Privacy and Data Protection at LiteLog

Privacy Policy

Effective: September 29, 2026

1. Controller

Controller for data processing:
IQONEX GmbH
Eugen-Richter-Straße 45
99085 Erfurt, Germany
E-Mail: info@litelog.de

Supervisory Authority:
Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI)
Häßlerstraße 8, 99096 Erfurt
Phone: +49 361 57-3112900
E-Mail: poststelle@datenschutz.thueringen.de

2. Rights of Data Subjects

You have the following rights under GDPR:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with the supervisory authority (Art. 77 GDPR).

3. Data Collection on Our Website

a) Hosting and Logfiles

Hosting: Platform.sh (EU region)
Data: IP address, date/time, URL, referrer, browser type/version, operating system
Purpose: operation, security, error diagnostics
Legal basis: Art. 6 (1) (f) GDPR
Storage period: 30 days

b) Cookies & Consent

Necessary cookies (Art. 6 (1) (f) GDPR)
Optional cookies (analytics/marketing) only with consent (Art. 6 (1) (a) GDPR)
Consent management: in-house system, revocable at any time

c) Registration / User Account

Data: name, email, login credentials, roles, tenant
Purpose: contract performance, access management
Legal basis: Art. 6 (1) (b) GDPR
Storage period: contract duration + 90 days

d) Contact

Data: information from contact forms or emails
Purpose: handling of inquiries
Legal basis: Art. 6 (1) (a), (b) GDPR
Storage period: 12 months

e) Appointment Scheduling

Provider: Empfango – a service operated by IQONEX GmbH itself (the controller, see section 1). The booking page is embedded on our website; hosted in the EU, no transfer to third-party providers.
Data: name, email, optional note, appointment time, video conference link if applicable (Microsoft Teams, Microsoft Ireland Operations Ltd., Dublin, Ireland)
Legal basis: Art. 6 (1) (b) GDPR
Storage period: until completion + statutory retention obligations

f) Google reCAPTCHA

Use of Google reCAPTCHA

We use Google reCAPTCHA on our website and within our portal. The service is provided by:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
(“Google”).

Google reCAPTCHA is used to protect our forms (e.g. registration, login, contact forms, password reset) against misuse by automated programs (bots). For this purpose, reCAPTCHA analyzes various information (e.g. IP address, browser and device information, date and time, referrer URL, mouse and scroll movements, cookies of Google services and – if you are logged in to your Google account – a possible association with this account).

The processing may also take place on servers of Google LLC in the United States. For this transfer we rely on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework (DPF) of 10 July 2023, to which Google LLC is certified; in addition, we have concluded the EU Standard Contractual Clauses with Google. Nevertheless, an equivalent level of data protection as in the EU cannot be fully guaranteed in third countries such as the USA (e.g. potential access to your data by public authorities).

Legal basis & consent

We only use Google reCAPTCHA if you have given your prior consent.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and – insofar as cookies or similar technologies are used – Section 25(1) TDDDG (German law, formerly TTDSG).

In practice, this means:

Before you give consent, the reCAPTCHA script is not loaded.

No data is transmitted to Google and no reCAPTCHA tracking takes place before you accept in our cookie/consent banner.

Only after your consent has been given, reCAPTCHA is loaded and used on the relevant forms.

You can withdraw your consent at any time with effect for the future via our cookie/consent manager. In that case, reCAPTCHA will no longer be loaded; certain functionalities (e.g. submitting forms) may then no longer be available or only work to a limited extent.

For more information on how Google processes data, please refer to Google’s Privacy Policy:
https://policies.google.com/privacy

and the specific information on reCAPTCHA:
https://policies.google.com/terms

g) Lead and Customer Management (CRM)

Provider: Empfango, a product of IQONEX GmbH itself (the controller, see section 1), hosted in the EU
Data: information from our brochure, template, attendance finder and contact forms (name, email, phone, company, industry, message) and the origin of the request
Purpose: answering your request, sending the requested material and subsequent sales follow-up
Legal basis: Art. 6 (1) (b) GDPR (initiation/performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in following up on requests)
Storage period: 12 months after the last contact unless a contract is concluded; after conclusion the periods in section 9 apply
No transfer to third parties; the data stays with IQONEX GmbH in the EU.

h) Storage and Delivery of Images, Documents and Videos (Amazon Web Services)

Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS")
Storage location: Amazon S3, data centre in Frankfurt am Main (EU)
Images and PDF documents: are stored at AWS and delivered to you through our own servers (see a). Your browser does not connect to AWS, and AWS receives no data from you.
Videos: are loaded directly from AWS when you play a video. AWS then processes your IP address, the date and time of the request, the requested file, your browser identifier and the referrer.
No cookies are set and no usage profiles are created.
Purpose: fast and reliable delivery of website content
Legal basis: Art. 6 (1) (f) GDPR
Data processing agreement: We have concluded a data processing agreement with AWS pursuant to Art. 28 GDPR.
Third-country reference: Processing takes place in the EU. Access by the parent company Amazon Web Services, Inc. (USA) cannot be ruled out. For this, we rely on the EU Commission's adequacy decision on the EU-US Data Privacy Framework, under which AWS is certified, and additionally on the EU Standard Contractual Clauses.

h) Advisory Chat (Empfango)

Provider: Empfango – a service operated by IQONEX GmbH itself (the controller, see section 1); processing in the EU, no transfer to third-party providers
Data: the content you enter in the chat, message timestamps, technical session identifier
The chat only becomes active when you open it. It does not set cookies; a random session identifier is stored in your browser's localStorage so the conversation persists across page navigation. No cross-site tracking takes place.
Purpose: answering product questions, consultation, appointment scheduling if applicable (see e)
Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request), otherwise Art. 6 (1) (f) GDPR
Storage period: 12 months

4. Analytics and Marketing Tools

a) Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data: usage behavior, interactions, device info
Note: no storage of EU IP addresses
Third-country transfer: USA, on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision, to which Google LLC is certified), supplemented by EU Standard Contractual Clauses
Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG (formerly TTDSG)
Note: the script is loaded only after you consent in the cookie/consent banner; no data is transmitted beforehand.
Storage period: 14 months

b) Hotjar

Provider: Hotjar Ltd., Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta
Data: clicks, scrolls, heatmaps, feedback (no form field entries)
Third-country transfer: possible (incl. USA); based on the EU Standard Contractual Clauses
Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG (formerly TTDSG)
Note: the script is loaded only after you consent in the cookie/consent banner; no data is transmitted beforehand.
Storage period: 12 months

c) Google Ads / Conversion Tracking

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data: conversions (e.g. form submissions)
Third-country transfer: USA, on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision, to which Google LLC is certified), supplemented by EU Standard Contractual Clauses
Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG (formerly TTDSG)
Note: the script is loaded only after you consent in the cookie/consent banner; no data is transmitted beforehand.
Storage period: depends on campaign duration

d) Meta Pixel (Facebook Pixel)

We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") on our website and inside the portal.

Purpose: conversion tracking, reach measurement and remarketing for ads on Facebook and Instagram.
Data: pseudonymous identifier (Pixel cookie), IP address, browser and device information, pages visited, triggered standard events (e.g. "CompleteRegistration", "Purchase").
Third-country transfer: USA, on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision), to which Meta Platforms, Inc. is certified; supplemented by EU Standard Contractual Clauses. In third countries such as the USA, an EU-equivalent level of data protection cannot be fully guaranteed (e.g. access by authorities).
Legal basis: your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (formerly TTDSG).
Storage period: up to 180 days; aggregated reports longer.

The Meta Pixel is only loaded after you consent in the cookie/consent banner. No scripts run and no data is sent to Meta before consent. You can withdraw your consent at any time with effect for the future via our cookie/consent manager.

For details about Meta's data processing see:
https://www.facebook.com/privacy/policy

5. Payment Methods

Payments are processed via Stripe Payments Europe, Ltd., Dublin, Ireland.

Stripe processes: payment details (credit card, IBAN, amount), billing data (name, address, email), IP address.

Legal basis:

Art. 6 (1) (b) GDPR (contract performance)
Art. 6 (1) (f) GDPR (fraud prevention, secure processing)

Third-country transfer: Processing in the USA by Stripe, Inc. may occur, based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, to which Stripe, Inc. is certified) and, in addition, the EU Standard Contractual Clauses. A copy of the Standard Contractual Clauses is available on request (info@litelog.de).

Further information: Stripe Privacy Policy

Available methods via Stripe:

Credit Card (via Stripe)
PayPal: PayPal Privacy Policy
Amazon Pay: Amazon Pay Privacy Policy
Google Pay: Google Pay Privacy Policy

6. Mobile Apps

a) LiteLog Android App

Data: location (incl. background), camera/media (QR, photos, videos), NFC UIDs, account data, event/tour logs, diagnostic/crash data
Purpose: attendance tracking, guard tours, security, support
Legal basis: Art. 6 (1) (a), (b), (f) GDPR
Storage period: logs 12 months, account data contract duration + 90 days, crash data 30–90 days

b) LiteLog iOS App

Data: same as Android
App Store Privacy Label: account data & event logs marked as “Data linked to you”
App Tracking Transparency: no IDFA, no cross-device tracking
Legal basis: Art. 6 (1) (a), (b), (f) GDPR
Storage period: same as Android
Availability: App Store + in-app (Settings → Privacy)

7. Connecting AI Tools (AI connection, MCP)

Customers can connect a third-party AI tool, for example Claude (Anthropic) or ChatGPT (OpenAI), to their LiteLog account via the open standard MCP. The AI connection is optional. An administrator of the customer can switch it off at any time in the portal under Features → Connections ("Allow AI connection") and lock individual areas (modules) for all AI tools. A connection is only established when a signed-in user explicitly consents in the portal and decides per area whether the tool gets no access, may only read or may also write. Customer access accounts cannot connect.

Data: data of the customer's LiteLog account within the role and the properties of the consenting user, for example properties (name, address), tasks, incident reports, form responses, patrols and control points, shifts with the people planned, time entries, absences (period and status, never the reason), names and roles of employees (no contact data), customers (name, customer number), work orders, material and the user's own vacation and time balances. This includes free text that users entered in LiteLog.
Transfer: LiteLog transfers data only when the connected tool requests it and only within the permissions granted; it can never do more than the user may do in the portal. With write access in an area the tool can create and change entries there (for example tasks, incident reports, shifts, material requests, form templates as drafts, properties), but it cannot delete anything. Changes that replace existing content as a whole are first shown as a preview and only carried out after explicit confirmation.
Purpose: use of the customer's LiteLog data in the AI tool of the customer's choice
Legal basis: Art. 6(1)(b) GDPR; where LiteLog processes personal data on behalf of the customer, this is done under Art. 28 GDPR
Responsibility: The customer is responsible for choosing the AI provider and for the processing of the data there; the terms and privacy notices of that provider apply. The provider may also process the data outside the EU. LiteLog has no influence on this.
Log: For every request LiteLog logs the time, the user, the connected program, the tool called, the result (status, duration, size) and a summary of the parameters consisting of identifiers, date limits and counts. Free text is not logged. Consent and disconnection appear in the change history of the settings.
Access credentials: access tokens are valid for 60 minutes, refresh tokens for 60 days from their last use; LiteLog stores them only as hash values.
Disconnecting and revocation: Every user can disconnect their connection in the portal under Features → Connections at any time, and an administrator can disconnect every connection of the company; disconnecting takes effect immediately. If the administrator switches the AI connection off, no further requests are possible. A connection also ends after a password change, when the account is deactivated and after 60 days without use.
Storage period: log of requests 90 days, for customers with GxP retention switched on according to their period; expired or replaced tokens 7 days; unfinished sign-in requests 24 hours after expiry; registered programs without a connection 30 days; disconnected connections 400 days after disconnection; confirmations of two-step changes 24 hours after expiry

8. Security (Art. 32 GDPR)

TLS/SSL encryption
Access restrictions & role/permission concepts
Pseudonymization of log data
Data minimization & deletion policies
Regular backups
Staff training

9. Storage Periods (Overview)

Server logs: 30 days
Contact inquiries: 12 months
Registration/account data: contract duration + 90 days
Crash/diagnostic data: 30–90 days
Contract/billing data: 6 years (HGB) / 10 years (AO)
Appointment bookings: until completion + statutory retention obligations
AI connection: log of requests 90 days, further periods see section 7

10. Changes

We reserve the right to update this Privacy Policy when services, technologies, or legal requirements change.

11. Data Protection Officer

E-Mail: info@litelog.de

If a Data Protection Officer is appointed under § 38 BDSG, their contact details will be published here.

Contact

For questions about this Privacy Policy:
info@litelog.de

Privacy and Data Protection at LiteLog | GDPR Compliant