Privacy
Policy

Language notice

This Privacy Policy is a translation of SIMINEO's German Privacy Policy. The German version is the original version. This translation is provided to make the information available in English and does not limit any rights of data subjects under applicable data protection law.

1. Introduction

This Privacy Policy (hereinafter: the "Policy") describes the information relating to the processing of personal data in connection with the operation of the SIMINEO service, with particular regard to the purposes, legal bases, scope, duration, recipients of the data processing, and the rights of data subjects.

This Policy applies to every natural person whose personal data are processed in connection with the operation of the SIMINEO service, regardless of whether the service is used as a private individual or on behalf of a business.

The purpose of this Policy is to provide data subjects with transparent, accurate, and comprehensive information about the processing of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR).

This Policy applies exclusively to data processing activities carried out within the SIMINEO service. The personal data processing activities of individual third-party service providers are governed by the respective privacy policies of those providers.

2. Data Controller Information

The controller responsible for the SIMINEO service is:

Name:

Jozsef Török

Legal form:

Sole Proprietor (Einzelunternehmen)

Registered office:

Schäfersteige 53.

73770 Denkendorf

Germany

Email address:

[email protected]

Website:

https://simineo.com

VAT Identification Number (USt-IdNr.):

DE312957247

Data Protection Contact

Questions, requests, or other inquiries relating to the processing of personal data may be sent to: [email protected].

Data Protection Officer

Based on SIMINEO's current data processing activities, the appointment of a Data Protection Officer is currently not required pursuant to Articles 37–39 of Regulation (EU) 2016/679 (GDPR).

Should the appointment of a Data Protection Officer become legally mandatory in the future, this Policy will be updated accordingly.

3. Principles of SIMINEO's Operation

Purpose of the Service

SIMINEO is an online service that enables businesses to publish their own profiles and content, while allowing users to browse, follow, like such content, and manage their user accounts associated with the service.

During the operation of the service, we process only those personal data that are necessary for creating user accounts, ensuring the secure operation of the service, providing its individual functionalities, and fulfilling applicable legal obligations.

Principles of Data Processing

When processing personal data, SIMINEO acts in accordance with the fundamental principles of the GDPR, in particular the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

SIMINEO primarily displays posts published by businesses based on the time of publication. At the same time, the service also applies uniform, predefined display rules to ensure balanced visibility among businesses. The purpose of these rules is to ensure that the frequency of publishing alone does not provide a disproportionate visibility advantage to certain businesses over others.

These display rules apply equally to all users and are not based on users' personal data or individual behaviour.

SIMINEO does not use algorithmic recommendation systems based on personal data or user behaviour, advertising profiling, paid promotion, or engagement-based ranking.

In its current operation, the platform does not provide advertising space for third parties, does not display advertisements sold by third parties, and does not offer paid visibility or paid promotion options. Profiles created by businesses and the posts they publish constitute user-generated content within the service and shall not be regarded as advertisements published, endorsed, or sold by the platform.

Public and Non-Public Data

SIMINEO processes publicly displayed profile data separately from the internal data required for the operation of the service.

Only those data that a business provides or publishes within the service for the purpose of public display appear on the business's public profile.

Certain business content may have different access scopes depending on the visibility selected by the business. This applies in particular to the “Company NOW” function: an active Company NOW is not made available in the public area before login merely because it has been created. Additional display on a publicly accessible SIMINEO interface before login occurs only where the business expressly enables this visibility for the relevant active Company NOW.

Where public visibility of a Company NOW is enabled, its content may also be accessible to persons who are not logged in to SIMINEO together with the publicly visible Company profile information required for its display and attribution. Where public visibility is disabled, the Company NOW remains in existence within its otherwise applicable active lifecycle but is no longer made available for this public display.

Internal data associated with user accounts—including, in particular, email addresses, authentication and session data, data related to account recovery processes, billing information, and security, monitoring, and administrative logging data—are not public and are processed only to the extent necessary for operating the service, maintaining its security, fulfilling legal obligations, or enabling authorised persons to perform their administrative duties.

When processing data relating to following businesses and liking content, SIMINEO does not make the identity of individual users publicly available. Publicly displayed follower and like counts consist solely of aggregated statistical information. The purpose of follows and likes is to provide user feedback, not to enable public comparison of users or distinguish them based on their status.

4. Personal Data Processed

Data Provided During Registration

When creating a user account, SIMINEO processes only those personal data that are necessary for using the service.

Depending on the selected account type and the services used, different data may be required for private and business accounts.

These may include, in particular:

• username;
• email address;
• password (stored exclusively in a securely hashed form);
• the selected account type;
• the time at which the registering person confirmed during registration that they are at least 18 years old;
• in the case of a business account, business-related information provided by the user, including in particular:
• business name;
• business type;
• registered office or business address;
• postal code;
• city;
• country;
• telephone number;
• profile picture (if uploaded);
• posts published by the business and the related public information;
• Company NOW content published by the business, including the visibility setting selected for the relevant content.

Mandatory fields are clearly indicated on the registration interface in every case.

For the purpose of confirming the minimum age, SIMINEO does not process the date of birth, the specific age, or identity-document data as part of the regular registration process. Only the time at which the registering person made the required declaration that they are at least 18 years old is stored. This information documents the declaration made by the user and does not constitute age verification performed by SIMINEO.

Data Generated During the Use of the Service

During the use of the service, SIMINEO may process additional data required for operating the user account, providing the service, maintaining security, and ensuring the proper operation of the system.

These may include, in particular:

• data relating to the status of the user account;
• profile and account settings configured by the user;
• search points entered and, where applicable, saved by the user for the Radar function, including the name assigned by the user and the associated geographic coordinates;
• for business accounts, geographic coordinates optionally provided for the participation of the business in the Radar function;
• technical data related to authentication and session management;
• system and permission data required for the secure operation of the service;
• technical data relating to push notifications and app badges, where the user uses these functions;
• data created or modified by the user while using the service;
• data-minimised usage and interaction data used to create reach and performance statistics, including in particular profile views, post views, follows, likes, shares, telephone clicks, and map clicks.

When such statistical events are recorded, SIMINEO does not store an identifier of the user or visitor who performed the relevant interaction. Where a logged-in user performs an interaction, the existing account association may be taken into account before storage solely for the technical purpose of excluding a business's own interactions from its own performance statistics. Such a user identifier is not stored as part of the statistical event.

SIMINEO processes only the data necessary for the operation of the relevant functionality and does not process personal data that are not required for the intended operation of the service.

Where a private user uses the “Remind Me” feature, SIMINEO processes the association of the reminder record with the user account and the relevant post, the reminder time selected by the user, the user's own reminder text of up to 150 characters, and the status and timestamp data required for technical delivery.

Reports, Moderation Data and Notices of Illegal Content

SIMINEO processes data in connection with reports and moderation procedures where this is necessary to investigate possible violations of the platform rules, prevent misuse, process allegedly illegal content, document moderation decisions in a traceable manner, or comply with legal obligations applicable to the platform operator.

SIMINEO distinguishes between the community reporting functions provided within the service and the separate procedure for notices concerning allegedly illegal content under Article 16 of Regulation (EU) 2022/2065 (Digital Services Act – DSA). Community reports do not become formal notices under Article 16 DSA merely by being submitted through a community reporting function.

For community reports, SIMINEO may process in particular the internal association of the reporting person with a user account, the identifier and type of the reported content, the selected reporting reason, the time of the report, as well as a snapshot of the reported content and related contextual data required for moderation.

For a report concerning Company NOW, SIMINEO may additionally process a description of the reporting reason entered by the reporting person. Such a description is required when the reporting reason “Other” is selected. This free-text description forms part of the moderation report and may contain personal data if the reporting person includes such information in the description.

When processing a community report, SIMINEO may also process information concerning the processing status, administrative review, moderation decision, reason for the decision, an individual explanation, any relevant legal or contractual basis, any action taken, and the timestamps required for traceability.

For a formal notice under Article 16 DSA, SIMINEO processes in particular the contact details submitted by the notifying person where their provision is legally required, the exact electronic location of the content concerned, information concerning the type and identification of the content, additional information enabling the content to be located, the explanation of the alleged illegality, any legal basis provided, and the confirmation that the notice was submitted in good faith and is complete and accurate to the best of the notifying person's knowledge.

As a general rule, this includes the name and email address of the notifying person. An exception applies to notices concerning information considered to involve one of the offences referred to in Articles 3 to 7 of Directive 2011/93/EU; in those cases, Article 16(2)(c) DSA does not require the provision of a name and email address. This statutory exception does not constitute a general option for anonymous reporting.

A unique reference identifier is generated for each formal notice. During subsequent processing, SIMINEO may also process the processing status, results of the administrative review, an administrator-verified association with specific content, the decision, the reason for the decision, an individual explanation, any applicable legal or contractual basis, information concerning the responsible administrative handling, and the relevant processing and decision timestamps.

The electronic location or content identifier submitted by the notifying person and the content actually identified by SIMINEO during its review are treated separately. A URL or identifier submitted by the notifying person does not automatically result in content being restricted or removed. Under the current procedure, such action requires administrative review and verification.

SIMINEO does not store a persistent IP address of the notifying person in the record of a formal notice as part of the notice and decision documentation.

AI image labels and AI Check cases

For AI labels, SIMINEO processes the uploader's original declaration, the effective classification, the source of an administrative change and relevant timestamps and language information. The effective classification appears with the post, including on public post views.

AI Check may process references to the relevant post and company, limited image and status snapshots, reporter account identifiers, report reasons of up to 500 characters, language information, case status and timestamps, administrative decisions and explanations of up to 1000 characters, and the necessary administrator identifier. Purpose-limited email delivery status, attempts and timestamps are also processed.

Reporter identities and internal review records are not publicly displayed as part of the AI badge. Free-text explanations should not contain unnecessary personal or sensitive data. AI Check is separate from community reports and the Article 16 DSA process.

Publicly Available Data

For business accounts, only those data are displayed publicly that the business provides or publishes for the purpose of public display and that are designated for public access by the settings of the relevant function.

For Company NOW, the business decides separately for each active status whether it may additionally appear on a publicly accessible SIMINEO interface before login. Without this express activation, the Company NOW is not made available as publicly accessible content in that area.

Personal data relating to private user accounts are not public.

When users follow businesses or like content, SIMINEO does not publicly disclose the identity of individual users. The platform displays only aggregated follower and like counts.

Special Categories of Personal Data

Special categories of personal data under Article 9(1) GDPR include, in particular, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used for the unique identification of a natural person, health data and data concerning a person's sex life or sexual orientation.

The intended operation of SIMINEO does not require such data. SIMINEO does not specifically request them for registration, profile management or ordinary platform functions and does not infer such characteristics from User Content or user behaviour for profiling, advertising, ranking, recommendation or statistical purposes.

Users are requested not to provide special categories of personal data in non-public input fields or published content unless doing so is necessary for the relevant function and lawful.

Where a data subject deliberately publishes their own special-category personal data through a publicly accessible function, Article 9(2)(e) GDPR may in particular be relevant to that specific public disclosure where the data subject has manifestly made the relevant data public themselves. This does not replace any legal basis additionally required under Article 6 GDPR for the relevant processing and does not authorise unrelated further processing.

Where such information concerns another identified or identifiable natural person, SIMINEO does not treat the publishing User's decision alone as that person's consent or as evidence that the data subject has manifestly made the data public themselves. If SIMINEO cannot establish an applicable legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR for its processing, the relevant content may be restricted or removed.

Where special-category personal data are incidentally included in reports, formal notices, support, security or moderation procedures, they are processed only to the extent necessary for handling the specific matter. The required legal basis and applicable Article 9(2) condition must be determined according to the concrete processing purpose.

The currently audited system does not perform biometric identification, facial recognition or create biometric templates. The mere uploading of a photograph is therefore not treated as biometric identification solely because a person is depicted.

Publicly available Company profiles and Posts may be indexed by search engines. Publishing special-category personal data in those areas may therefore result in substantially wider dissemination and should be avoided unless the publication is lawful and actually necessary. If such content is deleted from SIMINEO or its public availability is ended, it may temporarily continue to appear in search results or cached representations maintained by external search engines until the relevant search engine provider recrawls the URL, updates its index or removes the stored content.

Mandatory and Voluntary Data

SIMINEO may require certain personal data to be provided for the creation of a user account and the operation of the service.

The provision of voluntary data is based on the user's decision. However, failure to provide such data may result in limited functionality or the unavailability of certain features.

The purpose, legal basis, retention period, and categories of personal data relating to each processing activity are described in detail in the subsequent sections of this Policy.

5. Purposes and Legal Bases of Data Processing

SIMINEO processes personal data solely for specified, explicit, and lawful purposes. In every case, data processing is related to the operation and security of the service, the management of user accounts, the performance of subscriptions, and the fulfilment of the Data Controller's legal obligations.

For each processing activity, the Data Controller determines its specific purpose and the appropriate legal basis under the GDPR. In certain cases, the same personal data may be processed for multiple related purposes, provided that an appropriate legal basis exists for each purpose.

The categories of personal data processed, retention periods, recipients, processors, and further detailed provisions relating to each processing activity are described in the following sections of this Policy.

5.1 Creation and Management of User Accounts

Purpose of Processing

The creation of user accounts, identification of users, provision of login functionality, enabling the use of the service, management of user permissions, and the establishment and maintenance of the contractual relationship between the user and the Data Controller.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary for taking steps prior to entering into a contract and for the performance of the contract concluded between the user and the Data Controller.

5.2 Protection of User Account Security and Ownership

Purpose of Processing

Maintaining the security of user accounts, verifying email addresses, providing password reset functionality, verifying account ownership using the Recovery Code, securely changing email addresses, and preventing unauthorised access, account takeovers, and other forms of misuse.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the security measures required for the performance of the contract.

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in protecting the security of user accounts, the service, and its users.

5.3 Public Display of Business Profiles and Business Content

Purpose of Processing

The public display of business profiles, ensuring the discoverability of businesses, and enabling access to information and content that businesses make available for public display.

This may also include an active Company NOW where the business expressly enables additional public visibility for the relevant Company NOW. In that case, public availability is provided in accordance with the functionality setting selected by the business. Without such activation, the Company NOW is not made available for public display before login.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide and perform the service functions used by the business.

5.4 Provision of Platform Features

Purpose of Processing

Operating the functionalities of the SIMINEO service, including in particular following businesses, liking posts, and providing other platform features initiated by users.

By their nature, follows and likes are non-public user relationships. They are not used by the system for profiling or for operating personalised recommendation systems.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary for providing the service requested by the user.

For notices about new posts from followed businesses, SIMINEO stores a timestamp and the identifier of the last post marked as seen for each follow relationship. These data are used to identify unseen posts and related indicators, including supported app badges. Merely opening the Following overview does not reset this status. Unfollowing or account deletion removes the data together with the follow relationship.

5.4.1 Push Notifications and Activity Indicators

Purpose of Processing

Providing optional service-related push notifications and activity indicators so that users can be informed about events relevant to their user account and new activity within SIMINEO.

Where push notifications are used, SIMINEO processes the technical push-subscription data required for this purpose and their association with the relevant user account. Permission to allow or refuse notifications is managed through the settings of the browser or operating system used.

On logout, the server-side association of an existing push subscription with the user account may be removed. This does not automatically revoke notification permission that remains active on the device or in the browser.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the service-related notification and activity functions used by the user.

5.4.2 Radar and Saved Search Points

Purpose of Processing

SIMINEO allows users to enter geographic coordinates as a search point for the Radar function and optionally save them in the user account in order to display businesses within a radius selected by the user and to allow saved search points to be reused later.

For a saved search point, SIMINEO processes the name assigned by the user and the associated geographic coordinates.

The name of a saved search point is determined solely by the user. SIMINEO does not verify whether the name corresponds to the actual geographic location of the entered coordinates.

Business accounts may provide separate geographic coordinates for the voluntary participation of their business in the Radar function. If both coordinates are not provided, the business is not included as a Radar business in the distance-based search.

For a specific Radar search, the logged-in user sends the selected search point and search radius to SIMINEO. SIMINEO calculates server-side the geographic distance between this search point and the business coordinates provided for Radar participation and returns only eligible businesses located within the selected search radius.

The exact business coordinates provided for Radar participation are not transmitted to the searching user’s browser as part of the Radar search result. For display purposes, the user interface receives only the business information required for the Radar function and the distance from the selected search point rounded for display.

The results list is sorted according to this geographic distance, with closer businesses displayed before businesses located farther away. Follow status, Likes, popularity, interaction or engagement values, Company NOW, payments, or subscription type are not used to improve a business’s position in this Radar results list.

The Radar function does not perform continuous location tracking of the user. Names and search-point coordinates entered or saved by the user are not transmitted to external location or geocoding services.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the Radar, search-point and business-discovery functions requested by the user or business account.

5.4.3 Private Search Requests

Purpose of Processing

Private users may create a search request within SIMINEO in order to make businesses aware of a specific need in a stated city. For this purpose, SIMINEO processes the city provided by the user, a normalised form of the city name used for technical search purposes, the search text entered by the user, the time of creation, and the internal association of the search request with the user account.

Logged-in business accounts may view all active Private Search Requests originating from active and verified private user accounts within the designated search function. Without a city filter, active Search Requests are displayed by recency, with newer Search Requests appearing first. Business accounts may search or filter the displayed Search Requests by any freely entered city independently of their saved cities. The city, search text and time of creation are displayed. They are not provided with the private user's username, email address, public user identifier, internal user identifier, or other account data that directly identify the private user.

A business account may use the designated function once for an active search request to indicate that it can help. For this purpose, SIMINEO stores the association between the relevant search request and the business account as well as the time of the response. The response does not contain any free-text message entered by the business.

When such a response is made, the private user is shown the publicly visible profile data required to identify and open the profile of the responding business. This may include, in particular, the public profile identifier, the company name, the city specified in the company profile and the profile image. The internal user identifier of the business account is not disclosed to the private user.

Where a search request is reported by a business account because of a possible violation, SIMINEO may store a separate snapshot of the city and search text for moderation purposes together with the reason for the report and the time of the report. These moderation data may continue to exist even if the original search request is subsequently deleted.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the search function requested by the private user. Where data relating to a reported search request are stored separately for moderation and misuse-prevention purposes, such processing is carried out on the basis of Article 6(1)(f) GDPR in accordance with Section 5.5.

5.4.4 Saved Cities for Business Accounts

Purpose of Processing

Independently of the general ability to browse all active Private Search Requests and filter them by any city, business accounts may save up to three cities that are of particular interest to them. These saved cities serve as an additional monitoring and notification function. They are used to identify new Private Search Requests in those cities and to provide the business account with corresponding indicators, activity notifications and – where the notification function is used – push notifications.

For this purpose, SIMINEO processes the city saved by the business account, a normalised form of the city name used for technical matching, and a technical processing state used to determine which matching Search Requests for the relevant saved city have already been treated as seen. This technical processing state does not contain any additional content from the Private Search Requests.

When a city is saved for the first time, the technical processing state is set so that Search Requests that already existed in that city are not subsequently treated as new Search Requests. New indicators arise only for later Private Search Requests whose normalised city name matches the saved city.

The saved cities and their associated technical seen state are linked to the relevant business account and are not displayed publicly. A business account may modify or remove its saved cities through the designated function.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the search, indicator and notification functions requested by the business account.

5.4.5 Remind Me – Personal Post Reminders

Purpose of Processing

Private users can save a personal reminder for a post with a time of their choice and their own reminder text of up to 150 characters. SIMINEO processes these data to associate the reminder with the user account and the relevant post, technically process the reminder at the scheduled time, and provide the related notification and activity functionality to the user.

Where a usable push subscription is available for the user account, the reminder text entered by the user may be delivered to the user as a push notification at the selected time. Following successful push delivery, a related activity event may also be created so that the reminder is reflected in SIMINEO's activity and unread indicators.

Legal Basis for Processing

Article 6(1)(b) GDPR – processing is necessary to provide the reminder, notification, and activity functionality expressly requested by the user.

5.5 Moderation and Prevention of Misuse

Purpose of Processing

Maintaining the secure operation of the service, reviewing community reports, enforcing the platform rules, investigating potentially abusive or illegal content, documenting moderation decisions, and preserving the integrity of the platform.

This may include, in particular, moderation reports, snapshots of reported content, reporting reasons, additional explanations entered by the reporting person, administrative review data, reasons for decisions, individual explanations, actions taken, and the associated timestamps.

Legal Basis for Processing

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in ensuring the security and reliable operation of the service, preventing and investigating misuse, appropriately handling community reports, and enforcing the platform rules.

5.5.1 AI Check – labelling transparency and abuse prevention

The purposes are to provide transparent AI labelling, review reported discrepancies, correct effective classifications, prevent misuse and keep limited records of administrative decisions and notifications.

Article 6(1)(b) GDPR may apply to providing the labelling functionality used by the company user. Case review, misuse prevention and necessary records rely on Article 6(1)(f) GDPR, reflecting legitimate interests in transparent, reliable labels and protection against abusive reporting. A separate legitimate-interests assessment and data-minimisation review document these activities.

AI Check outcomes result from administrative review and do not constitute automated findings about the true origin of an image.

5.6 Information Security, Monitoring and Logging

Purpose of Processing

Maintaining the information security of the service, ensuring the stable operation of the system, detecting technical faults, identifying misuse, preventing attacks, and logging operational events.

Legal Basis for Processing

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in ensuring the secure, reliable, and continuous operation of the service.

5.7 Administrative Audit Logging

Purpose of Processing

Documenting administrative actions, ensuring accountability, maintaining the traceability of moderation decisions, investigating security incidents, and enabling subsequent verification of the proper operation of the service.

Legal Basis for Processing

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in ensuring the transparency and auditability of administrative actions.

5.8 Subscriptions and Access Entitlement

Purpose of Processing

Managing SIMINEO subscriptions and access entitlements, assigning the selected plan, managing subscription status and lifecycle, processing the required Paddle customer and subscription references, providing access to the Paddle customer portal, and maintaining limited technical documentation of subscription and billing events.

Actual payment processing, processing of payment instruments, invoicing, and material payment, tax and Merchant-of-Record processes are carried out by Paddle. Under the current system configuration, SIMINEO does not store full payment card data, payment method details, or local invoice files.

Legal Basis for Processing

Article 6(1)(b) GDPR – where processing is necessary to provide, manage or terminate the SIMINEO access or subscription selected by the user.

Article 6(1)(c) GDPR – where processing or retention of certain billing and evidentiary data is necessary for SIMINEO to comply with statutory accounting or other legal obligations.

Article 6(1)(f) GDPR – where limited technical subscription, lifecycle and billing evidence beyond immediate contract performance is necessary for system security, error analysis, conflict resolution or technical evidentiary purposes.

5.9 Transactional Emails

Purpose of Processing

Sending transactional emails relating to the operation of the user account, including in particular registration confirmation, email verification, password reset, billing notifications, subscription events, account changes, and other communications necessary for the operation of the service.

Legal Basis for Processing

Article 6(1)(b) GDPR – communication necessary for the performance of the contract.

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in providing information related to the secure operation of user accounts.

5.10 Contact and Customer Support

Purpose of Processing

SIMINEO processes personal data when persons contact the Data Controller through the published email addresses or the general contact form, in particular regarding general questions, customer support, technical problems, user accounts, subscriptions, complaints, business matters or other service-related enquiries.

Depending on the content of the enquiry, the processed data may include in particular the sender's email address, name or other identity information used by the sender, subject line, message content, reply correspondence, timestamps, technical email metadata and, where applicable, voluntarily submitted attachments or case-related references.

SIMINEO currently does not operate a separate support-ticket system or separate support database within the platform for general contact and support enquiries.

Legal Basis for Processing

Article 6(1)(b) GDPR – where processing is necessary for the performance of an existing contract or in order to take pre-contractual steps at the request of the data subject.

Article 6(1)(f) GDPR – where processing is necessary for handling other legitimate contact, support or business matters, resolving conflicts or maintaining limited evidence, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.

Where an enquiry forms part of a separate legal, data-protection, moderation or other specifically regulated procedure, processing is governed by the specific legal bases and rules applicable to that procedure.

5.11 Retention Obligations and Archiving

Purpose of Processing

Ensuring accountability, maintaining information security, preserving the traceability of security incidents, managing archiving processes, and fulfilling statutory data retention obligations.

Legal Basis for Processing

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in ensuring the secure and auditable operation of the service.

Article 6(1)(c) GDPR – processing required where the retention of data is prescribed by law.

5.12 Reach, Usage and Performance Statistics

Purpose of Processing

SIMINEO records certain interactions within the service in a data-minimised form in order to provide businesses with statistics concerning the use and reach of their own SIMINEO presence and to provide the Data Controller with aggregated information about the use, development, and operation of the platform.

The recorded data may include, in particular, profile views, post views, follows, likes, shares, telephone clicks, and map clicks, together with the time of the relevant interaction and its association with the affected business profile or, where required, a specific post.

The statistical events do not contain an identifier of the user or visitor who performed the relevant interaction. Businesses do not receive visitor lists or information identifying the specific person who performed an interaction.

Businesses receive only aggregated performance values relating to their own SIMINEO presence. The administrative platform statistics likewise present aggregated metrics and trends over time and are used in particular to assess platform growth, usage, reach, and the operation of the service.

Statistical data are not used to create personal interest profiles, for personalised advertising, or for algorithmic personalisation of content.

Legal Basis for Processing

Article 6(1)(f) GDPR – the legitimate interest of the Data Controller in measuring the use, reach, development, and operation of the SIMINEO service in a data-minimised manner and in providing meaningful performance information to business accounts without storing the identity of individual visitors in statistical events.

Company NOW – subsequent retention

A Company NOW remains active for a maximum of 24 hours from publication unless it is deleted or replaced earlier. This active provision takes place as part of the platform function requested by the business account on the basis of Article 6(1)(b) GDPR.

After expiry, deletion or replacement, a Company NOW is no longer provided as active content. The original Company NOW data record may, however, remain in the active system for a limited period where this is necessary to investigate misuse or moderation issues arising shortly afterwards, to associate reports or platform actions with previously published content, or to enable necessary evidence preservation or the establishment, exercise or defence of related legal claims.

This subsequent retention is based on Article 6(1)(f) GDPR and is limited to a maximum of 90 days from publication. During this period, the record is not used again as an active Company NOW and is not made publicly visible again. After expiry of the period, it is deleted from the active system as part of the regular retention and deletion cycle.

5.13 Formal Notices of Illegal Content Under Article 16 DSA

Purpose of Processing

Receiving, reviewing, and processing notices concerning allegedly illegal content under Article 16 DSA, identifying the specific content concerned, communicating with the notifying person, documenting the administrative review and decision, and implementing and evidencing any action that may be required.

For this purpose, SIMINEO may process the notice, contact, content, review, decision, and sending data described in Section 4.

Legal Basis for Processing

Article 6(1)(c) GDPR in conjunction with the legal obligations applicable to SIMINEO under Regulation (EU) 2022/2065, in particular Article 16 DSA.

Where, after completion of the immediate statutory processing procedure, individual data are retained for a limited period for accountability, to preserve the traceability of the decision, or to establish, exercise, or defend related legal claims, the further processing may additionally be based on Article 6(1)(f) GDPR where the applicable legal requirements are met.

5.14 Communications Concerning Moderation Decisions and Actions

Purpose of Processing

Sending or attempting to send, and documenting, acknowledgements of receipt and decision communications to notifying persons and – where required – communications to users affected by a content restriction, in particular statements of reasons under Article 17 DSA.

For notifying an affected content owner, SIMINEO may use a purpose-specific snapshot of the contact details required for sending the communication. These data are not used to disclose the notifying person's personal contact details to the affected content owner.

Legal Basis for Processing

Article 6(1)(c) GDPR where the communication is necessary to comply with a legal obligation under the DSA. Where technical sending and evidence data are processed to ensure and document proper communication, Article 6(1)(f) GDPR may additionally apply.

5.15 Notification of Suspicions of Criminal Offences Under Article 18 DSA

Purpose of Processing

Where, in the course of its activities as a hosting service provider, SIMINEO becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place, or is likely to take place, SIMINEO processes the relevant information available to it in order to carry out the assessment required by law and, where applicable, to notify the competent law-enforcement or judicial authorities pursuant to Article 18 DSA.

The data processed for this purpose may include, in particular, information concerning the affected content or user account, the factual context giving rise to the suspicion, available identification and contact data, relevant moderation or notice references, timestamps, and other information actually available to SIMINEO that is relevant to the statutory notification.

Where the conditions of Article 18 DSA are met, SIMINEO may provide such relevant information to the law-enforcement or judicial authorities of the Member State or Member States concerned. Where the Member State concerned cannot be identified with reasonable certainty, the notification may, in accordance with Article 18(2) DSA, be made to the competent law-enforcement authorities of the Member State in which SIMINEO is established, to Europol, or to both.

Processing under this Section does not constitute general monitoring of user content and does not create a general obligation for SIMINEO to actively search for possible criminal offences. An assessment is carried out only where SIMINEO actually becomes aware of information capable of meeting the statutory threshold under Article 18 DSA.

Legal Basis for Processing

Article 6(1)(c) GDPR in conjunction with Article 18 of Regulation (EU) 2022/2065 (Digital Services Act – DSA), where the processing is necessary for compliance with the statutory notification and information obligations laid down therein.

6. User Accounts and Authentication

Using SIMINEO requires the creation of a user account. The system processes data relating to the user account for the purpose of providing the service, identifying the user, maintaining account security, and preventing unauthorised access.

Data associated with user accounts are not considered public profile data, except for those data that users with business accounts explicitly provide for public display.

6.1 User Account

Each user account created during registration is assigned a unique identifier. In connection with the user account, the system processes, among other things, the username, email address, account type, technical data required for authentication, the time at which the minimum-age declaration was made during registration, and information relating to the status of the account.

The email address serves as the primary contact and identification data for the user account. It does not form part of the publicly displayed profile and is used exclusively for purposes related to the operation of the service.

6.2 Login and Sessions

During login, the system applies a secure authentication process. Following successful authentication, the system creates a session that enables the user to use the service securely.

The security measures applied to session management are intended to prevent unauthorised access, ensure the proper management of sessions, and maintain the security of user accounts.

When SIMINEO is used as an installed Progressive Web App (PWA), the system may provide a longer-lived session that can be renewed based on user activity. In its current operation, this PWA session is limited to a period of up to 72 hours without renewed activity. If the PWA is used again within that period, the session may be renewed within the applicable security mechanisms.

The PWA session is used solely to maintain the logged-in state in a convenient and secure manner. It is not used for tracking, advertising or profiling purposes. Security-relevant events may invalidate a session even before it would otherwise expire.

6.3 Recovery Code

To protect the ownership of user accounts, SIMINEO operates a Recovery Code system.

The Recovery Code is a security identifier associated with the user account. It is used in particular during procedures for securely changing the email address and verifying ownership of the account.

The Recovery Code is stored exclusively in hashed form. The Data Controller does not store its original value and is therefore unable to display or recover it at a later time.

6.4 Security Measures

To protect user accounts, the Data Controller applies multiple technical and organisational measures, including in particular email verification, the password reset process, the use of the Recovery Code, session management, and security mechanisms designed to prevent unauthorised access.

The Data Controller regularly reviews these security measures and modifies them where necessary to ensure the long-term security of the service and the protection of user accounts.

7. Cookies

SIMINEO uses only cookies that are necessary for the operation of the service, the management of user sessions, and the provision of security. These cookies are required for login, session management, CSRF protection, and the protection of administrative access.

In its current operation, SIMINEO does not use marketing, advertising, analytics, tracking, or profiling cookies.

7.1 Cookies Used

Based on SIMINEO's audited operation, the system uses the following relevant cookies:

• seeme_auth
• seeme_csrf
• seeme_admin_gate

These cookies are related to the secure operation of the service, the management of user sessions, the prevention of unauthorised access, and the protection of administrative access.

7.2 Session Cookie

The seeme_auth cookie is related to user login and session management. The system uses this cookie to determine whether the user is logged in and whether they are authorised to use certain parts of the service.

The seeme_auth cookie is configured as HttpOnly, so frontend JavaScript code cannot directly access the authentication data stored in it. The cookie operates with a SameSite Strict setting and uses the Secure setting in production environments.

In its current operation, SIMINEO does not use a separate refresh cookie. The validity of a session is determined in particular by the expiry time of the authentication token, token version verification and the session rules applicable to the relevant usage context. When SIMINEO is used as an installed PWA, the activity-based session renewal described in Section 6.2 may apply.

7.3 CSRF Cookie

The seeme_csrf cookie forms part of CSRF protection. SIMINEO applies the double-submit cookie pattern, under which the frontend also sends the value of the CSRF cookie in the X-CSRF-Token header for state-changing requests.

State-changing requests may be rejected if the authentication cookie, the CSRF cookie, or the CSRF header is missing, or if the values of the CSRF cookie and the CSRF header do not match.

Due to the double-submit mechanism, the seeme_csrf cookie is intentionally readable by frontend code. It is not an authentication cookie, but a security cookie required for the operation of CSRF protection. The cookie operates with a SameSite Strict setting and uses the Secure setting in production environments.

7.4 Cookie Related to Administrative Access

The seeme_admin_gate cookie is related to the protection of administrative access. This cookie is used exclusively as part of the administrative access process.

The seeme_admin_gate cookie is configured as HttpOnly, SameSite Strict, and uses the Secure setting in production environments. The cookie is associated with administrative routes and contains a signed security value.

7.5 Cookies We Do Not Use

Based on SIMINEO's current audited operation, the service does not use:

• marketing cookies;
• advertising cookies;
• analytics cookies;
• third-party tracking cookies;
• profiling or behavioural analysis cookies;
• cookies used to display personalised advertisements.

SIMINEO's use of cookies is limited to technical cookies necessary for the secure operation of the service and the protection of user accounts.

8. Subscriptions and Payment

SIMINEO operates as a paid service. In managing subscriptions, the system maintains its own internal subscription and entitlement records and also uses an external payment service provider for payment and billing processes.

SIMINEO's internal system processes the data necessary for verifying subscription entitlements, providing access, managing subscription status, and logging events related to the subscription.

8.1 Subscription System

SIMINEO uses its own internal subscription system to determine whether a user is entitled to use certain parts of the service.

In connection with the subscription, the system processes in particular the name of the subscription provider, the selected plan, the subscription status, the customer and subscription identifiers provided by the provider, the end of the current subscription period, any cancellation or deletion status, and the related timestamps.

SIMINEO's internal subscription statuses may include, in particular, active, canceling, and deleted statuses. The "inactive" status is not an independent subscription lifecycle status; it means that there is no active subscription or no available active entitlement in the system.

Access to the service is determined by SIMINEO based on its own internal subscription and entitlement records.

8.2 Paddle Payment Service

SIMINEO uses Paddle for handling payment, subscription, and billing processes.

During the payment process, checkout takes place through Paddle's system. To initiate checkout, SIMINEO may transmit or use the context required for the subscription, including in particular the email address associated with the user account, the selected plan, the account type, the payment environment, and the return URLs related to successful or interrupted payment.

Payment processing, management of payment methods, access to invoices, and provider-side subscription management functions are provided by Paddle. Based on SIMINEO's current operation, SIMINEO does not store bank card data, payment method details, or locally stored invoice files.

During payment and billing processes, Paddle may act as an independent controller or in the role determined by its own terms of service. Paddle's own privacy notice and terms of service apply to Paddle's data processing practices.

8.3 Billing

Billing-related processes are generally carried out through Paddle's system. The user may access invoices and provider-side subscription management options through the customer portal provided by the provider.

In connection with subscriptions, SIMINEO processes only its own technical data necessary for providing the service, verifying subscription entitlement, managing subscription status, and maintaining limited technical traceability of the subscription lifecycle. Actual payment processing, invoicing, and the payment, tax and billing obligations performed by Paddle as Merchant of Record are carried out by Paddle in its respective role.

8.4 Subscription Management

The user may initiate certain actions relating to their subscription through the SIMINEO interface or through the Paddle customer portal.

SIMINEO provides access to the Paddle customer portal through a protected interface. The session URL associated with the customer portal is a non-public link generated by the provider and is not considered public profile data.

SIMINEO may log subscription events in its internal system. Such events may include, in particular, subscription activation, placement into canceling status, reactivation, or deletion. Subscription events may originate from a webhook received from Paddle, a system process, a user action, or an account deletion/data protection deletion process.

SIMINEO may receive subscription events from Paddle through a webhook. During webhook processing, the system applies technical controls for verification, signature validation, and prevention of repeated processing.

9. Email Communication

SIMINEO uses email both for electronic communication related to the operation of user accounts and for receiving and handling general contact and customer support enquiries.

The email address is an essential part of the operation of registered user accounts; therefore, certain functions of the service can only be used with a valid email address. General contact or support enquiries may also be sent to the published contact addresses independently of an existing user account.

For sending, receiving and processing this email communication, SIMINEO uses Google Workspace-based email infrastructure in production.

9.1 Role of the Email Address

The email address serves as internal contact and identification data for the user account.

SIMINEO uses the email address in particular for the following purposes:

• registration;
• login;
• email verification;
• password reset;
• subscription-related communication;
• account deletion-related communication;
• acknowledgements of receipt and decision communications in connection with formal notices concerning allegedly illegal content;
• communications to users concerning moderation decisions and content restrictions where such communication is required.

The email address does not form part of the publicly displayed profile and is not displayed on the public business profile page.

9.2 Transactional Emails

SIMINEO sends transactional emails to users that are necessary for the operation of the service.

Such emails include, in particular:

• registration confirmation;
• email verification;
• password reset;
• notifications related to the subscription lifecycle;
• notification of the completion of account deletion;
• acknowledgement of receipt of a formal notice concerning allegedly illegal content;
• communication of the decision concerning such a notice;
• communication to the affected owner of a post or Company NOW concerning a content restriction applied as a result of a moderation decision, where legally required.

These emails are related to the operation of the service and do not constitute marketing communication.

9.3 Service Notifications

SIMINEO may also send other service notifications in connection with the operation of the user account, where they are necessary for providing the service, maintaining the security of the user account, or managing the subscription.

The purpose of service notifications is to properly inform the user, support the secure operation of the service, and communicate important events related to the user account.

9.4 General Contact and Support Communication

General contact, support, complaint and business enquiries may in particular be submitted through the email addresses published on SIMINEO pages or through the general contact form.

For such messages, SIMINEO processes the information provided by the sender only to the extent necessary to handle the specific enquiry and the associated legitimate communication, support, documentation or evidentiary purposes.

General support communication is separate from Community Reports, formal notices under Article 16 DSA and other specifically regulated procedures.

9.5 Moderation and DSA-Related Emails

For a formal notice concerning allegedly illegal content, SIMINEO may send an acknowledgement of receipt to the email address provided by the notifying person. After completion of the review, SIMINEO may inform the notifying person of the decision taken, the essential reasons for that decision, and the content association established by SIMINEO.

Where a post or Company NOW is restricted as a result of a formal notice or another moderation procedure, SIMINEO may send the affected content owner a separate communication concerning the decision and its reasons. The notifying person's contact details are not disclosed to the affected content owner.

For certain moderation and DSA-related emails, SIMINEO uses limited retry mechanisms where a sending attempt was not technically successful. A status technically recorded as sent within the SIMINEO system does not necessarily mean that the message was finally accepted by the receiving mail server or actually read by the recipient.

Where a purpose-specific snapshot of a username or email address is stored for sending a communication to an affected content owner, the specific retention and deletion rules in Section 14 and the account-deletion provisions in Section 15 apply.

9.6 Push Notifications and App Badges

SIMINEO may provide users with push notifications and activity indicators or app badges where supported by the browser, device or operating system used and permitted by the user.

For the technical delivery of push notifications, SIMINEO processes the technical data required for the relevant push subscription. These data are used only for providing the notification function and associating it with the relevant user account.

In its current operation, SIMINEO push notifications are used to provide information about service-related activity within the platform and are not used to create advertising profiles or for personalised advertising.

The user may manage or revoke notification permission through the settings of their browser, device or operating system. Logging out of SIMINEO may terminate the server-side association of the push subscription with the user account without automatically changing notification permission that remains active on the device.

For a “Remind Me” reminder created by the user, the push notification may contain the reminder text entered by the user. Following successful delivery, the reminder may also be recorded as an activity event and reflected in the unread and badge indicators of the user account.

10. Processors, Independent Controllers and Recipients of Personal Data

SIMINEO uses external service providers for certain technical and operational tasks. Personal data are made accessible to or transferred to these service providers only to the extent necessary for the relevant function.

SIMINEO does not sell personal data, does not transfer personal data to third parties for advertising purposes, and does not use external advertising or user profiling services.

Processors

SIMINEO currently uses, in particular, the following processors:

• Hetzner Cloud – for hosting, server, storage and database infrastructure and the technical provision of the platform;
• Google Workspace – for sending, receiving and processing transactional, system, contact and support emails, including in particular verification, security, billing, moderation, DSA and other service-related communications;
• Cloudflare – for DNS, proxy, TLS, DDoS, bot and security functions and for forwarding network traffic. In this context, in particular IP addresses, connection and request metadata, hostnames, URL or path information, technical headers, security signals and, where applicable, transmitted HTTPS content may be processed.

Where a service provider carries out individual processing operations for its own purposes or on the basis of its own legal obligations, its role in relation to that processing must be assessed separately.

Independent Controllers

In connection with payments and subscriptions, Paddle acts as Merchant of Record. In the context of payment processing, billing and compliance with its own legal obligations, Paddle processes certain personal data as an independent controller.

Data transferred to Paddle may include, in particular, the account email address required for checkout, subscription and billing, the selected plan or associated Price ID, and technical customer, checkout and subscription references. Payment instrument and card data are processed within the Paddle checkout and are not stored as complete payment data within the SIMINEO system.

Web Push Services

If a user enables push notifications, the data required for delivery are transferred to the Web Push service of the browser or operating system used by the user. This includes, in particular, the push endpoint, the required technical push keys and the encrypted notification content. The regular SIMINEO push payload does not contain an email address or an internal SIMINEO user ID.

Other Users and the Public

Certain platform functions are designed to make information available to other users or to the public. Depending on the function used, recipients may therefore also include other SIMINEO users or visitors to publicly accessible SIMINEO pages.

This applies in particular to:

• public Company Profiles and the public profile and contact information provided there by the Company Account;
• public Company Posts together with the associated public Company information;
• Company NOW content where public visibility has expressly been enabled;
• Private Searches made available to eligible Company Accounts. In particular, the city, search text and time are displayed; the identity of the Private User is not disclosed through username, email address or internal user ID;
• responses by Company Accounts to Private Searches. The relevant Private User receives the public Company profile information necessary to identify the responding Company, in particular the Company Public ID, Company name, Company city, avatar and response time;
• Following, Like and Activity functions insofar as public content or aggregated activity information is displayed.

For Follow, Unfollow, Like and comparable activity events, the regular Activity endpoints do not disclose internal Actor User IDs to other users. In particular, a Company Account does not receive a list identifying individual followers or users who liked content through these functions.

Internally Authorised Recipients

Personal data may be accessible within SIMINEO to authorised administrators or moderators insofar as this is necessary for platform operation, support, security, misuse prevention, moderation, audit, data protection, legal or other compliance-related tasks.

Access to protected administrative functions is technically role- and permission-based. Regular user accounts therefore do not receive general access to administrative personal data.

Moderation and DSA Procedures

In Community Reports and formal notices under Article 16 DSA, personal data are disclosed only to recipients necessary for the relevant procedure.

The identity or contact details of a Community Reporter are not automatically disclosed to the affected Content Owner. Conversely, the Reporter does not automatically receive the identity or contact details of the Content Owner.

In formal notices under Article 16 DSA, the notifier's name and email address are likewise not disclosed to the affected Content Owner merely because a subsequent communication is sent under Article 17 DSA. The decision communication to the notifier does not automatically contain the identity or contact details of the Content Owner either.

Authorities and Legally Required Disclosures

Personal data may be transferred to competent authorities, courts or other bodies designated by law where SIMINEO is required to do so on the basis of an applicable legal obligation or a binding administrative or judicial process.

For notifications under Article 18 DSA, there is no general or automated transfer of data to law-enforcement authorities. Such a notification takes place only on a case-specific basis where the legal requirements are met and is limited to the information available and necessary in the individual case.

Google Search Console Is Not a Regular Recipient

SIMINEO does not use Google Analytics, Google Tag Manager or any other Search Console integration within the platform through which personal user data or user-behaviour data from the SIMINEO application are transferred to Google Search Console. Google Search Console is therefore not treated as a regular recipient of SIMINEO users' personal data.

Individual recipients do not receive the same categories of data. Every disclosure or transfer is limited to the extent necessary for the relevant purpose.

Whether and to what extent processing by individual external service providers takes place outside the European Union or the European Economic Area is described separately in Section 17 of this Privacy Policy.

11. Data Security

SIMINEO implements technical and organisational measures to protect personal data. These measures are intended to prevent unauthorised access to personal data, unauthorised modification, loss, disclosure, or any other improper use.

Technical and Organisational Measures

During its operation, SIMINEO applies, in particular, the following security measures:

• authenticated user access;
• HttpOnly cookie-based session management;
• CSRF protection for session-based state-changing operations;
• passwords stored exclusively in hashed form;
• Recovery Codes stored exclusively in hashed form;
• permission- and role-based access control;
• additional protection for administrative operations;
• security logging and misuse prevention controls;
• secure HTTPS-based data transmission in production environments;
• security headers applied in production environments.

The SIMINEO frontend does not have direct access to the authentication session token and does not store it separately in browser-side storage.

Protection of User Accounts

To protect user accounts, SIMINEO uses authenticated sessions. Session lifetime is limited, and the system may invalidate existing sessions following certain events.

Such events may include, in particular:

• logout;
• password change;
• change of ownership of the email address;
• account deletion or GDPR-based account closure;
• certain administrative security measures.

Changing the email address requires Recovery Code verification and separate confirmation of the new email address. The Recovery Code is a security identifier that SIMINEO does not store in a readable form.

Account deletion or the execution of certain sensitive account operations may require additional verification, such as entering the current password.

Confidentiality and Integrity of Data

SIMINEO processes personal data exclusively under the access permissions necessary for operating the service. The system is designed to ensure that personal data are accessible only to those persons, systems, or service providers that require access for the relevant processing purpose.

SIMINEO maintains a clear separation between publicly displayed data and internal security, authentication, logging, and administrative data. Passwords, password hashes, Recovery Codes, Recovery Code hashes, session-related security data, and administrative and security log data do not constitute public profile data.

SIMINEO strives to ensure an appropriate level of confidentiality, integrity, and availability of the processed data throughout the operation of the service.

12. Logging, Monitoring and Misuse Prevention

To ensure the security, stability, and integrity of the service, SIMINEO implements security logging, monitoring, and misuse prevention systems. The data processed through these systems do not constitute public profile data and are used exclusively for purposes related to the operation, security, and maintenance of the service.

Security Logging

During the operation of the service, SIMINEO maintains security and operational logs. Their purposes include, in particular:

• maintaining the security of the service;
• investigating errors and security incidents;
• analysing incidents;
• protecting the integrity of the platform;
• ensuring the subsequent auditability of administrative actions.

Logged data may be used only to the extent necessary to fulfil the above purposes.

Monitoring

SIMINEO processes structured monitoring events for the purpose of supervising the operation of the service.

The purposes of monitoring include, in particular:

• ensuring the stable operation of the service;
• detecting system errors and abnormal operation;
• identifying security incidents and operational issues;
• generating automated alerts where necessary to support operational activities.

Security and monitoring messages and their related technical metadata are subject, where applicable, to filtering (sanitisation) in order to reduce the unnecessary processing of personal data. Depending on the specific security or monitoring event, the system may process in particular the request method, a request path stripped of its query string and fragment, technical event and status information, timestamps, and an IP address where this is necessary to maintain the security of the service, detect technical faults, or investigate misuse. Passwords, authentication tokens, cookies, and comparable security secrets are not intended to form part of regular log data and are removed or redacted within the scope of the applicable filtering and sanitisation mechanisms.

Misuse Prevention

For security and moderation purposes, SIMINEO applies procedures designed to detect and handle misuse of the service.

These procedures may include, in particular:

• detecting authentication and access-related abuse;
• investigating recurring errors and abnormal operation;
• detecting misuse related to uploads;
• supporting the handling of reports and moderation events;
• preserving the integrity and security of the platform.

SIMINEO does not use these data for marketing, advertising, or profiling purposes.

Administrative Logging

SIMINEO may record actions performed with administrative privileges in a dedicated administrative log for the purposes of accountability, security, and subsequent verification of the operation of the platform.

The administrative log may include, in particular:

• the type of administrative action;
• the time of the action;
• the type of the affected object;
• the identifier of the affected object;
• technical data related to the action;
• the IP address, where necessary.

The administrative log is accessible only to persons with the appropriate authorisation and does not form part of the users' publicly displayed data.

13. Files and Media Uploads

SIMINEO enables users, depending on the account type and the functions of the service, to upload image files. Such uploaded content may include, in particular, the business profile picture (avatar) and image content associated with business posts.

Uploaded Files

Before processing uploaded files, SIMINEO performs automatic checks to ensure that only files supported by the system and capable of being processed safely are accepted.

The checks may cover, in particular:

• the file type;
• the file size;
• the image dimensions and technical characteristics;
• the validity of the uploaded file.

The system may reject unsuitable or invalid uploads and may log them for security and misuse-prevention purposes.

Image Processing

SIMINEO may automatically process and optimise uploaded images in the manner necessary for the operation of the service.

The purposes of processing include, in particular:

• ensuring consistent display;
• efficient use of storage;
• optimising the performance of the service;
• applying supported image formats.

Storage

SIMINEO manages uploaded media files in separate storage areas.

In connection with uploads, the system may apply various technical safeguards, including in particular:

• upload quantity limits;
• storage usage quotas;
• verification of upload paths;
• maintaining the consistency of stored files;
• detecting and removing orphaned files that are no longer referenced in the database.

Deletion

Media files uploaded by the user may be deleted or prepared for deletion in connection with the deletion of the related content or user account.

Due to the operation of the system and technical background processes, the removal of media files may take place at different times. SIMINEO removes media files to the extent technically possible, but does not guarantee that deletion will take place immediately in every storage layer or backup.

Media files associated with content subject to moderation may also be retained temporarily for the purposes of the moderation process, preserving the integrity of the platform, or ensuring possible recovery.

14. Data Retention Periods

SIMINEO does not retain personal data for a uniform period of time. The retention period depends in each case on the type of data, the purpose of the processing, and the applicable legal obligations.

Different categories of data may follow different data retention lifecycles; therefore, the retention periods applicable to individual data may vary.

General Retention Periods

SIMINEO processes personal data only for as long as they are necessary to achieve the purpose of the processing or for as long as their retention is justified by legal, security, operational, or other legitimate operational interests.

When determining retention periods, the system distinguishes, in particular, between:

• data processed in the active system;
• archived data;
• data contained in backups;
• data processed by external service providers;
• data that must be retained under applicable legal obligations.

General Contact and Support Correspondence

General contact and support correspondence is processed for as long as necessary to handle the relevant enquiry and the associated legitimate communication, support, documentation or evidentiary purposes.

After an enquiry has been closed, the related correspondence may continue to be retained where this remains necessary in the specific case, in particular for follow-up enquiries, traceability of previous communications, conflict resolution, prevention of abuse, or the establishment, exercise or defence of legal claims.

No uniform rigid maximum retention period is applied to general contact and support correspondence independently of the purpose of processing. Continued necessity is reviewed at appropriate intervals. Unlimited retention solely for precautionary or convenience reasons is not intended.

Where a message forms part of a separate legal, moderation, data-protection, subscription-related or other specifically regulated procedure, the specific retention rules applicable to that procedure apply.

Company NOW

A Company NOW is designed as short-lived business content. An active Company NOW remains active for no longer than 24 hours from publication unless it is deleted earlier by the business or replaced with a new Company NOW.

Disabling additional public visibility ends the public availability of the Company NOW before login but does not automatically delete a Company NOW that remains active within the Service.

After expiry, deletion or replacement, a Company NOW is no longer provided as active content within the service. The original Company NOW data record may, however, remain in the active system for a limited period where this is necessary to investigate misuse or moderation issues arising shortly afterwards, to associate reports or platform actions with previously published content, or to enable necessary evidence preservation or the establishment, exercise or defence of related legal claims. This subsequent retention is based on Article 6(1)(f) GDPR and is limited to a maximum of 90 days from publication. During this subsequent retention period, the record is not used again as an active Company NOW and is not made publicly visible again. After expiry of the period, it is deleted from the active system as part of the regular retention and deletion cycle.

Where a Company NOW is reported because of a possible violation, a separate snapshot of the reported NOW text and the business information required for moderation is stored at the time of the report. The moderation report may also include the selected reporting reason and an additional description of the reporting reason entered by the reporting person. This applies in particular to the description required when “Other” is selected. These moderation data may continue to exist independently of the original Company NOW data record and are retained for handling and documenting the report, preventing misuse, and enforcing the platform rules for a maximum of 365 days from the time of the report, after which they are deleted from the active system.

The separate retention of such moderation data does not cause an expired, deleted, replaced or moderation-removed Company NOW to be made available again as active or publicly visible content. Independently of this, corresponding data may temporarily remain in backups; the backup rules described in this Section apply in such cases.

Radar and Saved Search Points

Radar search points saved by the user, including their names and geographic coordinates, are stored in the user account for as long as the user retains the relevant search point for further use.

When a saved search point is removed, it is removed from the active system in accordance with the technical deletion process. When the user account is deleted, the saved search points associated with that user account are also processed as part of the deletion process described in Section 15.

Business coordinates optionally provided by a business account for participation of the business in the Radar function remain stored in the active business profile for as long as the business account maintains that Radar participation by keeping the coordinates provided. If the business account removes both Radar coordinates, the business is no longer included in the Radar distance-based search. When the business account is deleted, the related Radar coordinates are processed as part of the deletion process applicable to the business profile.

The search radius selected by the user for an individual Radar search is not permanently stored as part of a saved Radar search point.

Corresponding data may temporarily remain in backups; the backup rules described in this Section apply in such cases.

Saved Cities for Business Accounts

A city saved by a business account, its normalised form used for technical matching, and the associated technical seen state remain in the active system for as long as the business account retains the relevant city for further use.

When the business account removes a saved city, the associated data are removed from the active system in accordance with the technical deletion process. When the business account is deleted, the saved cities and their associated technical seen states are also processed as part of the deletion process described in Section 15.

Corresponding data may temporarily remain in backups; the backup rules described in this Section apply in such cases.

Private Search Requests

A search request created by a private user is stored in the active system for as long as the user retains it for further use. The user may delete their own search request through the designated function. Responses from business accounts stored in connection with a search request are linked to that search request and are also removed from the active system when the search request is deleted. When the user account is deleted, the original search requests associated with that user account and the responses linked to them are processed as part of the deletion process described in Section 15.

Where a search request has previously been reported because of a possible violation, separately stored snapshots of the city and search text relating to the report, together with the associated moderation data, may continue to exist independently of the original search request. These moderation data are retained for handling and documenting the report, preventing misuse, and enforcing the platform rules for a maximum of 365 days from the time of the report, after which they are deleted from the active system.

Corresponding data may also temporarily remain in backups; the backup rules described in this Section apply in such cases.

Moderation Reports

Moderation reports submitted through specifically designed community reporting functions, in particular reports concerning Private Search Requests and Company NOW, are retained in the active system for no more than 365 days from the time of the report.

Depending on the relevant reporting function, these moderation data may include snapshots of the reported content, reporting reasons, additional explanations entered by the reporting person, technical associations required to identify the reported content, and data generated during the administrative processing of the report.

Deletion of the original reported content or deletion of the reporting person's user account does not necessarily result in the immediate deletion of the separate moderation report. Where provided for in the relevant reporting function, the association with the reporting person's account is anonymised when the account is deleted, while the remaining moderation record may continue to be retained within the applicable retention period.

AI Check – retention and deletion

Open AI Check cases and cases awaiting information are retained for the purposes of handling them. Closed cases become eligible for deletion after generally 365 days from closure if all associated notifications are recorded as sent or skipped. Pending, failed or unresolved sending states may delay automatic deletion; such cases are subject to operational monitoring and reconciliation.

Deleting a case also removes its dependent reports, reviews and notifications. During GDPR account deletion, outstanding notifications addressed to the deleted user are removed, and that user's identifiers in relevant AI Check reports and snapshots are anonymised or disconnected where limited case evidence must remain. General backup and restoration rules continue to apply.

Formal Notices Under Article 16 DSA

A formal notice concerning allegedly illegal content submitted under Article 16 DSA and the related processing data are retained while the notice is under review and until the relevant decision process has been completed, for as long as they are necessary for handling the notice and documenting the procedure.

After a formal notice has been decided, the notice and the associated decision documentation may be retained for a maximum further period of 1095 days from the date of the decision for accountability, traceability, and the preservation of evidence concerning the decision.

This maximum further retention period of 1095 days is an internal SIMINEO retention rule for the above purposes. It does not mean that the Digital Services Act imposes a general fixed three-year retention obligation for formal notices under Article 16 DSA.

The retained record may include the original notice data, the unique reference identifier, the processing status, the content association verified by SIMINEO, the decision, the reason for the decision, the individual explanation, any applicable legal or contractual basis, information concerning the administrative handling, relevant timestamps, and technical metadata concerning the sending of the associated emails.

At the end of the applicable retention period, the formal notice record, the associated decision documentation, and the related sending evidence are removed in accordance with the applicable deletion process. SIMINEO does not maintain a separate unlimited archive of these formal notice records beyond the defined retention period.

Purpose-Specific Contact Data for Communications to Affected Content Owners

Where SIMINEO stores a purpose-specific snapshot of the username and email address of an affected content owner for the purpose of sending a communication concerning a moderation decision or content restriction, these contact data are subject to a separate limited lifecycle.

If the affected user's account is deleted, the stored username snapshot is removed. The purpose-specific email address may be retained only for as long as it is still required for an active sending or retry process.

The purpose-specific email address is removed after successful sending of the required communication or, where sending remains unsuccessful, after no more than six unsuccessful sending attempts. Technical metadata documenting the sending attempts, their status, and relevant timestamps may continue to be retained without the purpose-specific contact snapshot where such retention remains necessary under the applicable moderation or evidence retention rules.

Administrative Audit Logs

Administrative audit logs are retained in the active database system for a maximum of 365 days from the original administrative event.

Where administrative audit data are transferred into a technically validated archive for accountability, traceability, security, or evidentiary purposes, the total retention period does not exceed 1095 days from the original creation timestamp of the relevant audit event.

The retention period is calculated from the original timestamp of the audit event and not from a later modification date of an archive file.

Automatic deletion of archived audit data is performed only where the archive has been technically validated and the data contained in it are fully beyond the applicable retention period. An invalid, incomplete, corrupted, or otherwise unverifiable archive is not deleted solely on the basis of the age of the archive file.

Reach, Usage and Performance Statistics

Individual statistical events are retained in the live system only for a limited period. A retention period of 90 days applies to these events. As part of the daily retention and deletion cycle, events that are older than 90 days are deleted.

Completed calendar days are additionally converted into aggregated daily statistics. For business accounts, such daily aggregates may be retained for the long-term presentation of the development and performance of the business's own SIMINEO presence for as long as the relevant business account continues to exist.

SIMINEO may also retain long-term platform-wide daily aggregates. These contain no user, business, or post identifier and consist solely of aggregated figures for the relevant calendar day. They are used for the long-term assessment of the development, usage, and reach of the platform.

Remind Me – Personal Post Reminders

Stored “Remind Me” reminders are generally retained in the active system until 30 days after the reminder time selected by the user. Automatic deletion is based on that reminder time and applies irrespective of the technical delivery status reached by the reminder.

Earlier deletion may occur in particular where the user deletes the reminder, the user account is deleted, or the relevant post is physically removed from the system.

Activity Events

Technical activity events used within the service, in particular to provide activity indicators and to maintain traceability of related platform events, are retained for no longer than 90 days from their creation. This period applies regardless of whether an activity event has already been marked as seen or read. After expiry of the period, the activity event is deleted from the active system as part of the regular retention and deletion cycle.

Push Subscriptions

Technical push-subscription data are processed for as long as they are required to provide the push functionality permitted by the user and their continuing technical validity is actually confirmed.

A push subscription whose continued validity has not been established through an intended genuine confirmation event for a period of 365 days is treated as stale and removed from the active system as part of the regular retention and deletion cycle. Logout, deletion of the user account, or identification of a permanently unavailable push endpoint may result in earlier deletion.

Unverified Registrations

Where a user account created through the regular registration process is not confirmed by email-address verification, it is retained in the active system only for a limited period. Unverified registrations that are older than 30 days are deleted from the active system as part of the regular retention and deletion cycle.

This automatic deletion rule does not apply to user accounts that have already been verified or to accounts that are undergoing a separate provisioning or initial-claim process. Data relating to a registration already deleted from the active system may temporarily remain in backups; the backup rules described in this Section apply in such cases.

Authentication and Security Artifacts

Temporary authentication and security artifacts are retained only for the period required for their respective security purpose.

Email-verification tokens are time-limited and are generally retained only until expiry; their regular validity period is approximately 24 hours. The verification token itself is not stored server-side in plaintext, but only in hashed form.

Password-reset tokens are retained only until the end of their defined validity period and may be removed by the regular technical deletion process after expiry.

Administrative login challenges are removed after expiry. Administrative login challenges that have already been used may remain for a limited technical security and traceability period of no more than 24 hours after use and are then deleted.

Current Recovery Code hashes are retained only for as long as they are required for the relevant user-account security function. They are replaced upon rotation and the related Recovery data are removed in connection with account deletion. SIMINEO does not store Recovery Codes in plaintext.

Operational Logs, Monitoring and Alerts

Security and operational messages processed through the standard output or standard error output of the production application container are subject to technically bounded log rotation based on file size and the number of retained log files. These running container logs therefore do not have a uniform retention period expressed in calendar days; their volume is limited by the production rotation configuration.

Structured monitoring events are retained in the live system for no more than 90 days. Before deletion, they may be archived for a limited additional period. Such a monitoring archive is retained for no more than a further 90 days from the time of archiving and is then permanently deleted.

Technical alerts that have already been resolved remain in the live system for no more than 30 days after resolution. They may then be retained before deletion in a limited archive for no more than a further 90 days from the time of archiving. After expiry of that archive period, they are permanently deleted.

Technical Billing and Subscription Evidence

Technical SIMINEO records required for the limited traceability of subscription and billing events are generally retained for three calendar years using a year-end calculation mechanism. This period is therefore not calculated simply as a fixed period of 1095 days.

This technical evidence rule is separate from statutory retention obligations applicable to invoices, accounting records, or tax-relevant business documents. Technical webhook or subscription-event data are not treated as long-term accounting records solely because they relate to a payment.

Ongoing subscription data or subscription data still required for the administration of an existing subscription are not deleted solely because of their age. The limited technical evidence period described above may apply to subscription records that have already been deleted.

Files Without an Existing Database Reference

When technically identifying orphaned upload files, SIMINEO applies a minimum protection period of 24 hours from the relevant file modification time. A more recent file that currently has no database reference is not treated as a deletable orphan solely because the reference is missing.

After expiry of this protection period, a file that remains unreferenced may be deleted through a controlled cleanup process. Before actual deletion, the system checks the database reference and additional technical file properties again in order to avoid accidental deletion of files that have meanwhile been used or changed.

The 24-hour minimum protection period is a technical safety period designed to prevent accidental deletion of an upload that has not yet been fully linked. It is not a separate data-protection retention period.

Retention Required by Law

Certain personal data may need to be retained in order to comply with legal obligations, including accounting, tax, or other statutory requirements.

Certain external service providers—particularly the payment service provider—may also apply their own data retention rules independently of SIMINEO's data processing, where required by their own legal obligations.

Backups

To ensure the secure operation of the service, SIMINEO may create backups of the system's data.

Backups may temporarily contain personal data that have already been deleted or anonymised in the live system. These backups follow their own retention lifecycle and do not result in the reactivation or restoration of deleted or anonymised user accounts.

SIMINEO applies a tiered backup retention lifecycle. Valid daily recovery points are retained for 0 to 6 days. Thereafter, the newest valid recovery point for each ISO calendar week may be retained for up to 30 days, followed by the newest valid recovery point for each calendar month for up to 90 days as a disaster-recovery backup. Recovery points are removed through the designated technical process once they reach 90 days. The short-term local backup layer is maintained on the production system, while selected longer-lived recovery points are stored as a separate off-machine copy on a Hetzner Storage Box in Falkenstein, Germany.

The limited continued existence of previously backed-up data serves exclusively recovery after technical failure or data loss and is not used to circumvent deletion carried out in the active system. Deleted or anonymised user accounts and content are not returned to normal platform operation solely because they remain temporarily present in a backup.

Expiry of the Retention Period

Where the purpose of processing personal data has ceased and SIMINEO is no longer required to retain the data under applicable law or any other legal basis for processing, the personal data will be deleted or anonymised.

The deletion of a user account does not automatically mean that personal data immediately disappear from every storage layer, archived dataset, or backup. Such data continue to be processed in accordance with the retention rules applicable to them.

15. Account Deletion and Deletion of Personal Data

SIMINEO enables users to delete their own accounts. Account deletion is a separate data processing process aimed at terminating the processing of personal data, which the system carries out in accordance with applicable law.

Deletion of the User Account

During account deletion, SIMINEO deactivates the user account, terminates the active sessions associated with it, and carries out the data processing operations related to account deletion.

In certain cases, initiating account deletion may be subject to additional security verification, in particular entering the current password.

During account deletion, the system also processes the related data, including in particular contact data, content created by the user, media files, and local records related to the subscription.

When a business account is deleted, the individual statistical events associated with that business and the business-specific long-term daily statistics are deleted from the live system. Platform-wide daily aggregates that have already been created may remain because they contain no user, business, or post identifier and are not stored as business-specific performance statistics.

Moderation and Evidence Data Upon Account Deletion

Separate moderation records, administrative audit data, and records retained for legal accountability or evidentiary purposes are not necessarily deleted solely because the associated user account is deleted. Such data may continue to be retained only where and for as long as the relevant purpose, legal basis, and retention period described in this Policy continue to apply.

Where a community moderation report is retained after account deletion, the association with the reporting person's user account is anonymised where provided for in the relevant reporting function, while the moderation snapshot and other data required for the moderation record may continue to be retained within the applicable retention period.

Where a purpose-specific contact snapshot has been stored for communicating a moderation decision or content restriction to an affected content owner, the username snapshot is removed when the account is deleted. The purpose-specific email address may remain only while it is required for an active sending or retry process and is removed after successful sending or after no more than six unsuccessful sending attempts.

A formal notice under Article 16 DSA that has already been decided, together with the associated decision documentation and technical evidence, may continue to be retained after deletion of an associated user account only within the limited retention period described in Section 14.

Anonymisation

Where complete deletion of personal data is not possible or is not justified for legal, security, or operational reasons, SIMINEO may anonymise certain personal data.

The purpose of anonymisation is to ensure that the user's identity is no longer directly identifiable, while the processing of data necessary for the operation of the system or required to be retained by law can continue to be ensured.

Remaining Data

Account deletion does not in every case result in the immediate or complete deletion of all data.

Certain data may continue to be retained after account deletion, in particular:

• for compliance with legal obligations;
• on the basis of accounting or tax requirements;
• for security and misuse-prevention purposes;
• for moderation or audit purposes;
• on the basis of external service providers' own legal obligations.

Such data are processed only where an appropriate legal basis exists.

Handling of Backups

Account deletion affects data processing operations carried out in the live system. Backups created previously may temporarily still contain personal data that have already been deleted or anonymised in the live system.

Backups are handled in accordance with their own retention rules and may not result in the reactivation of a deleted or anonymised user account or the reversal of the deletion process.

To technically preserve the effect of account deletion, SIMINEO additionally maintains a separate Recovery Safety Journal. It does not contain a copy of the deleted profile, published content or authentication data, but only a minimal internal account reference and technical event, sequence, timestamp and integrity information required to enforce an already completed account deletion even after restoring an older system state. In the current architecture, confirmed journal entries are not automatically deleted solely because of their age, because their continued availability is required to prevent a deleted account from being reactivated through a historical restore. Any future limitation, compaction or replacement of these entries may only be introduced if a technically equivalent safeguard against the reactivation of effectively deleted accounts is preserved.

16. Rights of Data Subjects

SIMINEO respects and ensures the exercise of the rights granted to data subjects under the GDPR. The conditions, possible limitations, and exceptions relating to the exercise of individual rights are determined by the applicable laws.

Right to Information

The data subject has the right to receive clear, transparent, and easily understandable information about the processing of their personal data. This Privacy Policy serves to fulfil that obligation.

Right of Access

The data subject has the right to request information as to whether SIMINEO processes personal data concerning them and to access the information relating to such processing as defined by law.

Users may also directly view the data available in their own accounts.

SIMINEO provides a self-service function in the logged-in profile that allows users, after confirming their current password, to request a copy of the directly exportable personal data associated with their account. The one-time download link is sent to the registered email address and is valid for 30 minutes. For further access requests under Article 15 GDPR that require individual review, contact [email protected]. This does not affect the rights of the data subject under the GDPR.

Identity Verification for Data Subject Requests

When handling requests to exercise rights under Articles 15 to 21 GDPR, SIMINEO uses existing and appropriate means of confirming identity wherever possible. For protected self-service functions, these may include the existing authenticated session, reconfirmation of the current password and confirmation through the registered email address.

Only where SIMINEO has reasonable doubts concerning the identity of the person making the request may additional information necessary to confirm identity be requested in accordance with Article 12(6) GDPR. The type and extent of verification depend on the particular request, the data concerned and the risk of unauthorised disclosure or alteration. Under the currently implemented procedure, SIMINEO does not request copies of identity cards, passports or comparable identity documents and does not use such document copies as a regular means of identity verification. Where reasonable doubts concerning identity exist, existing and less intrusive means of confirming identity must be used first where they are sufficient for the particular case.

Passwords and Recovery Codes must not be sent to SIMINEO by email or through a public contact form. Where such security information is required by an existing protected account function, it must be entered only through the designated secure SIMINEO interface. For requests made by persons without a user account, the necessary verification method is determined according to the specific data and circumstances of the individual case.

Response Time for Data Subject Requests

SIMINEO provides the data subject with information on action taken on a request under Articles 15 to 22 GDPR without undue delay and in any event within one month of receipt of the request.

Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two further months. SIMINEO informs the data subject of any such extension within one month of receipt of the request and provides the reasons for the delay at the same time.

Where the request was submitted electronically, the corresponding information is provided electronically where possible, unless the data subject requests otherwise.

Where SIMINEO does not take action on a data subject's request, the data subject is informed without undue delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a data protection supervisory authority and seeking a judicial remedy.

Right to Rectification

The data subject has the right to request the rectification of inaccurate personal data concerning them and the completion of incomplete data.

Data that can be modified in the user account may also be updated directly through the relevant interface of the service.

Right to Erasure

The data subject has the right to request the deletion of their personal data where the conditions set out in the GDPR are met.

SIMINEO carries out account deletion and the related data processing processes as described in Section 15 of this Policy.

Right to Restriction of Processing

The data subject has the right to request the restriction of the processing of their personal data in the cases specified by the GDPR.

Requests for restriction of processing may be submitted to [email protected]. SIMINEO assesses such requests individually. Where restriction is required, the affected personal data remain stored to the extent necessary but are not used for ordinary further processing outside the cases permitted by Article 18(2) GDPR. Depending on the affected data, appropriate technical or organisational measures may be used to make the data temporarily unavailable or otherwise prevent ordinary further processing. Before an existing restriction is lifted, the data subject will be informed in accordance with Article 18(3) GDPR.

Notification of Recipients under Article 19 GDPR

Where SIMINEO actually carries out a rectification under Article 16 GDPR, an erasure under Article 17(1) GDPR or a restriction of processing under Article 18 GDPR, SIMINEO will in principle also communicate that measure to recipients to whom the affected personal data were previously disclosed. This does not apply where such communication proves impossible or would involve disproportionate effort.

Whether and by what means such communication or technical propagation is required depends on the specific data flow, the data actually disclosed and the role of the relevant recipient. Independent controllers may continue to process personal data on the basis of their own legal obligations.

At the data subject's request, SIMINEO will provide information about the recipients falling within Article 19 GDPR in the relevant case.

Right to Data Portability

Under Article 20 GDPR, the data subject has the right to receive personal data concerning them which they have provided to SIMINEO in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from SIMINEO where the processing is based on consent or on a contract and is carried out by automated means.

SIMINEO provides Private and Company accounts with a protected self-service function through which a directly exportable copy of account and operational data can be requested in JSON format. This data copy has a broader scope than the right to data portability under Article 20 GDPR. Only those personal data contained in the copy for which the statutory requirements of Article 20 are actually met fall within the right to data portability.

Where technically feasible, the data subject may also request that data falling within Article 20 GDPR be transmitted directly to another controller. Such requests, and portability cases that are not adequately covered by the automated data copy, may be submitted to [email protected]. The exercise of the right to data portability must not adversely affect the rights and freedoms of others.

Right to Object

The data subject has the right to object to the processing of their personal data where the legal basis of the processing allows this.

In particular, the data subject has the right, on grounds relating to their particular situation, to object at any time to the processing of personal data concerning them where such processing is based on Article 6(1)(e) or (f) GDPR. Following such an objection, SIMINEO will no longer process the affected personal data for the relevant purpose unless SIMINEO demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.

An objection may be submitted to [email protected] and will be assessed individually with regard to the specific processing activity concerned and the particular situation of the data subject. SIMINEO does not currently process personal data for direct marketing purposes. If such processing is introduced in the future, an objection to processing for direct marketing purposes would result in the personal data no longer being processed for those purposes.

Withdrawal of Consent

Where any processing is based on the consent of the data subject, such consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

In the currently audited operation, SIMINEO does not base ordinary platform processing on consent under Article 6(1)(a) GDPR. In particular, acceptance of the Terms, the 18+ confirmation, acknowledgement of the Privacy Policy and a notification permission granted through the browser or operating system do not constitute such data-protection consent to additional SIMINEO processing purposes.

If SIMINEO introduces processing based on consent in the future, the data subject will be informed of the right to withdraw consent before consent is given. Withdrawal must be as easy as giving consent; therefore, the relevant function must provide an appropriate and easily accessible withdrawal method when consent is collected.

17. International Data Transfers

SIMINEO primarily uses infrastructure located within the European Union. However, for certain external services, it may be necessary for personal data to be processed outside the European Economic Area (EEA) or transferred there.

Cases of Data Transfer

International data transfers may occur in particular where services use global infrastructure or international processing and support structures.

Based on the current technical and contractual configuration, this applies in particular to:

• Google Workspace: for sending, receiving and processing transactional as well as general contact and support emails; processing outside the EEA may occur within Google's global infrastructure;
• Cloudflare: for DNS, reverse proxy, TLS, DDoS protection and security functions; processing outside the EEA may occur due to its global infrastructure;
• Paddle: for payment processing, subscription management and Merchant-of-Record functions; data may be processed in the United Kingdom and within international processing structures;
• Web Push services of the browser or operating system used: for delivering push notifications. The specific push service is determined by the user's browser or operating system and may use infrastructure outside the EEA. SIMINEO uses the standardised Web Push mechanism for this purpose and does not use a fixed provider-specific push SDK integration.

SIMINEO's production hosting is currently provided by Hetzner at its Falkenstein location in Germany. No regular third-country transfer has been identified for this current hosting configuration.

Safeguards Applied

Where personal data are transferred to a third country, the transfer takes place only in accordance with the requirements of Chapter V of the GDPR.

Where an adequacy decision of the European Commission under Article 45 GDPR applies to the relevant third country or specific recipient, the transfer may take place on that basis. This may include the EU-U.S. Data Privacy Framework for appropriately certified recipients in the United States where it applies.

Where no applicable adequacy decision exists, the Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR may in particular be used, together with, where required, an assessment of the level of protection in the recipient country and supplementary technical, organisational or contractual measures.

The safeguard applicable in a specific case depends on the relevant service provider, recipient, processing route and destination country. SIMINEO does not treat the mere inclusion of a country in a service provider's global subprocessor or infrastructure list, without further indications, as evidence that SIMINEO data are actually transferred to that country.

Data Minimisation and Technical Safeguards

SIMINEO limits personal data transferred to external services to what is necessary for the relevant processing purpose. Measures include, in particular, encryption in transit, minimisation of email and payment data, and standard Web Push encryption. When sending Web Push notifications, SIMINEO does not transmit an email address, name or direct SIMINEO profile ID to the push service determined by the browser or operating system.

18. Amendments to this Policy

SIMINEO reserves the right to amend this Privacy Policy where necessary.

Amendments may be made in particular in the following cases:

• changes in applicable law;
• changes to the operation or functions of the service;
• introduction of a new data processing process;
• changes in data protection or information security requirements.

The version of the Policy in force at any given time is available on SIMINEO's official website.

Unless otherwise provided, amendments take effect upon publication or on the effective date specified in the Policy.

Where an amendment materially affects users, SIMINEO may inform the affected persons in an appropriate manner according to the circumstances.

19. Contact

If you have any questions regarding this Privacy Policy, the processing of personal data, or the exercise of data subject rights, you may contact SIMINEO using the following contact details:

Data Controller:

Jozsef Török

Email:

[email protected]

Website:

https://simineo.com

SIMINEO reviews incoming inquiries in accordance with applicable data protection laws and responds within the time limit specified by law.

20. Official External References

The following links point to the websites of official organisations, service providers, or legal sources referred to in this Privacy Policy.

• Paddle – Privacy Notice
• Hetzner – Privacy Policy
• Google Workspace – Data Processing Terms
• Google – Privacy Policy
• GDPR – Regulation (EU) 2016/679
• LfDI Baden-Württemberg

21. Competent Supervisory Authority

If the data subject considers that SIMINEO processes their personal data in a manner that does not comply with applicable data protection laws, they have the right to lodge a complaint with the competent data protection supervisory authority.

The supervisory authority competent for SIMINEO is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)

Heilbronner Straße 35

70191 Stuttgart

Germany

Email:

[email protected]

Website:

https://www.baden-wuerttemberg.datenschutz.de

The data subject also has the right to seek a judicial remedy in accordance with the provisions of the GDPR.