Customer portal privacy notice

Last updated: 17 October 2026

This notice applies to our customer portal at app.fesity.de. Our website fesity.de has its own privacy policy. The German version (Datenschutzhinweise) is the binding one; this English version is provided for convenience.

1. Controller

SFX E-Commerce, owner Simon Festl
Junkersstr. 20
93055 Regensburg
Germany

Email for privacy requests: datenschutz@fesity.de
Phone: +49 171 2123136

We have not appointed a data protection officer because the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met.

2. Summary

• Only necessary cookies, no tracking: The portal only sets cookies needed for signing in and for your chosen language. We do not use analytics, advertising or tracking tools.
• Servers in the EU: We run the portal, database and files on Google Cloud in the europe-west1 region in Belgium.
• AI only in the EU: For individual functions, e.g. support and evaluating your workflow descriptions, we use AI models at Google Vertex AI (Belgium) and TensorX (Ireland, Finland), without training on your data and without the provider storing the inputs (section 11).
• A human decides: We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.

3. Legal bases

We process personal data on the basis of

• Art. 6(1)(a) GDPR (consent; you can withdraw it at any time with effect for the future, Art. 7(3) GDPR),
• Art. 6(1)(b) GDPR (contract or pre-contractual steps taken at your request, in particular use of the portal),
• Art. 6(1)(c) GDPR (legal obligation, e.g. retention under commercial and tax law),
• Art. 6(1)(f) GDPR (legitimate interests, e.g. secure operation, protection against abuse, proof of approvals).

Storing information on your device and accessing it is additionally governed by Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act, section 6).

4. Hosting and server logs

We run the portal on Google Cloud (services Cloud Run, Cloud SQL, Cloud Storage, Secret Manager and Cloud Logging) in the europe-west1 region in Belgium (EU). Our contractual partner is Google Cloud EMEA Limited, Dublin, Ireland. Google processes the data on our behalf (Art. 28 GDPR).

With every request, your browser transmits technically necessary data to the server: IP address, date and time, requested address, amount of data transferred, status code, browser identifier (user agent) and the previously visited page (referrer). We use this data only to deliver the portal, find errors and fend off attacks (Art. 6(1)(f) GDPR). Google Cloud Logging stores the logs on our behalf for 30 days and then deletes them automatically. If we need individual entries to investigate a specific security incident, we keep them until the investigation is complete.

5. Account and sign-in

Account: An account is created when you set up an account for your company via “Get started for free” or when someone from your company or from us invites you. We store your name, email address, company, your role in the company area (e.g. owner or member) and the language in which we write to you.

Creating an account: When you create an account, we additionally process your first name, last name, company, optionally your website and industry, the page you came from, and the time and version of your confirmation in the form. The purpose is to set up your account and company area and to prepare an initial meeting (Art. 6(1)(b) GDPR).

Sign-in without a password: You sign in with a six-digit code that we send you by email. The code is valid for 15 minutes, allows at most five attempts and is stored by us only as a check value (hash). Links for confirming your email address are valid for 24 hours. We delete expired codes and links after one day.

Invitations: The person inviting provides the email address and role of the invited person. The invitation is valid for 48 hours. The person inviting makes sure that the invited person expects it. The legal basis is Art. 6(1)(b) and (f) GDPR.

Sessions: For each sign-in we store the IP address, browser identifier and expiry time in order to detect abuse (Art. 6(1)(b) and (f) GDPR). We delete expired sessions 30 days after they expire.

6. Cookies and storage in your browser

The portal only sets technically necessary cookies and only stores what is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR):

Apart from the session identifier, the entries contain no identifier. Because these cookies are strictly necessary for the sign-in or language choice you requested, we do not ask for separate consent and do not show a cookie banner. You can delete cookies in your browser at any time; you will then need to sign in again.

We do not use analytics or marketing cookies. The portal does not load fonts, scripts or videos from other providers' servers.

7. Getting started: information about your business and callback request

After creating your account, you can tell us about your business: industry, level of digitalisation, software in use and a description of a workflow in your own words. We use this to prepare the initial meeting (Art. 6(1)(b) GDPR). Please do not enter data of your customers or employees in free-text fields.

Callback: If you request a callback, we store your phone number and the time and version of your consent. We only call you with this explicit consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, e.g. by email to datenschutz@fesity.de or by removing the callback request in the portal.

Retention for prospects: If your enquiry does not lead to a collaboration, we delete or anonymise the contact details of your enquiry (name, email, phone, website, workflow description, consents) twelve months after the enquiry or after your last change to the company profile.

8. Working together in the portal

We work with you in the portal. For this we process the content that you or we create there (Art. 6(1)(b) GDPR):

• Projects, workflows and reports: descriptions of your workflows, project status and reports.
• Documents: files uploaded by you or us. We store them in Google Cloud Storage in Belgium; they can only be downloaded via time-limited, signed links.
• Messages: your messages to us and our replies, with sender and time.
• Appointments: If you book a meeting, we store your email address, the time, the type of appointment and your note, and send you a confirmation with a calendar entry. We hold video calls via Google Meet (part of Google Workspace, section 15).
• Approvals and feedback: If you approve an offer, a delivery or a result, request changes or comment, we store your text, your name, the version and the time. This also serves as proof of the approval (Art. 6(1)(f) GDPR).
• Team: members of your company area and their roles.

Only members of your company and the people responsible for you at our end have access to the data in your company area.

Retention: for the duration of our collaboration. After it ends, we hand over your data on request and delete it no later than three months afterwards, unless statutory retention obligations apply. We delete appointments of prospects without a collaboration 180 days after the appointment.

9. Voice notes, images and texts about your workflows

You can also describe workflows by voice recording, photo or text. This is voluntary and only takes place with your explicit consent (Art. 6(1)(a) GDPR), which we store with time and version. We do not use your voice to identify you. Please do not record conversations with other people and do not show data of your customers.

Retention: We delete recordings, images, texts and any transcripts and evaluations we create from them 180 days after upload, or earlier if you delete them yourself or withdraw your consent. We only keep the information that and when an input was made with consent (proof, Art. 7(1) GDPR).

10. Change log

We log business-relevant changes in the portal (e.g. approvals, invitations, edited entries) with person, time and type of change. This serves traceability and as proof for you and for us (Art. 6(1)(f) GDPR). After twelve months, we replace the reference to the acting person with a check value (pseudonym).

11. Automation, AI and internal agents

We use programs (agents) for internal tasks. They only access data via our own interface, each with its own identity (Google service account) and its own narrowly limited permissions; we log changes made by agents as described in section 10. Agents without explicit permission for personal data only receive filtered data, i.e. without names, email addresses, phone numbers and free text. We delete agent results (e.g. notes for preparing a meeting) after 180 days. Decisions are always made by a human.

AI models: For individual functions we use AI models, e.g. to summarise your workflow descriptions, to transcribe voice notes (section 9), to recognise the software you use or to handle and answer your support requests. For this we exclusively use AI models operated in the EU: Google Vertex AI in the europe-west1 region (Belgium) under our contract with Google Cloud, and TensorX (TensorX Ltd, Dublin, Ireland) with its own servers in Dublin and Helsinki (section 15). Neither provider uses the inputs to train models; TensorX does not store inputs or outputs but processes them in memory only. At TensorX, open models from various developers run on TensorX's own servers; the model developers do not receive any data. Where the task allows it, we first replace names, email addresses, phone numbers and similar details with placeholders (pseudonymisation). If the task needs the full content, e.g. to answer your message in support, the model also processes names and content in plain text, likewise only at the providers named above in the EU. Voice notes are only sent to the model as a recording with your explicit consent so that it can create the transcript. The legal basis is Art. 6(1)(b) GDPR (providing the agreed service), and your consent for voice notes (Art. 6(1)(a) GDPR). We label AI-generated answers as such; you can ask at any time for a human to handle your request. Decisions with legal or similarly significant effects are made by a human (Art. 22 GDPR).

AI services of further providers are only used for content without personal reference, e.g. general research, texts for our website or the software catalogue. We do not pass on data from your company area to them.

12. Emails from the portal

We send sign-in codes, invitations, appointment confirmations and notices about your matters via Google Workspace (SMTP relay, sender portal@fesity.de). Replies to these emails arrive in our mailbox at Google Workspace.

13. Protection against spam and abuse

To prevent automated abuse of forms (e.g. “Create account”), we use the open-source method ALTCHA: when you submit a form, your browser solves a small computing task that it receives from our server. No cookies are set and no data is transmitted to third parties. In addition, the forms contain a field that is invisible to humans.

To limit excessive requests from one connection, we count requests per IP address. For this we do not store the IP address but a check value (hash) calculated from it with a secret key, together with a counter and a timestamp, for forms as well as for sign-in. The counters are valid for seconds to minutes; we delete them after about one day. The legal basis is Art. 6(1)(f) GDPR.

14. When we process data on your behalf

If, as part of an assignment, we process personal data for which you are responsible (e.g. data of your customers or employees), we act as your processor on the basis of a contract under Art. 28 GDPR. Your company is then the controller; this notice does not apply to that processing.

15. Recipients and transfers to third countries

We only pass on personal data where this is necessary for the purposes described. Service providers act on our behalf on the basis of a contract under Art. 28 GDPR:

For Google Workspace we have set the data region to Europe: stored emails and files are kept in data centres in the EU. Transmission and individual processing steps (e.g. for delivery or support) may also take place outside the EU. Google belongs to the US group Alphabet. For Google Cloud, too, we cannot rule out that Google transfers data to the USA in individual cases or accesses it from there, e.g. for maintenance and support. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, Google has agreed to the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

16. Retention at a glance

We back up the database daily; automatic backups are overwritten after 14 days. Before each update we create an additional backup; it is deleted during a later update once it is older than 30 days. Deleted files remain recoverable for seven more days. Until then, deleted data may still be contained in a backup.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Please write to datenschutz@fesity.de.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons.

Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the supervisory authority of your place of residence or work.

18. Obligation to provide data, no automated decisions

For an account and for signing in we need the fields marked as required; without them you cannot use the portal. All other information is voluntary.

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

19. Security

The portal is only accessible in encrypted form (HTTPS). Sign-in works without a password using one-time codes. Company areas are separated from each other; we grant permissions on the principle of least privilege. Keys and credentials are kept in a separate key management service (Art. 32 GDPR).

20. Changes

We update this notice when the portal or the legal situation changes. The version published here applies.

Last updated: 17 October 2026

Website privacy policy →