data within the scope of our order and not beyond.

For the automated sending of emails (e.g. newsletters) we use Mailtrap, a web tool from Railsware Products Studio, LLC. (hereinafter referred to as “Railsware”). If users or customers are granted access to Mailtrap, personal data are also processed. Furthermore, a processing of personal data of the persons affected, who receive the automated emails, takes place. The personal data processed by Railsware may include the mail address, the telephone number, the last and first name, the company name, the bank details, the postal / billing address and the IP address. Furthermore, Railsware may process (e.g. in the context of tracking statistics of sent mails) data containing the client ID of the used web browser, the browser type and also geographical locations.

Since Railsware is headquartered in the USA and stores the data there, user or customer data are transferred to a third country that is not located in the European Union or the European Economic Area.

To ensure the secure handling of this data, we have concluded a data processing agreement with Railsware. This contract regulates that Railsware only processes the data within the scope of our order and not beyond.

Login data (user name and password) provided by the customer may be stored digitally. This data may also contain personal data – e.g. the name of a customer, which is used as a user name or to which the stored data is assigned during storage.

We use 1Password for the storage. This is a service provided by AgileBits Inc (hereinafter referred to as “1Password” or “AgileBits”). Despite AgileBits being headquartered in Canada, the personal data we process are always stored on servers inside the European Union. Personal data are therefore not processed in a third country.

We use Google Analytics to analyse our website as described in section 8 of this privacy policy. In order to ensure the secure handling of the data collected, we have concluded a contract with Google LLC for commissioned data processing. This contract stipulates that Google will only process the data within the scope of our order and not beyond. Furthermore, Google is certified under the Privacy Shield Agreement and thus offers an additional guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

When contacting us (via contact form, Calendly (online appointment booking), email or telephone), we process the information provided by the user or customer exclusively for the purpose of processing the contact request and its processing according to article 6 paragraph 1 letter b. GDPR.

The user’s or customer’s data are stored on the email server of our mail provider Microsoft Corporation (hereinafter referred to as “Microsoft”) when a contact request is made via contact form, via Calendly (online appointment booking) or email.

Despite Microsoft’s headquarters in the USA, the personal data processed by us are always stored on servers located in Germany or in the European Union / in the European Economic Area.

To ensure the secure handling of this data, we have concluded a data processing agreement with Microsoft. This contract regulates that Microsoft only processes the data within the scope of our order and not beyond.

If contact is made via Calendly (online appointment booking), the user’s or customer’s data is also stored on a server of Calendly LLC (hereinafter referred to as “Calendly”).

Calendly is based in the USA and the data is therefore also stored in the USA.

To ensure the secure handling of this data, we have concluded a data processing agreement with Calendly. This contract regulates that Calendly only processes the data within the scope of our order and not beyond.

The storage takes place only as long as it is necessary according to the purpose. I.e., insofar as a business relationship with us arises from the contact request, the customer’s details will be stored in our email inbox on the Microsoft server for 6 years from the end of the year in which they were received – according to legal requirements for the storage of business correspondence. If no business relationship arises from the contact request, the user’s details will be deleted from the Microsoft server after just 14 days.

Based on our legitimate interests – in the context of article 6 paragraph 1 letter f. GDPR – we collect data about every access to the server on which our website and possibly other of our online services are located. This data are stored in so-called “server log files”. The access data include the IP address of the user, the date and time of the page call, the URL called up and the user agent (browser).

The above-mentioned data in the server log files are collected for security reasons – e.g. to investigate acts of abuse or fraud. The data are stored for a period of 30 days and are then deleted. Data that must be retained for evidentiary purposes are excluded from deletion until final clarification of the incident.

The data are stored on servers of DigitalOcean Inc. (hereinafter referred to as “DigitalOcean”), Raidboxes GmbH (hereinafter referred to as “Raidboxes”) or Microsoft Corporation (hereinafter referred to as “Microsoft”).

DigitalOcean is headquartered in a third country (USA), but the personal data are stored on servers in Germany. A transfer of data to a third country (USA) therefore does not take place and the user’s data remain in the European Economic Area. Nevertheless – to ensure the secure handling of this user data – we have concluded a data processing agreement with DigitalOcean. This regulates that DigitalOcean will only process the data within the scope of our contract and not beyond.

Raidboxes is a company whose headquarters are located in Germany and thus in the EU or the European Economic Area. This means that the GDPR is also directly applicable law for Raidboxes. In order to ensure the secure handling of personal data, we have concluded a contract with Raidboxes for commissioned data processing. This contract stipulates that Raidboxes will only process data within the scope of our order and not beyond. The data is stored within Germany or the EU / European Economic Area.

Microsoft is headquartered in a third country (USA), but the personal data are stored on servers in Germany or in the European Union / European Economic Area. A transfer of data to a third country (USA) therefore does not take place and the user’s data remain in the European Economic Area. Nevertheless – to ensure the secure handling of this user data – we have concluded a data processing agreement with Microsoft. This contract regulates that Microsoft only processes the data within the scope of our contract and not beyond.

Cookies are pieces of information that are transmitted from our web server or third-party web servers to users’ web browsers, where they are stored for later retrieval. Cookies may be small files or other types of information storage.

Cookies are stored in the user’s web browser by our web server or third-party web servers for the following cases:

If you do not want cookies to be stored in your web browser, please disable the corresponding options in the system settings of your web browser. Stored cookies can also be deleted in the system settings of the web browser. Please note that the exclusion of cookies may lead to functional restrictions on our website.

Google reCAPTCHA uses cookies to carry out an analysis of user behaviour. These cookies are used to distinguish automated access from legitimate requests. If you do not wish this to happen, you can prevent the storage of cookies by making the appropriate settings in your browser. Please note that this may restrict the functionality of the contact form.

We use Google Analytics, a web analysis service of Google Inc. (hereinafter referred to as ‘Google’) on our website. It is used on the basis of our legitimate interests, i.e. interest in the analysis, optimisation and economic operation of our website within the meaning of Art. 6 para. 1 lit. f. GDPR. GDPR. Google uses cookies for Google Analytics. The information generated by these cookies about the use of the website by the user is generally transmitted to a Google server in the USA and stored there.

In particular, data is transmitted that is used to analyse user behaviour, the end device used (desktop or mobile), the approximate geographical origin, the entry and exit pages. In addition, the IP address – anonymised – is transmitted to Google.

When using Google Analytics, we have always activated IP anonymisation. This means that the IP address of users is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address is not stored before it is truncated. The user’s IP address is also not merged with other Google data.

In order to ensure the secure handling of this data, we have concluded a contract with Google for commissioned data processing. This contract stipulates that Google will only process the data within the scope of our order and not beyond. Furthermore, Google is certified under the Privacy Shield Agreement and thus offers an additional guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Users of our website can prevent their data from being processed as part of the Google Analytics web analysis service by clicking on the button provided in the privacy policy.

Please note that the setting of cookies by our web server must always be authorised in the user’s web browser for the opt-out to be effective. This means that when the ‘Google Analytics Opt-Out’ button mentioned above is used, a cookie is stored by our web server in the user’s web browser. This cookie prevents Google from further processing the user’s data on our website.

 In principle, users can prevent the storage of cookies and thus the transfer of data to Google Analytics by making the appropriate settings in their web browser. Users can also prevent Google from collecting the data generated by the cookie and relating to their use of our website and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de

For more information on Google’s use of data, setting and objection options, please visit the following Google website: https://www.google.de/policies/privacy/partners/ (“How Google uses data when you use our partners’ websites and apps”).

Users and customers have the right to obtain information about the personal data that we store about them. This information is provided free of charge at the request of the user or customer.

Furthermore, the users and customers have the right to correct any incorrect data that we have stored about these users and customers.

Users and customers also have the right to restriction of processing and deletion of their personal data. Where applicable, users and customers may exercise their right to data portability.

In the case of the assumption of unlawful processing of their personal data, users and customers have the right to file a complaint with the relevant regulatory institution.

Users and customers can also revoke their consent, in principle with effect for the future.

The data stored by us will be deleted by us as soon as they are no longer required for their intended purpose, insofar as the deletion does not conflict with any legal retention requirements. If the data are still required for other and legally permissible purposes and are not deleted, their processing will be restricted. I.e. the data will be blocked and not processed for other purposes. This applies, for example, to customer data that must be retained for reasons of commercial or tax law.

The data is stored according to legal requirements for 6 years according to § 257 paragraph 1 HGB (commercial books, inventories, opening balances, annual financial statements, commercial letters, accounting records, etc.) and for 10 years according to § 147 paragraph 1 AO (books, records, management reports, accounting records, commercial and business letters, documents relevant for taxation, etc.).

According to legal requirements, users and customers can object to the future processing of their personal data at any time. Please address the objection to our contact person for data protection – named at the beginning of this privacy policy.

The use of Google reCAPTCHA is based on our legitimate interest and takes place regardless of your consent in the cookie banner. You can object to the processing by no longer using our website or by adjusting your browser settings.

We reserve the right to change this privacy policy in case of changes in the legal situation or changes in the service and the processing of personal data. This only applies, in relation to the declarations on data processing. Insofar as user or customer consents are required for an adjusted privacy policy or components of the privacy policies contain regulations of the contractual relationship with the customers, the changes will only be made with the consent of the users or customers.

Users and customers are requested to inform themselves regularly about the content of the privacy policy.