Privacy policy
Draft – not legal advice. Have it reviewed by a lawyer and fill in the placeholders in [square brackets] before publishing.
This is a translation. The German version is legally binding.
1. Controller
Philipp Küster, Pinspect, Karl-Kübel-Str. 8, 64625 Bensheim, Germany
E-mail: support@pinspect.de, phone: [Phone]
No data protection officer has been appointed, as there is no legal obligation to do so. For any data protection question, contact us at the address above.
2. Summary
This website loads no external fonts, maps or trackers; there is no advertising and no analytics. We process personal data only as far as needed to run the website, answer your requests, operate the shop and the Pinspect app. Exception: when online payment is switched on, the PayPal payment buttons are loaded on the shop's checkout page (section 7).
3. Hosting and server log files
The website and shop are hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data processing agreement (Art. 28 GDPR) [to be concluded in the KAS].
With every request the server automatically stores: IP address, date and time, requested page or file, amount of data transferred, status code, referring page and browser/operating system. This is needed to deliver the website securely and to detect attacks (legitimate interest, Art. 6(1)(f) GDPR). Log files are deleted or anonymised after [number] days [check KAS setting]. The connection is encrypted via HTTPS.
4. Contact by e-mail
If you write to us (info@pinspect.de, support@pinspect.de), we process your e-mail address, name and message to handle your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise (f)). The mailboxes are also hosted by ALL-INKL.COM. We delete messages once your request is settled unless commercial or tax retention periods apply (up to 6 or 10 years).
5. Customer account, cart and order requests
Customer account. When you create an account and order or send a request, we store your e-mail address, password (only as a non-reversible hash), name and company if given (also for the title block in the app), billing address, customer type (business/consumer), company and VAT ID if given, your orders and requests, payments received, cancellations and withdrawals, and the devices signed in with the app (device name, time of last check). Legal basis: pre-contractual steps and performance of a contract (Art. 6(1)(b) GDPR); without this data we cannot conclude a contract. Invoice and payment data are retained due to commercial and tax law (Art. 6(1)(c) GDPR, up to 10 years). Data is stored in a database at ALL-INKL.COM.
Order requests. While online payment is switched off, your selection is sent to us by e-mail as a non-binding request; you receive a confirmation by e-mail.
Sign-in security. To protect against password guessing, failed sign-in attempts are stored with IP address and e-mail for at most 24 hours (Art. 6(1)(f) GDPR).
E-mails. Confirmations (request, order, cancellation, withdrawal) and password reset links are sent from our mailbox at ALL-INKL.COM.
Deletion. Account data is deleted after the contract ends unless retention obligations apply; you can delete your account yourself at any time – in the app or at pinspect.de/shop/konto-loeschen.php (or by e-mail to support@pinspect.de). Without contracts or payments it is deleted completely; otherwise we remove sign-in and e-mail and keep only invoice and contract data.
6. Cookies and local storage
The website itself sets no cookies. Only when you use the shop (pinspect.de/shop/) do we set a strictly necessary session cookie ("pinspect") for sign-in and cart; it is deleted when you close the browser. No consent is required for this (Section 25(2) no. 2 TDDDG). The page header asks our own server whether you are signed in and how many items are in the cart; no new cookie is set by this.
7. Payment via PayPal
When online payment is switched on, payment is made exclusively via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Only on the shop's checkout page do we load PayPal's payment buttons (script from www.paypal.com); PayPal thereby receives your IP address and browser data and may set its own cookies. You enter your payment data (PayPal account, card or direct debit) directly with PayPal in the PayPal window – it never reaches our server. We send PayPal the amount, the order description and an internal order number; PayPal tells us the payment status, transaction or subscription number and payment time. Legal basis: Art. 6(1)(b) GDPR. PayPal may perform credit or identity checks for fraud prevention and may process data outside the EU. PayPal's privacy statement: paypal.com/de/legalhub/privacy-full.
8. Pinspect app
Download. You get the app from Google Play or as a file from our website. Google's privacy policy applies to Google Play; we only receive aggregated statistics from Google (e.g. number of installs).
Data on the device. The app stores projects, plans, pins, photos, videos, comments, forms, work reports and signatures on your device only at first. Without a connected server this data leaves the device only when you share it yourself (PDF, backup file). The app contains no advertising and no analytics, crash reporting or tracking services, and creates no backup in Google's cloud.
Location. With your permission the app stores the GPS position when you place a pin and with every photo, only while the app is open (no background location). Without permission the app works without GPS.
Camera. Photos and videos are taken with your device's camera app. The app's own camera is used only to scan barcodes and QR codes; these images are neither stored nor transmitted.
Building data ("floor plan" and "3D model" tools). When you use these tools, the app sends the entered address or coordinates and – for technical reasons – your IP address to public geodata services to retrieve building outlines and 3D building models: OpenStreetMap (nominatim.openstreetmap.org, overpass-api.de, overpass.private.coffee) and official geodata services of German states and cities (including Hesse: gds.hessen.de, inspire-hessen.de; North Rhine-Westphalia: ogc-api.nrw.de; Baden-Württemberg: owsproxy.lgl-bw.de; Berlin: gdi.berlin.de; Vienna: data.wien.gv.at; and lod2.s3.eu-de.cloud-object-storage.appdomain.cloud). You start the query yourself; no further personal data is transmitted. Legal basis: Art. 6(1)(b) GDPR. The respective operators' privacy notices apply to these services.
Pinspect account and app licence. The app requires a Pinspect account. If you create it in the app, the app sends your e-mail, password, name and company (if given) encrypted to pinspect.de. When you sign in with your account, the app sends your e-mail and password once, encrypted, to pinspect.de and receives an access key (token); the password is not stored on the device. Afterwards the app regularly checks which plan and tools your account has unlocked and uses your name and company for the title block, processing the token, IP address (server log) and time (Art. 6(1)(b) GDPR). You can sign out devices under "My account".
Your company's server (customer portal) and ERP. If you connect the app to your company's Pinspect server or ERP system, the app data mentioned above is transmitted there encrypted (HTTPS). Your company is then the controller; where we operate the server, we process the data as a processor under Art. 28 GDPR based on a separate agreement.
Deletion. Delete local data by uninstalling the app or via "Clear data" in Android settings. Data on a server is deleted by your company, or by us on request to support@pinspect.de.
9. Recipients and transfers to third countries
Your data is received only by the parties named above: our host (processor), PayPal for online payment and, when you use the building tools, the geodata services listed. We do not sell data or pass it on for advertising. The OpenStreetMap Foundation is based in the United Kingdom, for which an EU adequacy decision exists. PayPal may transfer data to third countries (e.g. the USA); see PayPal's privacy statement.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3)). An e-mail to support@pinspect.de is sufficient.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
You may lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.
11. Automated decisions
We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR.
Last updated: [Date]