Effective date: March 22nd, 2022
For any questions about our privacy policy or your personal data, please contact us via email at [[email protected]].
-
GENERAL INFORMATION
Codepan GmbH, with registered office at Paul Lincke Ufer 8b, 10999 Berlin, Germany, registered at the Amtsgericht Berlin-Charlottenburg no. HRB 190925 B (hereinafter, “Codepan”, “Us”, “We” or “Our”), knows how important privacy is to its customers (hereinafter, “You” or “Your”), and strives to be clear about how personal data is collected, used and disclosed.
This privacy policy (hereinafter, the “Privacy Policy”) provides an overview of Our privacy practices and tells You about the information that We collect when You access or use Our services via the website www.codepan.com (hereinafter this site will be referred to as the “Site”, while any software, service or SaaS provided via the same Site will be hereinafter collectively and indistinctly referred to as the “Services”), as well as how We may use or disclose such collected information.
We act as “Data Controller” of your Personal Data.
“Data Controller” means the entity (in most cases, an organisation, but sometimes a person) that directs the reason why Personal Data is processed in the first place and it is the entity that first receives Personal Data and is responsible for it.
“Process”, “Processing” or “Processed” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means the entity (again a person or organisation, etc.) that actually does the Processing or analysis of Personal Data on behalf of the Data Controller.
“Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
We invite You to read this Privacy Policy carefully to understand Our considerations and practices regarding the processing of Your Personal Data. If You do not agree to the practices described in this Privacy Policy, You should not access the Site and/or use Our Services.
-
PRINCIPLES OF THE PROCESSING
We are committed to fully complying with the European Regulation no. 2016/679 (General Data Protection Regulation; hereinafter, the “GDPR”).
Therefore, We have configured Our Site and Services so that the Processing of Personal Data is kept to the minimum necessary.
We have also adopted safeguards and technical and organizational measures in order to protect the rights of data subjects, and to ensure that, by default, only Personal Data which is necessary for each specific purpose of the data is being Processed.
-
PERSONAL DATA WE PROCESS
-
Personal Data Processed. When You access the Site and Our Services, We may collect the following Personal Data:
| Categories | Details | Origin |
| Contact Data | Personal Data that You provide Us when You contact Us by e-mail or any other available means (such as, the “request a demo” or the “Apply now” form in the Site). | Personal Data voluntarily provided by You through various means (e.g., e-mail, website contact form, etc.). |
| Account Data | Personal Data provided by You when You register Your user account for the use of the Services, such as: email address, first name, last name, billing information, payment information. | Personal Data voluntarily provided by You through various means (e.g., e-mail, registration form, sign-in / sign-on via the Site, etc.). |
| Content Data | Personal Data contained in texts, messages, pictures and in any data, content or material transmitted or conveyed through the Services. | Personal Data either: (i) voluntarily provided by You through the access to the Services or (ii) automatically Processed (e.g., created, adapted, structured, stored, etc.) by Us in order to provide You with the Services. |
| Technical Data | Personal Data contained in log information regarding Your visits and use of Our Services, such as: Your interaction with the Site/Services, Your user status (active/inactive), Your last session, Your IP address, proxy server, operating system, web browser and add-ons, device identifier and features, number of sessions, language and location. | Personal Data collected by Us during the provision of the Services. |
| Cookies | Personal Data collected using cookies and other similar technologies. | Please, visit Our Cookie Policy at [link] for further information. |
-
Your responsibility. We will process the above Personal Data in accordance with the GDPR and on the assumption that they refer to You or to third parties who have authorized You to provide them pursuant to an appropriate legal basis which legitimizes the Processing at stake. In this case, unless You accepted a specific data processing agreement with Us, You act as an independent Data Controller, taking on all relevant obligations and responsibilities according to the GDPR. In this regard, You shall indemnify and hold Us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) arose by any claim made by any third party whose Personal Data have been Processed in breach of the applicable law (including, without limitation, the GDPR) as regards to Your obligations as independent Data Controller of the same Personal Data.
-
PURPOSES AND LEGAL BASIS OF THE PROCESSING
-
Purposes. Personal Data above will be processed by Us for the purposes and legal basis specified below:
| Personal Data involved | Purposes | Legal basis |
| Contact Data
Account Data Content Data |
To carry out Our obligations arising from any contracts entered into between You and Us and to provide You with the Services that You requested from Us (e.g., create and manage Your account, provide Our Services, provide custom, personalized content and information, etc.) | This Processing is necessary for the performance of our mutual contractual obligations and/or carried out with Your consent. |
| Contact Data
Account Data Technical Data |
To communicate with You to verify Your account and for informational and operational purposes (e.g., account verification, account management, customer service, system maintenance), including by periodically emailing you Services-related announcements. | This Processing is necessary for the performance of our mutual contractual obligations and/or based on a legitimate interest pursued by Us. |
| Contact Data
Account Data Content Data Technical Data |
To give You access to Our support and customer care services and to enable You to communicate with Our team. | This Processing is necessary for the performance of our mutual contractual obligations, carried out with Your consent and/or necessary for the establishment, exercise or defense of legal claims. |
| Content Data
Technical Data Cookies |
To carry on statistical research / analysis, as well as to report, measure and evaluate the Services’ operation, usability, effectiveness, features and performance (e.g., monitor aggregate metrics such as total number of visitors, traffic, usage, diagnose or fix technology problems, etc.). | This Processing is based on a legitimate interest pursued by Us and/or does not involve Personal Data, as the relevant data may be anonymized. |
| Contact Data | To provide You with information and/or services that You requested from Us (e.g., process the subscription to Our newsletter, etc.). | This Processing is based on Your consent. |
| Contact Data
Account Data Technical Data Cookies |
To ensure compliance with any applicable law (including the GDPR), Our terms and conditions, and our Privacy Policy. | This Processing is necessary for the performance of our mutual contractual obligations and/or for the establishment, exercise or defense of legal claims. |
-
Voluntary nature of the processing. Providing Personal Data for the above-mentioned purposes is voluntary and not mandatory. However, any refusal to provide any of such data may not allow Us to establish and/or continue a contractual relationship with You, or to fulfill Your requests, or to comply with legal obligations to which We are subject.
-
Automated processing. Automated decision-making does not take place on Our Services nor involves Personal Data.
-
DATA RETENTION PERIOD
Personal Data collected by Us will be processed for the time strictly necessary to achieve the purposes referred to in above. In particular: (i) Personal Data needed for the provision of Our newsletter service will be processed until You decide to unsubscribe; (ii) Personal Data needed for the provision of our Services will be processed until the lapse of ten (10) days from Your account termination; (iii) Personal Data whose retention is mandatory under the applicable laws (e.g., tax laws, bookkeeping, etc.) will be retained for a period necessary or permitted to comply with such laws.
-
SECURITY MEASURES TAKEN FOR YOUR SAFEGUARD
-
General. We warrant to maintain (and continue to maintain) appropriate and sufficient technical and organisational security measures to protect Your Personal Data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access, as well as against all other unlawful forms of processing. Please be aware that no security measures are perfect or impenetrable, so We cannot guarantee that unauthorised access, hacking, data loss or a data breach will never occur.
-
Measures and safeguards. Notwithstanding the preceding, we operate with the aim of mitigating the risks associated with processing Your Personal Data through several measures, including without limitation: (i) process only Personal Data that is essential to carry out Our services and legal obligations (data minimisation); (ii) use encryption for securing the Personal Data that We process (e.g., Secure Sockets Layer – SSL); (iii) use company-wide restriction methods for restricting access into the foundation of Our processes, systems and structure, in order to ensure that only those with authorisation and/or a relevant purpose have access to Personal Data and always with their private keys; (iv) make sure that our third-party services provider to whom we may transfer your Personal Data put in place an adequate level of protection thereof when carry on their Processing activities.
-
RECIPIENTS OF YOUR PERSONAL DATA
We share Your Personal Data with the following third parties, to the extent necessary to provide You with the Services and, in any case, in consistency with the purposes and legal basis of proceeding mentioned in this Privacy Policy:
-
Our affiliates, partners and employees. We may share Personal Data with any subsidiary, holding company, associated company, affiliate of, or companies controlled by, or under common control with, Codepan (including their employees and partners), to whom it is reasonably necessary or desirable for Us to Process Your Personal Data for the purposes described in this Privacy Policy.
-
Third-party service providers or consultants. We engage certain trusted third parties to perform functions and provide services to Us, including hosting and maintenance, e-mail, web analytics, database storage and management, operations, customer relationship, and advertising operations. We also require these third parties to maintain the confidentiality and security of Your Personal Data they Process on our behalf. Here is a list of Our service providers involved in the Processing operations:
| Entity Name | Role | Privacy Policy URL |
| Google Inc. | Processor | https://policies.google.com/privacy |
| Atlassian | Processor | https://www.atlassian.com/legal/privacy-policy |
| Microsoft Azure | Processor | https://privacy.microsoft.com/en-gb/privacystatement |
| Github | Processor | https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement |
| Datev | Processor | https://www.datev.com/about-datev/data-protection/ |
| Kenjo | Processor | https://www.kenjo.io/legal/privacy |
| Fellow | Processor | https://fellow.app/privacy-policy/ |
-
Third parties required by laws or authorities. We may disclose Your Personal Data to a third party if: (i) We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request (including to meet national security or law enforcement requirements), or (ii) to protect ourselves, Our customers, or the public from harm or illegal activities. If We are required by law to disclose any of Your Personal Data, then We will use reasonable efforts to provide You with notice of that disclosure requirement, unless We are prohibited from doing so by statute, subpoena or court or administrative order. Further, We object to requests that We do not believe were issued properly.
-
Third Parties recipients of anonymised, de-identified and aggregated data. We may transform Your Personal Data in such a manner (i.e., through anonymisation, de-identification and aggregation) that these data can no longer be attributed to You. Such anonymised, de-identified or aggregated data will be shared to third parties for various purposes, including for business or marketing purposes or to assist third parties in understanding Our users’ interest, habits and usage patterns for certain programs, content, services and functionalities of our Site and/or Services.
-
WHERE YOUR PERSONAL DATA MAY BE TRANSFERRED
We are based in Germany and Your Personal Data may be further transferred to, and stored at, any of our affiliates, partners or service providers mentioned in previous Sect. 7. We will ensure that the jurisdiction in which the recipient third party is located ensures an adequate level of protection of Your Personal Data; if it is not the case, our non-EU service providers mentioned in Sect. 7 above shall be signatories of a data transfer agreement which shall include the “Standard Contractual Clauses for data transfers between EU and non-EU countries” adopted by the European Commission.
Application via Email and application form
Scope of processing personal data
There is an application form on our website which can be used for electronic applications.
The following data is processed:
Your Name
Email address
Curriculum vitae
Open field for commenting
Your consent will be obtained for the processing of your data as part of the sending process and reference will be made to this privacy policy.
Alternatively, you can send us your application by email. In this case, we collect your email address and the information you provide in the email.
After sending your application, you will receive confirmation of receipt of your application documents from us by email.
The data will be used exclusively for processing your application.
Purpose of data processing
The processing of personal data from the application form serves us solely to process your application. If you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the application form and to ensure the security of our information technology systems.
Legal basis for data processing
The legal basis for the processing of the data is the initiation of the contractual relationship at the request of the data subject, Art. 6 (1) (b) GDPR and § 26 (1) BDSG.
Duration of storage
After completion of the application procedure, the data will be stored for up to six months. Your data will be deleted after six months at the latest. In the event of a legal obligation, the data will be stored within the framework of the applicable provisions.
Objection and removal
The applicant has the possibility to object to the processing of personal data at any time. If the applicant contacts us by email via [email protected], they can object to the storage of their personal data at any time. In such a case, your application will no longer be considered.
All personal data stored in the course of electronic applications will be deleted in this case.
-
YOUR RIGHTS
-
Right of access. You are always entitled to receive confirmation as to whether Your Personal Data is being processed or not and, where that is the case, access and receive a copy of such Personal Data in an intelligible form. Furthermore, You are also entitled to receive information concerning: (i) the purposes of the processing; (ii) the categories of Personal Data concerned; (iii) the recipients (or categories thereof) to whom the Personal Data have been or will be disclosed; (iv) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period; (v) the existence of the right to request from Us the rectification or the erasure of Personal Data or the restriction of the Processing of Your Personal Data or to object to such processing; (vi) the right to lodge a complaint with a Supervisory Authority; (vii) the source of the Personal Data; (viii) the existence of automated decision-making; (ix) where Personal Data is transferred to a third country or to an international organization, the appropriate safeguards relating to the transfer.
-
Right to withdraw consent. You are always entitled to withdraw, at any time, Your consent to the Processing of Your Personal Data, both on legitimate grounds (even though they are relevant to the purpose of the collection) and if the Processing is carried out for direct marketing purpose. The preceding will not affect the lawfulness of Your Personal Data Processing based on consent before the withdrawal.
-
Right to rectification, erasure and restriction. You are always entitled to obtain from Us, without undue delay: the rectification or integration of Your Personal Data that are inaccurate or incomplete; the erasure of Your Personal Data that have been processed unlawfully or whose retention is unnecessary for the Purposes; the restriction of Processing, in case You challenge either the accuracy of Your Personal data or the lawfulness of the Processing, or in case We no longer need the Personal Data for the Purposes, but they are required by you for the establishment, exercise or defense of a legal claim.
-
Right to data portability. You have the right to receive Your Personal Data in a structured, commonly used and machine-readable format, as well as the right to transmit those data to another Data Controller without hindrance from Us, where technically feasible.
-
Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects. We may use automated decision-making only if it is authorized by legislation and if You have provided Us with an explicit consent or if it is necessary for the performance of a contract. You can always request a manual decision-making process instead, express Your opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect You.
-
Right to lodge a complaint. You have the right to lodge a complaint before the Supervisory Authority, if You believe that the Processing of Your Personal Data is against the GDPR. Such relevant Supervisory Authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (located at Friedrichstr. 219, 10969 Berlin, tel.: +49 (0)30 13889-0, fax: +49 (0)30 2155050, email: [email protected]).
-
Contacts. Requests to exercise the rights above must be sent by e-mail to [[email protected]] or by post to Codepan GmbH, Paul Lincke Ufer 8b, 10999 Berlin, Germany. Any access request is always completed within one (1) month; however, where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two (2) further months. If this is the case, We will write You within one (1) month and keep You informed of the delay and the reasons thereof.
-
AMENDMENTS TO THIS POLICY
