Privacy Policy

1. Data protection at a glance

1.1 General notes and mandatory information

cluetec takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with data protection laws and the present data protection statement.

With this privacy policy, we inform you about the processing of personal data in connection with the use of the products, applications and services offered by cluetec GmbH. For a consistent and simplified presentation, these are referred to collectively below as the “cluetec services”. This includes, in particular, specific services such as “cluetec Audit” or “mQuest”.

Various personal data is collected when you use the cluetec services. Personal data is data that can be used to identify you personally. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission on the internet (e.g. for communication by e-mail) may be subject to security breaches. Absolute protection of the data against third party access is not possible.

1.2 Functioning of cluetec services

The cluetec services are software solutions of cluetec GmbH, headquartered in Karlsruhe, Germany. cluetec GmbH supports its customers with products and services, in particular in the areas of audit management, data collection, surveys, assessments and digital checklists via mobile devices or browser-based applications.

cluetec is a technical service provider. cluetec services are used exclusively by cluetec or by companies that have acquired a license from cluetec for this purpose (hereinafter referred to as “customers”). The cluetec services are provided by cluetec as Software as a Service (SaaS). Direct access to the cluetec services by third parties cannot be ruled out.

In some cases, cluetec customers also operate the software independently in their own data centers. In these cases, the cluetec customer is the sole point of contact for data protection matters, because cluetec does not process personal data in those cases. Please contact the respective cluetec customer directly in such cases.

The following notes provide a simple overview of what happens to your personal data when you use our cluetec services. Personal data means all data that can be used to identify you personally. Personal data may originate both from cluetec customers and from users or be entered by employees of cluetec customers.

This privacy policy relates to the cluetec services. Our customers may provide their users with a customised privacy policy in a designated area (e.g. under Media & Files in cluetec Audit).

The privacy policy for visitors to our website is available at https://cluetec-audit.de/privacy-statement-eu/

2. Data processing when using cluetec services

2.1 Roles and responsibilities

cluetec services are operated as a cloud-based multi-tenant SaaS solution. To the extent that our customers collect, enter, store, analyze or delete personal data in cluetec services, cluetec generally processes this data as a processor on behalf of the respective customer. In this context, the respective customer is the controller within the context of the GDPR and in particular determines the purposes, content, categories of personal data, recipients and retention periods.

To the extent that cluetec processes personal data for the provision, protection, monitoring and further development of the platform, this processing is carried out under cluetec’s own responsibility under data protection law. This includes in particular technical operational data, security logs, telemetry and diagnostic data, as well as data required to detect, analyze and defend against disruptions, misuse and cyberattacks.

2.2 Cookies and similar technologies

The web-based cluetec services use cookies and similar technologies, in particular browser storage, session tokens and security tokens, in order to enable the secure and functional provision of the service.

This includes in particular technologies required for:

• sign-in and session management
• load balancing and system security
• storage of security-related settings
• error analysis and technical provision of the application

These technically required technologies are used to provide the cluetec services securely and in a usable manner. To the extent that personal data is processed in this context, processing takes place for the performance of the service relationship with the respective customer or on the basis of our legitimate interest in the secure, stable and technically proper provision of the cluetec services pursuant to Art. 6 (1) (f) GDPR.

You can configure your browser to inform you about the setting of cookies or to reject cookies in whole or in part. Please note that the functionality of the cluetec services may be limited as a result if technically required functions are affected.

2.3 Technical logs and security logs

When using the cluetec services, log and diagnostic data is processed for technical and security-related purposes. This may in particular include the following data:

• time of access and request
• technical information about the end device used, operating system, browser or app version
• system and status information
• error and performance data
• pseudonymized user and session identifiers
• information about API calls and system events
• security-relevant events and anomalies

This processing takes place insofar as it serves operational stability, troubleshooting, misuse detection, attack detection, system hardening and IT security, on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. Log and security data in Azure is generally stored for up to three months and then deleted or anonymized, unless longer storage is required for the investigation of specific security incidents, the fulfillment of legal obligations, or the establishment, exercise or defense of legal claims.

To the extent that logs document customer-related actions within the application directly, for example as part of audit or traceability functions, cluetec processes this data on behalf of the respective customer.

2.4 User accounts and access management

User accounts may be required for the use of cluetec services. In this context, the data required to set up, manage and use the user account are processed. This regularly includes in particular:

• business email address
• sign-in and authentication information
• role and permission assignments
• profile data configured by the customer

Additional information may be optional depending on the customer’s configuration. This data is processed in the context of providing the service on behalf of the respective customer. The customer decides on the creation, permissions, changes, suspension and deletion of user accounts.

2.5 Customer data and processing on behalf of the customer

The content, form data, audit data, findings, actions, attachments, comments, chat histories, uploaded documents and other data entered in cluetec services by the customer or its users are processed exclusively in accordance with the instructions of the respective customer.

The respective customer determines which personal data is processed in cluetec services and on which legal basis this is done. Therefore, if you have questions about substantive data collection, data subject rights relating to customer data, or the deletion of content, please generally contact the respective customer.

Customer data is deleted in accordance with the contractual agreements, the retention and deletion rules configured by the customer, and after termination of the contractual relationship, unless statutory retention obligations or technically required, temporary residual data in backups prevent immediate deletion.

2.6 Pseudonymized product and usage metrics

To monitor, analyze errors and further develop cluetec services in a user-oriented manner, we use Microsoft Azure Application Insights. In this context, we process pseudonymized telemetry and usage data, in particular regarding performance, stability, error patterns, page views, feature usage and technical usage paths within the application.

No tracking or marketing profiles are created in this context. IP addresses are not stored. Pseudonymized user and session identifiers are processed; directly identifying personal data is not collected in this context.

Processing takes place on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR in providing our cluetec services securely, efficiently, in a user-friendly way and in continuously improving them.

2.7 Data processing by Audit Intelligence

Audit Intelligence includes the AI-supported functions in cluetec services that support analyses, evaluations, summaries, suggestions, search functions and assistance functions in the cluetec services context.

If customers use such functions, the customer data required for this purpose, in particular audit reports, findings, actions, document content, prompts, chat histories, inputs and generated outputs, may be processed. If such content contains personal data, cluetec processes it as a processor on behalf of the respective customer.

To provide Audit Intelligence, cluetec uses services from Microsoft Azure OpenAI and Azure AI Services in EU regions, currently in particular West Europe and Sweden Central. The processing takes place within the EU. The data is processed on a tenant-specific basis and are not accessible to other customers. They are not disclosed to other customers or other model providers and are not used to train generative AI foundation models unless the customer has expressly issued separate instructions or given separate consent.

Prompts, chat histories and generated outputs are treated as part of the customer data. The same contractual and customer-specific rules therefore apply to their storage, retention and deletion as apply to other content stored in cluetec services, including customer-specific retention periods or automated TTL rules.

3. Your rights

You have the right:

• to demand information about your personal data processed by us in accordance with Art. 15 GDPR. You may, in particular, demand information about the purposes of processing, the categories of personal data, the categories of recipients to whom the personal data have been or will be disclosed, the envisaged period of storage, the existence of the right to rectification or erasure or restriction of processing or to object to such processing, the existence of a right to lodge a complaint, where the personal data is not collected from us, any available information as to their source, the existence of automated decision-making, including profiling, and meaningful information about details;
• to demand, in accordance with Art. 16 GDPR, rectification of inaccurate personal data or completion of your personal data stored with us without undue delay;
• to demand, in accordance with Art. 17 GDPR, the erasure of your personal data stored with us, unless processing such data is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• to demand, in accordance with Art. 18 GDPR, the restriction of processing of your personal data, as far as you contest the accuracy of the data, the processing is unlawful and you op-pose the erasure of the personal data and we no longer need the data but you require them for the establishment, exercise or defence of legal claims or you lodged objection against the processing in accordance with Art. 21 GDPR;
• to demand, in accordance with Art. 20 GDPR, to receive the personal data, which you provided to us in a structured, commonly used and machine-readable format or to transmit those data to another controller;
• at any time to withdraw the consent given to us, in accordance with Art. 7 (3) GDPR. The consequence of this is that we are not permitted to continue the data processing based on this consent, and
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority at your habitual residence or place of work or our domicile.
• Please address your request (e.g., data subject requests, requests for information, etc.) to the responsible party, normally the cluetec customer who uses the cluetec services.

If you wish to contact cluetec directly as a processor, please contact us at datenschutz@cluetec.de or via the contact details provided on our website: https://cluetec-audit.de/privacy-statement-eu

4. Security

4.1 Technical and organizational measures

cluetec implements appropriate technical and organizational measures to protect personal data against loss, unauthorized access, unauthorized alteration, unauthorized disclosure and other unlawful or accidental processing. These measures are regularly reviewed and adjusted where necessary, taking into account the state of the art, the implementation costs, the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of the risks.

4.2 Encryption and secure transmission

The transmission of data between end devices, apps, browsers and the cluetec services is encrypted in accordance with the state of the art. In particular, we use TLS-secured transmission channels for publicly accessible connections. Data is also stored in encrypted form in the databases and storage systems we use.

4.3 Tenant separation and access protection

cluetec services are designed as a multi-tenant platform with logical separation of customer data. Access to data is restricted to authorized persons and systems and follows the need-to-know and least-privilege principles. To protect access, we support or use, depending on the usage scenario, role-based access control concepts, single sign-on, multi-factor authentication and modern authentication methods such as passkeys.

4.4 Operational security and resilience

To ensure the availability, integrity and resilience of the cluetec services, cluetec uses measures such as system monitoring, logging of security-relevant events, vulnerability management, data backups and recovery procedures. Security-relevant incidents are detected, assessed and handled in accordance with established processes.

4.5 Confidentiality

Personal data processed via the cluetec services are treated confidentially. Access to customer data is granted only to those persons or subprocessors who require such access to perform their tasks and who are bound to confidentiality accordingly. Where cluetec uses external service providers, this is done in compliance with data protection and contractual requirements.

4.6 Place of processing

Data processing in connection with the cluetec services takes place exclusively within the European Union. This also applies to the AI services used by us in connection with Audit Intelligence.

5. Data protection officer

Legally required data protection officer

We have appointed a data protection officer for our company.

Datenschutz perfect GmbH | datenschutz@cluetec.de

Place of data processing

Data processing by cluetec takes place in the EU exclusively.

7. Subcontractors

Operator of the cloud services

Microsoft Ireland Operations Limited
Private Company Limited by Shares | Registered in Ireland | No. 256796
70 Sir John Rogerson’s Quay | Dublin 2 | Irland
https://azure.microsoft.com/

MongoDB, Inc.
1633 Broadway | 38th Floor | New York, NY 10019
https://www.mongodb.com/

8. Amendments to this data protection statement

We reserve the right to amend our data protection statement should this be required as a result of new technologies. Please make sure that you have the latest version.