Privacy Policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because the statutory requirements for a mandatory appointment are not met. Please direct any inquiries regarding data protection to the contact details given above.

2. Who this policy applies to

• Visitors to this website, including the download area for our SAP software.
• Persons who contact us via the contact form, by email, or by telephone.
• Contact persons at customers, prospective customers, suppliers, and partners, even where we did not obtain their data from them directly (information pursuant to Art. 14 GDPR).

Information about legal entities, such as company name, business address, or commercial register data, is not personal data in itself. It is personal data where it relates to a natural person, for example in the case of sole proprietorships or in connection with a contact person. This policy applies in those cases.

3. Visiting the website

Hosting

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers are located in a data center in Germany. We have concluded a data processing agreement with Hostinger pursuant to Art. 28 GDPR.

Server log files

Each time a page or file is accessed, the web server processes technically necessary access data: IP address, date and time, the address accessed, the amount of data transferred, HTTP status code, the previously visited page (referrer), as well as browser and operating system. This also applies to downloads of our software packages.

Purpose and legal basis

We process this data to deliver the website, to ensure its security and stability, to analyze errors, and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.

Retention period

The log files are available to us for seven days; after that, they are no longer accessible to us. We do not combine them with other data. Hostinger processes the log files as our processor only to the extent required for the operation and security of the hosting or as required by law. Details are set out in Hostinger's privacy information.

4. Cookies, local storage, tracking

This website does not set cookies and does not use comparable storage techniques in your browser. We do not use any analytics, tracking, or marketing services and do not create usage profiles.

Fonts, scripts, and images are loaded exclusively from our own server. No connection to third-party servers is established when you visit the website. A consent banner is therefore not required.

5. Contact form

What data we collect

Inquiry (selection), company, first and last name, and business email address, as well as, optionally, your telephone number and further information in the free-text field. In addition, we store the time of submission and the address of the web page through which the inquiry was submitted. Your IP address is not stored in the ticket; it appears only in the server log files described in Section 3.

How we process the data

The form creates your inquiry as a ticket in our sales project in Jira Cloud. Jira is operated by Atlassian; the ticket data belongs to the product data for which we have set Germany as the storage location (see Section 9). Access is restricted to those employees of ISPICIO GmbH who handle your inquiry. To protect against automated submissions, the form checks technical characteristics of the submission process; no external captcha service is used.

If the handover to Jira fails, we receive a technical error message by email that contains the details of your inquiry so that it is not lost.

Purpose and legal basis

We process your details in order to handle and answer your inquiry and to prepare a quotation. Where your inquiry serves the initiation or performance of a contract with you as a natural person, the legal basis is Art. 6(1)(b) GDPR. For inquiries on behalf of a company, we process the contact data of the respective contact person on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in handling business inquiries and communicating with prospective customers and business partners.

Required information

Inquiry, company, first and last name, and business email address are required so that we can assign and answer your inquiry. Without this information, the inquiry cannot be submitted. Telephone number and “Further information” are optional; we use the telephone number only to call you about your inquiry.

Retention period

If your inquiry does not lead to a business relationship, we delete the ticket as soon as further contact is no longer to be expected, and at the latest three years after the last contact. If a contract is concluded, the periods set out in Section 7 apply.

6. Email and telephone

If you contact us by email or telephone, we process your contact details, the content of your message, and the information needed to handle it. For email, calendar, telephone and video conferences (Microsoft Teams), and the storage of documents, we use Microsoft 365 provided by Microsoft Ireland Operations Limited (see Section 9).

The legal basis is Art. 6(1)(b) GDPR where the communication concerns or prepares a contract with you as a natural person. For contact persons of a company and in all other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in handling business inquiries and communicating with prospective customers and business partners. We store the communication for as long as its handling requires. We retain commercial and business letters for six years pursuant to Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).

Unencrypted emails can be viewed by third parties in transit. For confidential content, please contact us and we will agree on a suitable transmission channel.

7. Business contacts: customers, prospective customers, suppliers

If you work with us as a customer, prospective customer, supplier, or partner, or act as a contact person for such a company, we process the following data:

• Company details: company name, business address, commercial register details (register court, register number, persons authorized to represent the company), VAT identification number.
• Contact details of contact persons: first and last name, role within the company, business email address, business landline and mobile numbers.
• Contract data: quotations, contracts, orders, records of services rendered, invoices, and payment information such as bank details.
• Communication data: correspondence, notes of conversations, contact and support requests.
• License data for our SAP software: an anonymous user name without personal reference, the license key, and the start and end of its validity.

Where the data comes from

From you yourself; from your company, for example when you are named to us as a contact person; from public registers such as the commercial register; and from publicly accessible sources such as company websites and professional networks, for example LinkedIn.

Where we have not obtained your personal data directly from you, we inform you pursuant to Art. 14 GDPR within a reasonable period, at the latest one month after receiving the data. If we use the data to communicate with you, we inform you at the latest at the time of the first communication to you; if disclosure to another recipient is envisaged, at the latest when the data is first disclosed. This does not apply where a statutory exemption from the obligation to inform exists, for example because you already have the information.

Purposes and legal bases

• Initiation, conclusion, and performance of contracts, including preparing quotations, providing services, invoicing, and support: Art. 6(1)(b) GDPR where you are a contracting party yourself, for example as a sole proprietor. For contact persons of a company: Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with our business partners and performing the contracts with their companies.
• Compliance with legal obligations, in particular retention obligations under commercial and tax law: Art. 6(1)(c) GDPR.
• Establishing and defending legal claims and ensuring the traceability of our services: Art. 6(1)(f) GDPR.

Where the data is stored

We manage tickets, support requests, and project documentation in Jira and Confluence (Atlassian Cloud). Email and documents such as quotations and contracts are stored in Microsoft 365. We process invoices and accounting records in DATEV Unternehmen online and use it to make them available to our tax advisor for bookkeeping and annual financial statements. Details on the service providers are given in Section 9.

Recipients

Our processors (Section 9), our tax advisor, banks for payment processing, legal advisors in the event of a dispute, and public authorities where we are legally obliged to disclose data. We do not sell data and do not pass it on to third parties for advertising purposes.

Retention period

For the duration of the business relationship and thereafter in accordance with the statutory periods: commercial and business letters six years, accounting records such as invoices eight years, books of account and annual financial statements ten years (Section 257 HGB, Section 147 AO). We delete the data of prospective customers with whom no contract is concluded as soon as further contact is no longer to be expected, and at the latest three years after the last contact. We retain data for longer only for as long as claims have not yet become time-barred.

8. Support for our SAP software

Support requests regarding ISPICIO_X, ISPICIO_S, and ISPICIO_E reach us by email to support@ispicio.com or via the contact channels specified in your contract. In doing so, we process your contact details, the description of the issue, and the materials you send us for error analysis, such as screenshots or log files. Please send us only what is necessary for the analysis and remove personal data of third parties where possible.

The analysis and log data of your SAP systems remain in your system environment; we have no access to them. During the online license check, the software transmits the license key via an interface to our Jira instance at Atlassian, where the license data is stored (see Section 9). In the process, the IP address of the calling system is processed technically for the duration of the request; we do not store it. Atlassian processes such connection data as our processor in its operational logs.

The legal basis for handling support requests and for checking the license key is Art. 6(1)(b) GDPR (performance of the license or support contract). We base the purely technical, temporary processing of the IP address on Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functional operation of the license check. We store support tickets for the duration of the contract and thereafter in accordance with the periods set out in Section 7.

9. Service providers and transfers to third countries

We use the following service providers as processors pursuant to Art. 28 GDPR. Data processing agreements are in place with all of them.

Transfers to third countries

Atlassian and Microsoft also process data outside the European Economic Area, in particular in the context of support, operations, and group administration, as well as through sub-processors, including in the USA and Australia. The following applies to such transfers:

• Where an adequacy decision of the European Commission exists for the recipient country (Art. 45 GDPR), we base the transfer on it. For recipients in the USA, this applies insofar as they are certified under the EU-U.S. Data Privacy Framework; Atlassian and Microsoft are certified.
• For transfers not covered by an adequacy decision, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR). They form part of our data processing agreements with Atlassian, Microsoft, and Hostinger.
• In addition, the providers protect the data through technical and organizational measures, in particular encryption in transit and at rest as well as access restrictions.

Hostinger and DATEV process our data in data centers in Germany; if Hostinger uses sub-processors outside the European Economic Area, the standard contractual clauses likewise apply. A copy of the safeguards is available on request.

10. Your rights

You have the following rights against us with regard to the personal data concerning you:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future, insofar as we base processing on consent (Art. 7(3) GDPR)

To exercise your rights, a message to info@ispicio.com or to the address given in Section 1 is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority responsible for us is:

11. No automated decision-making

We do not make decisions based solely on automated processing and do not carry out profiling.

12. Data security

The website is delivered exclusively over encrypted connections (HTTPS). This also applies to the transmission of the contact form and to the connection between our server and Jira. Access to our systems is restricted to the persons who need it for their tasks and is protected by multi-factor authentication.

13. Changes to this policy

We update this policy when our processing or the legal situation changes. The version published on this page applies. Last updated: September 8, 2026.