Privacy Policy

1. Data Controller

The data controller responsible for data processing on this website is:

2. Data We Collect

We collect the following types of personal data:

• Identity data (names, addresses)
• Contact data (email, phone numbers)
• Content data (form inputs, uploaded files)
• Usage data (visited pages, access times)
• Technical data (IP addresses, browser information)
• Contract data (subscription details, billing)
• Payment data (bank details, invoices)

3. Legal Basis for Processing

We process personal data based on:

• Consent (Art. 6(1)(a) GDPR) - You have given consent for processing.
• Contract Performance (Art. 6(1)(b) GDPR) - Processing is necessary for contract fulfillment.
• Legal Obligation (Art. 6(1)(c) GDPR) - Processing is required by law.
• Legitimate Interests (Art. 6(1)(f) GDPR) - Processing is necessary for our legitimate interests.

4. Security Measures

We implement technical and organizational security measures to protect your data:

• SSL/TLS encryption for all data transfers
• All data stored on servers in Germany (encrypted backup copies additionally in Finland, EU)
• Regular security updates and backups
• Access control and authentication
• AntiVirus protection for uploaded files
• Regular security audits

5. Data Processing When Using BauManager Pro

5.1 Registration and User Account

During registration, we collect:

• First and last name
• Email address
• Company name and address
• Phone number (optional)
• Password (stored encrypted)

5.2 Software Usage

When using BauManager Pro, the following data is processed:

• Business data you enter (customers, projects, invoices, etc.)
• Uploaded documents and files
• Communication through the messaging system
• Log data (logins, changes)

5.3 Payment Processing

For payment processing, your payment data is transmitted to our payment service provider. We do not store complete credit card data.

5.4 AI assistant “BauMeister AI”

BauManager Pro offers an AI assistant. When you use it, your input (questions) is transmitted to an AI provider and processed there to generate the answer. If the administrator of your company has enabled access to company data under Einstellungen → KI (Settings → AI), the data from your account needed to answer the respective question is also transmitted (e.g. customer, quote, invoice, payment, project or appointment data). Passwords, customer portal credentials, internal notes and bank details are not transmitted. The assistant can only read data; drafts (e.g. of a quote) are saved only when you review and save them yourself.

Providers: depending on the configuration, OpenAI Ireland Ltd, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, or Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. The providers process the data on our behalf under a data processing agreement (Art. 28 GDPR). According to the providers, data submitted via the API is not used to train AI models and is generally retained for at most 30 days for abuse monitoring.

Transfers to third countries: The providers may transfer data to affiliates and sub-processors in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where the recipient is certified under the EU-US Data Privacy Framework, on the European Commission's adequacy decision (Art. 45 GDPR).

Legal basis: Art. 6(1)(b) GDPR (provision of the contractually agreed function). Where personal data of your customers is concerned, we process it as a processor on behalf of your company; the AI providers are sub-processors. For the public chat on our website: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) — please do not enter personal data there.

Retention: Conversations are stored in BauManager Pro according to your company's setting (1 to 180 days, default 90 days, counted from the last message) and then deleted automatically; they can be deleted at any time. Only questions and answers are stored, not the raw data retrieved. For billing and abuse detection we log the time, user, company, model used and size of the request (number of tokens).

Voluntary use: Using the assistant is voluntary. Access to company data can be disabled by the administrator at any time under Einstellungen → KI (Settings → AI).

6. Cookies

We use cookies to make our website functional and improve your user experience:

• Necessary cookies: For basic website functions (session, authentication)
• Functional cookies: For enhanced features (language settings, preferences)
• Analytics cookies: To improve our service (only with your consent)

You can change your cookie settings at any time via the cookie banner.

7. Visitor statistics (website and live demo)

To understand how our website and the live demo are used, we evaluate page views statistically. When you open a public page or the demo we process: the page and the time, the previously visited website (without search terms or parameters), campaign or partner codes from the link, device type, browser, operating system and language setting, and country, region and city, which we derive from your IP address using a database stored locally on our server (DB-IP Lite, db-ip.com, CC BY 4.0).

Your IP address is neither stored for this purpose nor transmitted to third parties. To distinguish visitors we compute a check value from the IP address, browser identifier, a secret key and the date; it changes daily and does not allow identification. We do not set any additional cookies for these statistics; page views are grouped into a visit via the technically necessary session cookie.

The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR). The data is deleted after 13 months. You may object to this processing at any time using the contact details above.

8. Electronic signatures

Businesses using BauManager Pro can have documents such as offers, contracts, change orders or acceptance reports signed electronically. The respective business is the controller for this processing; we process the data on its behalf (Art. 28 GDPR).

When signing we process: name, e-mail address and, where applicable, mobile number of the signatory, the times of invitation, opening, code dispatch, confirmation and signature, the confirmation code (only in irreversibly hashed form), the image of the signature or the typed name, the IP address and browser or device identifier as well as checksums of the document. This information is recorded in an audit report attached to the signed, sealed document so that authenticity and integrity can be proven. All parties receive the document by e-mail.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and the legitimate interest in proving the signature (Art. 6(1)(f) GDPR). Confirmation codes are sent by e-mail or — if a mobile number is provided and you choose it — by text message. Signatures stored by users are kept encrypted and only used after password confirmation. Via the public verification page, the check code from the document reveals only the title, sender, names of the signatories and times — no e-mail or IP addresses.

The data is stored as long as the business keeps the document in BauManager Pro or until its account is deleted; statutory retention obligations of the business (e.g. six or ten years under German commercial and tax law) remain unaffected. You can exercise your rights under section 9 towards the business that sent you the document.

9. Your Rights

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about your stored data.
• Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate data.
• Right to Erasure (Art. 17 GDPR): You can request deletion of your data.
• Right to Restriction (Art. 18 GDPR): You can request restriction of processing.
• Right to Data Portability (Art. 20 GDPR): You can receive your data in a common format.
• Right to Object (Art. 21 GDPR): You can object to processing.
• Right to Withdraw Consent (Art. 7(3) GDPR): You can withdraw your consent at any time.

10. Data Storage

Your data is stored as long as your user account is active or as required to provide our services. After termination, your data will be deleted within 30 days, unless legal retention obligations apply.

All data is stored on servers in Germany (data centre in Nuremberg). Encrypted backup copies are additionally kept in a data centre in Helsinki, Finland (EU).

11. Third Parties and Data Transfer

AI providers (OpenAI, Anthropic): see section 5.4.

We only transfer data to third parties when necessary for contract fulfillment:

• Payment service providers for billing
• Email services for sending notifications
• Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Nuremberg, backups in Helsinki) — data processing under Art. 28 GDPR

Apart from the AI providers (section 5.4), no data is transferred to third countries outside the EU.

12. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

13. Changes to This Privacy Policy

We reserve the right to update this privacy policy to adapt to changed legal requirements or service changes. The current version is always available on this page.